Manage GCP Dataplex Asset IAM Bindings

The gcp:dataplex/assetIamBinding:AssetIamBinding resource, part of the Pulumi GCP provider, manages IAM access control for Dataplex assets by binding roles to members. This guide focuses on three capabilities: role-based member management with AssetIamBinding, incremental member additions with AssetIamMember, and complete policy replacement with AssetIamPolicy.

These resources reference existing Dataplex assets within lakes and zones. AssetIamPolicy cannot be used alongside AssetIamBinding or AssetIamMember because they manage the same policy in conflicting ways. The examples are intentionally small. Combine them with your own Dataplex infrastructure and identity management strategy.

Grant a role to multiple members at once

When you need to give the same role to multiple users, service accounts, or groups, AssetIamBinding manages all members for that role as a single unit.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.dataplex.AssetIamBinding("binding", {
    project: example.project,
    location: example.location,
    lake: example.lake,
    dataplexZone: example.dataplexZone,
    asset: example.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.dataplex.AssetIamBinding("binding",
    project=example["project"],
    location=example["location"],
    lake=example["lake"],
    dataplex_zone=example["dataplexZone"],
    asset=example["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataplex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataplex.NewAssetIamBinding(ctx, "binding", &dataplex.AssetIamBindingArgs{
			Project:      pulumi.Any(example.Project),
			Location:     pulumi.Any(example.Location),
			Lake:         pulumi.Any(example.Lake),
			DataplexZone: pulumi.Any(example.DataplexZone),
			Asset:        pulumi.Any(example.Name),
			Role:         pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.DataPlex.AssetIamBinding("binding", new()
    {
        Project = example.Project,
        Location = example.Location,
        Lake = example.Lake,
        DataplexZone = example.DataplexZone,
        Asset = example.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataplex.AssetIamBinding;
import com.pulumi.gcp.dataplex.AssetIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new AssetIamBinding("binding", AssetIamBindingArgs.builder()
            .project(example.project())
            .location(example.location())
            .lake(example.lake())
            .dataplexZone(example.dataplexZone())
            .asset(example.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:dataplex:AssetIamBinding
    properties:
      project: ${example.project}
      location: ${example.location}
      lake: ${example.lake}
      dataplexZone: ${example.dataplexZone}
      asset: ${example.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The role property specifies which permission set to grant (e.g., “roles/viewer”). The members array lists all identities that receive this role. AssetIamBinding is authoritative for its role: it replaces any existing member list for that role but preserves other roles on the asset. The asset, dataplexZone, lake, and location properties identify which Dataplex asset to configure.

Add a single member to a role incrementally

To grant access to one identity without affecting others who already have the same role, use AssetIamMember for non-authoritative updates.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.dataplex.AssetIamMember("member", {
    project: example.project,
    location: example.location,
    lake: example.lake,
    dataplexZone: example.dataplexZone,
    asset: example.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.dataplex.AssetIamMember("member",
    project=example["project"],
    location=example["location"],
    lake=example["lake"],
    dataplex_zone=example["dataplexZone"],
    asset=example["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataplex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataplex.NewAssetIamMember(ctx, "member", &dataplex.AssetIamMemberArgs{
			Project:      pulumi.Any(example.Project),
			Location:     pulumi.Any(example.Location),
			Lake:         pulumi.Any(example.Lake),
			DataplexZone: pulumi.Any(example.DataplexZone),
			Asset:        pulumi.Any(example.Name),
			Role:         pulumi.String("roles/viewer"),
			Member:       pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.DataPlex.AssetIamMember("member", new()
    {
        Project = example.Project,
        Location = example.Location,
        Lake = example.Lake,
        DataplexZone = example.DataplexZone,
        Asset = example.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataplex.AssetIamMember;
import com.pulumi.gcp.dataplex.AssetIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new AssetIamMember("member", AssetIamMemberArgs.builder()
            .project(example.project())
            .location(example.location())
            .lake(example.lake())
            .dataplexZone(example.dataplexZone())
            .asset(example.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:dataplex:AssetIamMember
    properties:
      project: ${example.project}
      location: ${example.location}
      lake: ${example.lake}
      dataplexZone: ${example.dataplexZone}
      asset: ${example.name}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies a single identity to add (note the singular form, unlike AssetIamBinding’s members array). This resource adds the member to the role without removing existing members. You can use multiple AssetIamMember resources for the same role, and they won’t conflict with each other. However, mixing AssetIamMember with AssetIamBinding for the same role will cause conflicts because AssetIamBinding authoritatively replaces the entire member list.

Replace the entire IAM policy with a new definition

For complete control over all IAM bindings, AssetIamPolicy defines the entire policy in one place, replacing any existing configuration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.dataplex.AssetIamPolicy("policy", {
    project: example.project,
    location: example.location,
    lake: example.lake,
    dataplexZone: example.dataplexZone,
    asset: example.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.dataplex.AssetIamPolicy("policy",
    project=example["project"],
    location=example["location"],
    lake=example["lake"],
    dataplex_zone=example["dataplexZone"],
    asset=example["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataplex"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = dataplex.NewAssetIamPolicy(ctx, "policy", &dataplex.AssetIamPolicyArgs{
			Project:      pulumi.Any(example.Project),
			Location:     pulumi.Any(example.Location),
			Lake:         pulumi.Any(example.Lake),
			DataplexZone: pulumi.Any(example.DataplexZone),
			Asset:        pulumi.Any(example.Name),
			PolicyData:   pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.DataPlex.AssetIamPolicy("policy", new()
    {
        Project = example.Project,
        Location = example.Location,
        Lake = example.Lake,
        DataplexZone = example.DataplexZone,
        Asset = example.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.dataplex.AssetIamPolicy;
import com.pulumi.gcp.dataplex.AssetIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new AssetIamPolicy("policy", AssetIamPolicyArgs.builder()
            .project(example.project())
            .location(example.location())
            .lake(example.lake())
            .dataplexZone(example.dataplexZone())
            .asset(example.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:dataplex:AssetIamPolicy
    properties:
      project: ${example.project}
      location: ${example.location}
      lake: ${example.lake}
      dataplexZone: ${example.dataplexZone}
      asset: ${example.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The policyData property accepts the output from getIAMPolicy, which defines all roles and their members in a single structure. This resource is fully authoritative: it replaces the entire IAM policy for the asset. The bindings array in getIAMPolicy can include multiple roles, each with its own member list. AssetIamPolicy cannot coexist with AssetIamBinding or AssetIamMember resources for the same asset because they will fight over policy ownership.

Beyond these examples

These snippets focus on specific IAM binding features: role-based and member-based IAM binding, and authoritative policy replacement. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Dataplex assets within lakes and zones, and a GCP project with configured location. They focus on configuring IAM bindings rather than provisioning the Dataplex resources themselves.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions and formatting
Policy conflict resolution strategies
Import syntax for existing IAM configurations

These omissions are intentional: the goal is to illustrate how each IAM binding approach is wired, not provide drop-in access control modules. See the Dataplex AssetIamBinding resource reference for all available configuration options.

Let's manage GCP Dataplex Asset IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between AssetIamPolicy, AssetIamBinding, and AssetIamMember?

gcp.dataplex.AssetIamPolicy is authoritative and replaces the entire IAM policy. gcp.dataplex.AssetIamBinding is authoritative for a specific role, preserving other roles. gcp.dataplex.AssetIamMember is non-authoritative, adding a single member to a role while preserving other members.

Can I use AssetIamPolicy with AssetIamBinding or AssetIamMember?

No, gcp.dataplex.AssetIamPolicy cannot be used with gcp.dataplex.AssetIamBinding or gcp.dataplex.AssetIamMember because they will conflict over the policy.

Can I use AssetIamBinding and AssetIamMember together?

Yes, but only if they don’t grant privilege to the same role. Each role must be managed by only one resource type.

IAM Configuration

How do I specify custom roles?

Custom roles must use the full format: [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role.

What member identity formats are supported?

Supported formats include:

allUsers (anyone on the internet)
allAuthenticatedUsers (anyone with a Google account)
user:{emailid} (specific Google account)
serviceAccount:{emailid} (service account)
group:{emailid} (Google group)
domain:{domain} (G Suite domain)
projectOwner:projectid, projectEditor:projectid, projectViewer:projectid
Federated identities (e.g., principal://iam.googleapis.com/...)

Resource Properties

What properties can't be changed after creation?

The following properties are immutable: asset, dataplexZone, lake, location, project, role, and condition. Changing any of these requires recreating the resource.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides