Manage GCP BigQuery Analytics Hub Data Exchange IAM Policies

The gcp:bigqueryanalyticshub/dataExchangeIamPolicy:DataExchangeIamPolicy resource, part of the Pulumi GCP provider, controls IAM permissions for BigQuery Analytics Hub data exchanges using three distinct approaches. This guide focuses on three capabilities: authoritative policy replacement (DataExchangeIamPolicy), role-level member binding (DataExchangeIamBinding), and incremental member addition (DataExchangeIamMember).

All three resources reference an existing data exchange by project, location, and dataExchangeId. The examples are intentionally small. Combine them with your own data exchange infrastructure and organizational IAM policies.

Replace the entire IAM policy for a data exchange

When you need complete control over who can access a data exchange, you can set the entire IAM policy at once, replacing any existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.bigqueryanalyticshub.DataExchangeIamPolicy("policy", {
    project: dataExchange.project,
    location: dataExchange.location,
    dataExchangeId: dataExchange.dataExchangeId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.bigqueryanalyticshub.DataExchangeIamPolicy("policy",
    project=data_exchange["project"],
    location=data_exchange["location"],
    data_exchange_id=data_exchange["dataExchangeId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigqueryanalyticshub"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = bigqueryanalyticshub.NewDataExchangeIamPolicy(ctx, "policy", &bigqueryanalyticshub.DataExchangeIamPolicyArgs{
			Project:        pulumi.Any(dataExchange.Project),
			Location:       pulumi.Any(dataExchange.Location),
			DataExchangeId: pulumi.Any(dataExchange.DataExchangeId),
			PolicyData:     pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.BigQueryAnalyticsHub.DataExchangeIamPolicy("policy", new()
    {
        Project = dataExchange.Project,
        Location = dataExchange.Location,
        DataExchangeId = dataExchange.DataExchangeId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamPolicy;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new DataExchangeIamPolicy("policy", DataExchangeIamPolicyArgs.builder()
            .project(dataExchange.project())
            .location(dataExchange.location())
            .dataExchangeId(dataExchange.dataExchangeId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:bigqueryanalyticshub:DataExchangeIamPolicy
    properties:
      project: ${dataExchange.project}
      location: ${dataExchange.location}
      dataExchangeId: ${dataExchange.dataExchangeId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The DataExchangeIamPolicy resource is authoritative: it replaces the entire IAM policy for the data exchange. The policyData property accepts output from getIAMPolicy, which defines bindings between roles and members. This approach cannot be used alongside DataExchangeIamBinding or DataExchangeIamMember resources, as they would conflict over policy ownership.

Grant a role to multiple members at once

When multiple users or service accounts need the same level of access, you can bind them all to a single role without affecting other role assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.bigqueryanalyticshub.DataExchangeIamBinding("binding", {
    project: dataExchange.project,
    location: dataExchange.location,
    dataExchangeId: dataExchange.dataExchangeId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.bigqueryanalyticshub.DataExchangeIamBinding("binding",
    project=data_exchange["project"],
    location=data_exchange["location"],
    data_exchange_id=data_exchange["dataExchangeId"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigqueryanalyticshub"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bigqueryanalyticshub.NewDataExchangeIamBinding(ctx, "binding", &bigqueryanalyticshub.DataExchangeIamBindingArgs{
			Project:        pulumi.Any(dataExchange.Project),
			Location:       pulumi.Any(dataExchange.Location),
			DataExchangeId: pulumi.Any(dataExchange.DataExchangeId),
			Role:           pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.BigQueryAnalyticsHub.DataExchangeIamBinding("binding", new()
    {
        Project = dataExchange.Project,
        Location = dataExchange.Location,
        DataExchangeId = dataExchange.DataExchangeId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamBinding;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new DataExchangeIamBinding("binding", DataExchangeIamBindingArgs.builder()
            .project(dataExchange.project())
            .location(dataExchange.location())
            .dataExchangeId(dataExchange.dataExchangeId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:bigqueryanalyticshub:DataExchangeIamBinding
    properties:
      project: ${dataExchange.project}
      location: ${dataExchange.location}
      dataExchangeId: ${dataExchange.dataExchangeId}
      role: roles/viewer
      members:
        - user:jane@example.com

The DataExchangeIamBinding resource is authoritative for a specific role: it controls all members assigned to that role while preserving other roles in the policy. The members property accepts a list of identities (users, service accounts, groups). You can use DataExchangeIamBinding alongside DataExchangeIamMember resources, but only if they manage different roles.

Add a single member to a role incrementally

When you need to grant access to one user without disturbing existing permissions, you can add individual members to roles non-authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.bigqueryanalyticshub.DataExchangeIamMember("member", {
    project: dataExchange.project,
    location: dataExchange.location,
    dataExchangeId: dataExchange.dataExchangeId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.bigqueryanalyticshub.DataExchangeIamMember("member",
    project=data_exchange["project"],
    location=data_exchange["location"],
    data_exchange_id=data_exchange["dataExchangeId"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigqueryanalyticshub"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bigqueryanalyticshub.NewDataExchangeIamMember(ctx, "member", &bigqueryanalyticshub.DataExchangeIamMemberArgs{
			Project:        pulumi.Any(dataExchange.Project),
			Location:       pulumi.Any(dataExchange.Location),
			DataExchangeId: pulumi.Any(dataExchange.DataExchangeId),
			Role:           pulumi.String("roles/viewer"),
			Member:         pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.BigQueryAnalyticsHub.DataExchangeIamMember("member", new()
    {
        Project = dataExchange.Project,
        Location = dataExchange.Location,
        DataExchangeId = dataExchange.DataExchangeId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamMember;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new DataExchangeIamMember("member", DataExchangeIamMemberArgs.builder()
            .project(dataExchange.project())
            .location(dataExchange.location())
            .dataExchangeId(dataExchange.dataExchangeId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:bigqueryanalyticshub:DataExchangeIamMember
    properties:
      project: ${dataExchange.project}
      location: ${dataExchange.location}
      dataExchangeId: ${dataExchange.dataExchangeId}
      role: roles/viewer
      member: user:jane@example.com

The DataExchangeIamMember resource is non-authoritative: it adds one member to a role without affecting other members already assigned to that role. The member property accepts a single identity string. This is the safest approach when multiple teams manage access to the same data exchange, as it preserves permissions set by other resources.

Beyond these examples

These snippets focus on specific IAM management approaches: authoritative policy replacement, role-level binding management, and incremental member addition. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as BigQuery Analytics Hub data exchanges (project, location, dataExchangeId). They focus on configuring IAM permissions rather than provisioning the data exchange itself.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition blocks)
Service account impersonation
Custom role definitions
Policy retrieval without modification (data source usage)

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the DataExchangeIamPolicy resource reference for all available configuration options.

Let's manage GCP BigQuery Analytics Hub Data Exchange IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resource should I use to manage data exchange permissions?

You have three options:

DataExchangeIamPolicy - Authoritative, replaces the entire IAM policy
DataExchangeIamBinding - Authoritative for a specific role, preserves other roles
DataExchangeIamMember - Non-authoritative, adds a single member to a role without affecting other members

Can I use DataExchangeIamPolicy with DataExchangeIamBinding or DataExchangeIamMember?

No, DataExchangeIamPolicy cannot be used with DataExchangeIamBinding or DataExchangeIamMember as they will conflict over policy management. Choose one approach for your data exchange.

Can I use DataExchangeIamBinding and DataExchangeIamMember together?

Yes, but only if they don’t grant privileges to the same role. Each role must be managed by either DataExchangeIamBinding or DataExchangeIamMember, not both.

Configuration & Usage

Where does the policyData for DataExchangeIamPolicy come from?

The policyData property requires output from the gcp.organizations.getIAMPolicy data source, as shown in the example with bindings for roles and members.

Can I change the dataExchangeId, location, or project after creation?

No, dataExchangeId, location, and project are all immutable and cannot be changed after the resource is created.

What formats can I use when importing IAM resources?

You can use any of these formats: projects/{{project}}/locations/{{location}}/dataExchanges/{{data_exchange_id}}, {{project}}/{{location}}/{{data_exchange_id}}, {{location}}/{{data_exchange_id}}, or just {{data_exchange_id}}. Variables not provided are taken from the provider configuration.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides