Manage GCP Data Catalog Entry Group IAM Bindings

The gcp:datacatalog/entryGroupIamBinding:EntryGroupIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Data Catalog entry groups by granting a specific role to a list of members. This resource is deprecated; for new projects, use gcp.dataplex.EntryGroup instead. This guide focuses on two capabilities: batch member assignment and incremental member addition.

IAM bindings reference existing entry groups and roles. The examples are intentionally small. Combine them with your own entry group infrastructure and member identities.

Grant a role to multiple members at once

Teams managing entry groups often need to grant the same role to multiple users or service accounts simultaneously, such as giving viewer access to an entire team.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.datacatalog.EntryGroupIamBinding("binding", {
    entryGroup: basicEntryGroup.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.datacatalog.EntryGroupIamBinding("binding",
    entry_group=basic_entry_group["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/datacatalog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datacatalog.NewEntryGroupIamBinding(ctx, "binding", &datacatalog.EntryGroupIamBindingArgs{
			EntryGroup: pulumi.Any(basicEntryGroup.Name),
			Role:       pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.DataCatalog.EntryGroupIamBinding("binding", new()
    {
        EntryGroup = basicEntryGroup.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.datacatalog.EntryGroupIamBinding;
import com.pulumi.gcp.datacatalog.EntryGroupIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new EntryGroupIamBinding("binding", EntryGroupIamBindingArgs.builder()
            .entryGroup(basicEntryGroup.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:datacatalog:EntryGroupIamBinding
    properties:
      entryGroup: ${basicEntryGroup.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The binding is authoritative for the specified role: it replaces the entire member list for that role on the entry group. The members array accepts various identity formats including users, service accounts, groups, and domains. Each binding manages one role; other roles on the same entry group remain unchanged.

Add individual members to a role incrementally

When access needs evolve, teams add members one at a time rather than managing the entire member list.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.datacatalog.EntryGroupIamMember("member", {
    entryGroup: basicEntryGroup.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.datacatalog.EntryGroupIamMember("member",
    entry_group=basic_entry_group["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/datacatalog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datacatalog.NewEntryGroupIamMember(ctx, "member", &datacatalog.EntryGroupIamMemberArgs{
			EntryGroup: pulumi.Any(basicEntryGroup.Name),
			Role:       pulumi.String("roles/viewer"),
			Member:     pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.DataCatalog.EntryGroupIamMember("member", new()
    {
        EntryGroup = basicEntryGroup.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.datacatalog.EntryGroupIamMember;
import com.pulumi.gcp.datacatalog.EntryGroupIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new EntryGroupIamMember("member", EntryGroupIamMemberArgs.builder()
            .entryGroup(basicEntryGroup.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:datacatalog:EntryGroupIamMember
    properties:
      entryGroup: ${basicEntryGroup.name}
      role: roles/viewer
      member: user:jane@example.com

The EntryGroupIamMember resource is non-authoritative: it adds a single member to a role without affecting other members. This approach works well when different teams manage access independently or when onboarding happens gradually. You can combine multiple EntryGroupIamMember resources for the same role, or mix them with EntryGroupIamBinding resources for different roles.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and batch and incremental member assignment. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Data Catalog entry groups and IAM roles (predefined or custom). They focus on configuring access bindings rather than provisioning the underlying catalog resources.

To keep things focused, common IAM patterns are omitted, including:

  • Conditional IAM bindings (condition property)
  • Project and region specification (defaults to provider config)
  • Policy-level management (EntryGroupIamPolicy resource)
  • Custom role formatting ([projects|organizations]/{parent}/roles/{name})

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the EntryGroupIamBinding resource reference for all available configuration options.

Let's manage GCP Data Catalog Entry Group IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Migration & Deprecation
Is this resource deprecated?
Yes, the parent resource gcp.datacatalog.EntryGroup is deprecated and will be removed in a future major release. Migrate to gcp.dataplex.EntryGroup instead. See the transition guide at https://cloud.google.com/dataplex/docs/transition-to-dataplex-catalog for migration steps.
Resource Selection & Conflicts
Which IAM resource should I use for managing EntryGroup permissions?

Choose based on your needs:

  • gcp.datacatalog.EntryGroupIamPolicy - Authoritative. Replaces the entire IAM policy.
  • gcp.datacatalog.EntryGroupIamBinding - Authoritative for a specific role. Preserves other roles.
  • gcp.datacatalog.EntryGroupIamMember - Non-authoritative. Adds a single member to a role without affecting other members.
Can I mix different IAM resources for the same EntryGroup?
gcp.datacatalog.EntryGroupIamPolicy cannot be used with EntryGroupIamBinding or EntryGroupIamMember as they will conflict. However, EntryGroupIamBinding can be used with EntryGroupIamMember only if they don’t grant privileges to the same role.
Configuration & Identity Management
What identity formats can I use in the members array?

Supported formats include:

  • user:{email} - Specific Google account
  • serviceAccount:{email} - Service account
  • group:{email} - Google group
  • domain:{domain} - All users in a G Suite domain
  • allUsers - Anyone on the internet
  • allAuthenticatedUsers - Anyone with a Google account
  • projectOwner:projectid, projectEditor:projectid, projectViewer:projectid - Project-level roles
  • principal://... - Federated identities (see Principal identifiers documentation)
How do I specify a custom IAM role?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.
Do I need to specify project and region explicitly?
Not necessarily. Both project and region can be parsed from the entryGroup identifier if not specified. If they’re not in the identifier, the provider configuration is used.
Immutability & Limitations
What properties can't I change after creation?
The following properties are immutable: entryGroup, role, project, region, and condition. Changing any of these requires recreating the resource.
Can I use only one EntryGroupIamBinding per role?
Yes, only one gcp.datacatalog.EntryGroupIamBinding can be used per role. To add multiple members to the same role, include them all in the members array of a single binding, or use gcp.datacatalog.EntryGroupIamMember for individual member management.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides