The gcp:bigtable/tableIamBinding:TableIamBinding resource, part of the Pulumi GCP provider, grants IAM roles to members for a specific Bigtable table. This resource is authoritative for a given role, meaning it replaces all members assigned to that role. This guide focuses on two capabilities: authoritative role binding for multiple members and non-authoritative member addition.
IAM bindings reference existing Bigtable tables and instances by name. The examples are intentionally small. Combine them with your own table and instance infrastructure.
Grant a role to multiple members
Teams managing Bigtable access often need to grant the same role to multiple users or service accounts at once, such as giving a group of developers read access.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.bigtable.TableIamBinding("editor", {
table: "your-bigtable-table",
instanceName: "your-bigtable-instance",
role: "roles/bigtable.user",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.bigtable.TableIamBinding("editor",
table="your-bigtable-table",
instance_name="your-bigtable-instance",
role="roles/bigtable.user",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigtable"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := bigtable.NewTableIamBinding(ctx, "editor", &bigtable.TableIamBindingArgs{
Table: pulumi.String("your-bigtable-table"),
InstanceName: pulumi.String("your-bigtable-instance"),
Role: pulumi.String("roles/bigtable.user"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.BigTable.TableIamBinding("editor", new()
{
Table = "your-bigtable-table",
InstanceName = "your-bigtable-instance",
Role = "roles/bigtable.user",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigtable.TableIamBinding;
import com.pulumi.gcp.bigtable.TableIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new TableIamBinding("editor", TableIamBindingArgs.builder()
.table("your-bigtable-table")
.instanceName("your-bigtable-instance")
.role("roles/bigtable.user")
.members("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:bigtable:TableIamBinding
properties:
table: your-bigtable-table
instanceName: your-bigtable-instance
role: roles/bigtable.user
members:
- user:jane@example.com
The TableIamBinding resource is authoritative for the specified role. When you set members to a list of identities, the resource replaces any existing members for that role. The role property specifies the IAM role (like “roles/bigtable.user”), and members lists the identities to grant access. Each member uses a prefix like “user:”, “serviceAccount:”, or “group:” followed by an email address.
Add a single member to a role
When onboarding individual users or granting access to specific service accounts, TableIamMember adds one member without affecting others already assigned to the role.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.bigtable.TableIamMember("editor", {
table: "your-bigtable-table",
instanceName: "your-bigtable-instance",
role: "roles/bigtable.user",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.bigtable.TableIamMember("editor",
table="your-bigtable-table",
instance_name="your-bigtable-instance",
role="roles/bigtable.user",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigtable"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := bigtable.NewTableIamMember(ctx, "editor", &bigtable.TableIamMemberArgs{
Table: pulumi.String("your-bigtable-table"),
InstanceName: pulumi.String("your-bigtable-instance"),
Role: pulumi.String("roles/bigtable.user"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.BigTable.TableIamMember("editor", new()
{
Table = "your-bigtable-table",
InstanceName = "your-bigtable-instance",
Role = "roles/bigtable.user",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigtable.TableIamMember;
import com.pulumi.gcp.bigtable.TableIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new TableIamMember("editor", TableIamMemberArgs.builder()
.table("your-bigtable-table")
.instanceName("your-bigtable-instance")
.role("roles/bigtable.user")
.member("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:bigtable:TableIamMember
properties:
table: your-bigtable-table
instanceName: your-bigtable-instance
role: roles/bigtable.user
member: user:jane@example.com
Unlike TableIamBinding, TableIamMember is non-authoritative. It adds a single member to a role without removing existing members. Use this when you need incremental access grants rather than replacing the entire member list for a role.
Beyond these examples
These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative binding. They’re intentionally minimal rather than full access management solutions.
The examples reference pre-existing infrastructure such as Bigtable tables and instances. They focus on configuring IAM bindings rather than provisioning the underlying Bigtable resources.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Project-level configuration (project property)
- Full policy replacement (TableIamPolicy resource)
- Custom role definitions
These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access management modules. See the Bigtable TableIamBinding resource reference for all available configuration options.
Let's manage GCP Bigtable Table IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.bigtable.TableIamPolicy to set the entire IAM policy (authoritative). Use gcp.bigtable.TableIamBinding to manage all members for a specific role (authoritative for that role). Use gcp.bigtable.TableIamMember to add individual members to a role (non-authoritative).gcp.bigtable.TableIamPolicy cannot be used with gcp.bigtable.TableIamBinding or gcp.bigtable.TableIamMember because they will conflict over the policy.gcp.bigtable.TableIamPolicy replaces the entire IAM policy, so you can accidentally remove ownership permissions if you don’t include them in the new policy.Configuration & Constraints
gcp.bigtable.TableIamBinding can be used per role.allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, and domain:{domain}.[projects|organizations]/{parent-name}/roles/{role-name}.Immutability & Updates
instanceName, project, role, table, and condition properties cannot be changed after creation.