Manage GCP Data Catalog Tag Template IAM Bindings

The gcp:datacatalog/tagTemplateIamBinding:TagTemplateIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Data Catalog tag templates by granting a specific role to a list of members. This guide focuses on two capabilities: binding multiple members to a single role and adding individual members incrementally.

This resource is authoritative for the specified role, replacing any existing member list for that role while preserving other roles on the tag template. The examples are intentionally small. Combine them with your own tag templates and identity management strategy.

Grant a role to multiple members at once

When multiple users or service accounts need the same level of access, binding them together ensures consistent permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.datacatalog.TagTemplateIamBinding("binding", {
    tagTemplate: basicTagTemplate.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.datacatalog.TagTemplateIamBinding("binding",
    tag_template=basic_tag_template["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/datacatalog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datacatalog.NewTagTemplateIamBinding(ctx, "binding", &datacatalog.TagTemplateIamBindingArgs{
			TagTemplate: pulumi.Any(basicTagTemplate.Name),
			Role:        pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.DataCatalog.TagTemplateIamBinding("binding", new()
    {
        TagTemplate = basicTagTemplate.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.datacatalog.TagTemplateIamBinding;
import com.pulumi.gcp.datacatalog.TagTemplateIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new TagTemplateIamBinding("binding", TagTemplateIamBindingArgs.builder()
            .tagTemplate(basicTagTemplate.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:datacatalog:TagTemplateIamBinding
    properties:
      tagTemplate: ${basicTagTemplate.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The members property accepts a list of identity strings in specific formats: user emails, service accounts, groups, or special identifiers like allUsers. The binding is authoritative for the specified role, so any members not in this list will lose access to that role.

Add a single member to a role incrementally

Teams managing permissions individually can add members one at a time without affecting others.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.datacatalog.TagTemplateIamMember("member", {
    tagTemplate: basicTagTemplate.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.datacatalog.TagTemplateIamMember("member",
    tag_template=basic_tag_template["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/datacatalog"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := datacatalog.NewTagTemplateIamMember(ctx, "member", &datacatalog.TagTemplateIamMemberArgs{
			TagTemplate: pulumi.Any(basicTagTemplate.Name),
			Role:        pulumi.String("roles/viewer"),
			Member:      pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.DataCatalog.TagTemplateIamMember("member", new()
    {
        TagTemplate = basicTagTemplate.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.datacatalog.TagTemplateIamMember;
import com.pulumi.gcp.datacatalog.TagTemplateIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new TagTemplateIamMember("member", TagTemplateIamMemberArgs.builder()
            .tagTemplate(basicTagTemplate.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:datacatalog:TagTemplateIamMember
    properties:
      tagTemplate: ${basicTagTemplate.name}
      role: roles/viewer
      member: user:jane@example.com

The TagTemplateIamMember resource adds a single member to a role non-authoritatively, preserving existing members. Use member (singular) instead of members (plural). This approach works well when permissions are granted individually rather than as a group.

Beyond these examples

These snippets focus on specific IAM binding features: role binding for multiple members and incremental member addition. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Data Catalog tag templates. They focus on configuring IAM bindings rather than creating the underlying resources.

To keep things focused, common IAM patterns are omitted, including:

  • Conditional IAM bindings (condition property)
  • Custom role definitions
  • Policy-level IAM management (TagTemplateIamPolicy)

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the TagTemplateIamBinding resource reference for all available configuration options.

Let's manage GCP Data Catalog Tag Template IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between TagTemplateIamPolicy, TagTemplateIamBinding, and TagTemplateIamMember?
TagTemplateIamPolicy is authoritative and replaces the entire IAM policy. TagTemplateIamBinding is authoritative for a specific role but preserves other roles. TagTemplateIamMember is non-authoritative and adds a single member while preserving other members for that role.
Can I use multiple IAM resource types together?
TagTemplateIamPolicy cannot be used with TagTemplateIamBinding or TagTemplateIamMember as they will conflict. However, TagTemplateIamBinding can be used with TagTemplateIamMember only if they grant different roles.
Which IAM resource should I use for my use case?
Use TagTemplateIamPolicy to manage the complete policy authoritatively. Use TagTemplateIamBinding to manage all members for a specific role. Use TagTemplateIamMember to add individual members without affecting others.
IAM Configuration
What format do custom roles require?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.
What member identity formats are supported?
Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....
Resource Properties
What properties can't I change after creation?
The role, tagTemplate, project, and region properties are all immutable and cannot be changed after the resource is created.
How are project and region determined if I don't specify them?
If not specified, project is parsed from the parent resource identifier or falls back to the provider configuration. Similarly, region is parsed from the parent identifier or taken from the provider configuration.
How do I import an existing IAM binding?
Use the format pulumi import gcp:datacatalog/tagTemplateIamBinding:TagTemplateIamBinding editor "projects/{{project}}/locations/{{region}}/tagTemplates/{{tag_template}} roles/viewer" with space-delimited identifiers for the resource and role.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides