Manage GCP BigQuery Analytics Hub Data Exchange IAM

The gcp:bigqueryanalyticshub/dataExchangeIamMember:DataExchangeIamMember resource, part of the Pulumi GCP provider, manages IAM permissions for BigQuery Analytics Hub data exchanges by adding individual members to roles. This guide focuses on three approaches: non-authoritative member grants, role-level binding management, and full policy replacement.

IAM resources for data exchanges come in three variants with different authoritativeness levels. The DataExchangeIamPolicy resource replaces the entire policy and conflicts with binding and member resources. The DataExchangeIamBinding resource manages all members for one role. The DataExchangeIamMember resource (this page) adds one member to one role non-authoritatively. The examples are intentionally small. Choose the resource type that matches your access control model.

Grant a single user access to a data exchange

When you need to add one identity to a role without affecting other permissions, the member resource provides non-authoritative access control.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.bigqueryanalyticshub.DataExchangeIamMember("member", {
    project: dataExchange.project,
    location: dataExchange.location,
    dataExchangeId: dataExchange.dataExchangeId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.bigqueryanalyticshub.DataExchangeIamMember("member",
    project=data_exchange["project"],
    location=data_exchange["location"],
    data_exchange_id=data_exchange["dataExchangeId"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigqueryanalyticshub"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bigqueryanalyticshub.NewDataExchangeIamMember(ctx, "member", &bigqueryanalyticshub.DataExchangeIamMemberArgs{
			Project:        pulumi.Any(dataExchange.Project),
			Location:       pulumi.Any(dataExchange.Location),
			DataExchangeId: pulumi.Any(dataExchange.DataExchangeId),
			Role:           pulumi.String("roles/viewer"),
			Member:         pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.BigQueryAnalyticsHub.DataExchangeIamMember("member", new()
    {
        Project = dataExchange.Project,
        Location = dataExchange.Location,
        DataExchangeId = dataExchange.DataExchangeId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamMember;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new DataExchangeIamMember("member", DataExchangeIamMemberArgs.builder()
            .project(dataExchange.project())
            .location(dataExchange.location())
            .dataExchangeId(dataExchange.dataExchangeId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:bigqueryanalyticshub:DataExchangeIamMember
    properties:
      project: ${dataExchange.project}
      location: ${dataExchange.location}
      dataExchangeId: ${dataExchange.dataExchangeId}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies the identity to grant access, using formats like “user:jane@example.com” for Google accounts or “serviceAccount:app@project.iam.gserviceaccount.com” for service accounts. The role property defines the permission level. This resource adds the member without removing other identities already granted the same role, making it safe to use alongside other member resources for the same data exchange.

Manage all members for a single role

To control the complete list of identities for a specific role, use the binding resource.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.bigqueryanalyticshub.DataExchangeIamBinding("binding", {
    project: dataExchange.project,
    location: dataExchange.location,
    dataExchangeId: dataExchange.dataExchangeId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.bigqueryanalyticshub.DataExchangeIamBinding("binding",
    project=data_exchange["project"],
    location=data_exchange["location"],
    data_exchange_id=data_exchange["dataExchangeId"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigqueryanalyticshub"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bigqueryanalyticshub.NewDataExchangeIamBinding(ctx, "binding", &bigqueryanalyticshub.DataExchangeIamBindingArgs{
			Project:        pulumi.Any(dataExchange.Project),
			Location:       pulumi.Any(dataExchange.Location),
			DataExchangeId: pulumi.Any(dataExchange.DataExchangeId),
			Role:           pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.BigQueryAnalyticsHub.DataExchangeIamBinding("binding", new()
    {
        Project = dataExchange.Project,
        Location = dataExchange.Location,
        DataExchangeId = dataExchange.DataExchangeId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamBinding;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new DataExchangeIamBinding("binding", DataExchangeIamBindingArgs.builder()
            .project(dataExchange.project())
            .location(dataExchange.location())
            .dataExchangeId(dataExchange.dataExchangeId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:bigqueryanalyticshub:DataExchangeIamBinding
    properties:
      project: ${dataExchange.project}
      location: ${dataExchange.location}
      dataExchangeId: ${dataExchange.dataExchangeId}
      role: roles/viewer
      members:
        - user:jane@example.com

The members property takes an array of identities that will have the specified role. This resource is authoritative for the role: it replaces all existing members for that role while preserving other roles in the policy. You can combine multiple binding resources for different roles on the same data exchange, but each role can only have one binding resource.

Replace the entire IAM policy for a data exchange

Organizations with centralized access control can set the complete IAM policy using the policy resource.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.bigqueryanalyticshub.DataExchangeIamPolicy("policy", {
    project: dataExchange.project,
    location: dataExchange.location,
    dataExchangeId: dataExchange.dataExchangeId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.bigqueryanalyticshub.DataExchangeIamPolicy("policy",
    project=data_exchange["project"],
    location=data_exchange["location"],
    data_exchange_id=data_exchange["dataExchangeId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigqueryanalyticshub"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = bigqueryanalyticshub.NewDataExchangeIamPolicy(ctx, "policy", &bigqueryanalyticshub.DataExchangeIamPolicyArgs{
			Project:        pulumi.Any(dataExchange.Project),
			Location:       pulumi.Any(dataExchange.Location),
			DataExchangeId: pulumi.Any(dataExchange.DataExchangeId),
			PolicyData:     pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.BigQueryAnalyticsHub.DataExchangeIamPolicy("policy", new()
    {
        Project = dataExchange.Project,
        Location = dataExchange.Location,
        DataExchangeId = dataExchange.DataExchangeId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamPolicy;
import com.pulumi.gcp.bigqueryanalyticshub.DataExchangeIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new DataExchangeIamPolicy("policy", DataExchangeIamPolicyArgs.builder()
            .project(dataExchange.project())
            .location(dataExchange.location())
            .dataExchangeId(dataExchange.dataExchangeId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:bigqueryanalyticshub:DataExchangeIamPolicy
    properties:
      project: ${dataExchange.project}
      location: ${dataExchange.location}
      dataExchangeId: ${dataExchange.dataExchangeId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The policyData property accepts the output from getIAMPolicy, which defines all roles and members in a single structure. This resource replaces the entire IAM policy for the data exchange. It cannot be used with binding or member resources because they would conflict over policy ownership.

Beyond these examples

These snippets focus on specific IAM management approaches: non-authoritative member grants, role-level binding management, and full policy replacement. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as a BigQuery Analytics Hub data exchange. They focus on IAM configuration rather than provisioning the data exchange itself.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Federated identity configuration
Multiple role management in a single resource

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the DataExchangeIamMember resource reference for all available configuration options.

Let's manage GCP BigQuery Analytics Hub Data Exchange IAM

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between DataExchangeIamPolicy, DataExchangeIamBinding, and DataExchangeIamMember?

DataExchangeIamPolicy is authoritative and replaces the entire IAM policy. DataExchangeIamBinding is authoritative for a specific role but preserves other roles. DataExchangeIamMember is non-authoritative and adds a single member to a role while preserving other members.

Can I use DataExchangeIamPolicy with DataExchangeIamBinding or DataExchangeIamMember?

No, DataExchangeIamPolicy cannot be used with DataExchangeIamBinding or DataExchangeIamMember as they will conflict over the IAM policy.

Can I use DataExchangeIamBinding and DataExchangeIamMember together?

Yes, but only if they don’t grant privileges to the same role. Using both for the same role causes conflicts.

Configuration & Identity Formats

What identity formats can I use for the member parameter?

You can use allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

How do I format custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.

Are dataExchangeId, location, and project immutable?

Yes, all three properties are required and immutable. They identify the parent data exchange resource for the IAM binding.

Import & Management

How do I import IAM resources?

Use space-delimited identifiers based on resource type:

Member: resource role member (e.g., "projects/{project}/locations/{location}/dataExchanges/{id} roles/viewer user:jane@example.com")
Binding: resource role (e.g., "projects/{project}/locations/{location}/dataExchanges/{id} roles/viewer")
Policy: resource only (e.g., projects/{project}/locations/{location}/dataExchanges/{id})

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides