Manage GCP BigQuery Connection IAM Bindings

The gcp:bigquery/connectionIamBinding:ConnectionIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for BigQuery Connection resources. This guide focuses on two capabilities: authoritative role binding to multiple members and non-authoritative single member addition.

IAM bindings reference existing BigQuery Connection resources and require valid project and location identifiers. The examples are intentionally small. Combine them with your own connection resources and identity management workflows.

Grant a role to multiple members at once

When managing access for analytics teams, you often need to assign the same role to multiple users or service accounts simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.bigquery.ConnectionIamBinding("binding", {
    project: connection.project,
    location: connection.location,
    connectionId: connection.connectionId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.bigquery.ConnectionIamBinding("binding",
    project=connection["project"],
    location=connection["location"],
    connection_id=connection["connectionId"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigquery"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bigquery.NewConnectionIamBinding(ctx, "binding", &bigquery.ConnectionIamBindingArgs{
			Project:      pulumi.Any(connection.Project),
			Location:     pulumi.Any(connection.Location),
			ConnectionId: pulumi.Any(connection.ConnectionId),
			Role:         pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.BigQuery.ConnectionIamBinding("binding", new()
    {
        Project = connection.Project,
        Location = connection.Location,
        ConnectionId = connection.ConnectionId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigquery.ConnectionIamBinding;
import com.pulumi.gcp.bigquery.ConnectionIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new ConnectionIamBinding("binding", ConnectionIamBindingArgs.builder()
            .project(connection.project())
            .location(connection.location())
            .connectionId(connection.connectionId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:bigquery:ConnectionIamBinding
    properties:
      project: ${connection.project}
      location: ${connection.location}
      connectionId: ${connection.connectionId}
      role: roles/viewer
      members:
        - user:jane@example.com

The ConnectionIamBinding resource is authoritative for the specified role. It replaces all existing members for that role with the members list you provide. The role property specifies the IAM role (predefined or custom), and members lists all identities that should have that role. The connectionId, location, and project properties identify which connection to bind the policy to.

Add a single member to a role incrementally

When onboarding individual users, you can add them one at a time without affecting existing members who already have the same role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.bigquery.ConnectionIamMember("member", {
    project: connection.project,
    location: connection.location,
    connectionId: connection.connectionId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.bigquery.ConnectionIamMember("member",
    project=connection["project"],
    location=connection["location"],
    connection_id=connection["connectionId"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigquery"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := bigquery.NewConnectionIamMember(ctx, "member", &bigquery.ConnectionIamMemberArgs{
			Project:      pulumi.Any(connection.Project),
			Location:     pulumi.Any(connection.Location),
			ConnectionId: pulumi.Any(connection.ConnectionId),
			Role:         pulumi.String("roles/viewer"),
			Member:       pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.BigQuery.ConnectionIamMember("member", new()
    {
        Project = connection.Project,
        Location = connection.Location,
        ConnectionId = connection.ConnectionId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigquery.ConnectionIamMember;
import com.pulumi.gcp.bigquery.ConnectionIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new ConnectionIamMember("member", ConnectionIamMemberArgs.builder()
            .project(connection.project())
            .location(connection.location())
            .connectionId(connection.connectionId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:bigquery:ConnectionIamMember
    properties:
      project: ${connection.project}
      location: ${connection.location}
      connectionId: ${connection.connectionId}
      role: roles/viewer
      member: user:jane@example.com

The ConnectionIamMember resource is non-authoritative. It adds a single member to a role without removing other members who already have that role. Use member (singular) instead of members (plural) to specify one identity. This approach works well when multiple teams manage access independently, since each team can add their own members without coordinating changes.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as BigQuery Connection resources and a GCP project with appropriate location. They focus on configuring IAM bindings rather than provisioning the underlying connections.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy-level management (ConnectionIamPolicy resource)
Custom role definitions and formatting
Federated identity configuration

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the BigQuery ConnectionIamBinding resource reference for all available configuration options.

Let's manage GCP BigQuery Connection IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between ConnectionIamPolicy, ConnectionIamBinding, and ConnectionIamMember?

ConnectionIamPolicy is authoritative and replaces the entire IAM policy. ConnectionIamBinding is authoritative for a specific role, preserving other roles. ConnectionIamMember is non-authoritative and adds a single member to a role without affecting other members.

Can I use ConnectionIamPolicy with ConnectionIamBinding or ConnectionIamMember?

No, ConnectionIamPolicy cannot be used with ConnectionIamBinding or ConnectionIamMember because they will conflict over the IAM policy.

Can I use ConnectionIamBinding and ConnectionIamMember together?

Yes, but only if they manage different roles. Using both for the same role will cause conflicts.

IAM Configuration

How do I grant a role to multiple members at once?

Use ConnectionIamBinding with the members array containing all identities you want to grant the role to.

How do I add a single member to a role without affecting existing members?

Use ConnectionIamMember with the member property for non-authoritative updates that preserve other members.

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

Location & Regional Mapping

How does location mapping work for Cloud SQL connections?

Cloud SQL us-central1 maps to BigQuery US, and europe-west1 maps to BigQuery EU. Other regions use their standard names.

Custom Roles & Import

What format do I need for custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.

How do I import an IAM binding with a custom role?

Use the full custom role name in the import command:

pulumi import gcp:bigquery/connectionIamBinding:ConnectionIamBinding editor "projects/{{project}}/locations/{{location}}/connections/{{connection_id}} projects/my-project/roles/my-custom-role"

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides