Manage GCP Dataproc Job IAM Permissions

The gcp:dataproc/jobIAMBinding:JobIAMBinding resource, part of the Pulumi GCP provider, grants IAM roles to lists of members for Dataproc jobs. This resource is authoritative for a specific role: it replaces all members assigned to that role while preserving other roles in the job’s IAM policy. This guide focuses on two capabilities: binding multiple members to a role and adding individual members non-authoritatively.

IAM bindings reference existing Dataproc jobs and typically use the provider’s default project and region. The examples are intentionally small. Combine them with your own job references and explicit project/region configuration as needed.

Grant a role to multiple members

Teams managing job access often need to assign a role to multiple users or service accounts at once.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const editor = new gcp.dataproc.JobIAMBinding("editor", {
    jobId: "your-dataproc-job",
    role: "roles/editor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

editor = gcp.dataproc.JobIAMBinding("editor",
    job_id="your-dataproc-job",
    role="roles/editor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataproc.NewJobIAMBinding(ctx, "editor", &dataproc.JobIAMBindingArgs{
			JobId: pulumi.String("your-dataproc-job"),
			Role:  pulumi.String("roles/editor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var editor = new Gcp.Dataproc.JobIAMBinding("editor", new()
    {
        JobId = "your-dataproc-job",
        Role = "roles/editor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.JobIAMBinding;
import com.pulumi.gcp.dataproc.JobIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var editor = new JobIAMBinding("editor", JobIAMBindingArgs.builder()
            .jobId("your-dataproc-job")
            .role("roles/editor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  editor:
    type: gcp:dataproc:JobIAMBinding
    properties:
      jobId: your-dataproc-job
      role: roles/editor
      members:
        - user:jane@example.com

The members array lists all identities that receive the specified role. This binding is authoritative for the editor role: it replaces any existing editor assignments but leaves other roles (like viewer or owner) unchanged. The jobId identifies which Dataproc job receives the policy update.

Add a single member to a role

When onboarding individual users, non-authoritative member grants preserve existing assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const editor = new gcp.dataproc.JobIAMMember("editor", {
    jobId: "your-dataproc-job",
    role: "roles/editor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

editor = gcp.dataproc.JobIAMMember("editor",
    job_id="your-dataproc-job",
    role="roles/editor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataproc.NewJobIAMMember(ctx, "editor", &dataproc.JobIAMMemberArgs{
			JobId:  pulumi.String("your-dataproc-job"),
			Role:   pulumi.String("roles/editor"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var editor = new Gcp.Dataproc.JobIAMMember("editor", new()
    {
        JobId = "your-dataproc-job",
        Role = "roles/editor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.JobIAMMember;
import com.pulumi.gcp.dataproc.JobIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var editor = new JobIAMMember("editor", JobIAMMemberArgs.builder()
            .jobId("your-dataproc-job")
            .role("roles/editor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  editor:
    type: gcp:dataproc:JobIAMMember
    properties:
      jobId: your-dataproc-job
      role: roles/editor
      member: user:jane@example.com

The JobIAMMember resource adds one identity to a role without affecting other members already assigned to that role. This is non-authoritative: multiple JobIAMMember resources can target the same role, and each adds its member to the list. Use this when you need incremental access grants rather than replacing the entire member list.

Beyond these examples

These snippets focus on specific IAM binding features: role binding for multiple members and single member grants. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Dataproc jobs (by jobId) and rely on the GCP provider’s default project and region. They focus on granting access rather than provisioning jobs or managing full policies.

To keep things focused, common IAM patterns are omitted, including:

  • Full policy replacement (JobIAMPolicy)
  • Conditional role bindings (condition property)
  • Explicit project and region specification
  • Custom role formats (projects/{parent}/roles/{name})

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the Dataproc JobIAMBinding resource reference for all available configuration options.

Let's manage GCP Dataproc Job IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between JobIAMPolicy, JobIAMBinding, and JobIAMMember?
JobIAMPolicy is authoritative and replaces the entire IAM policy. JobIAMBinding is authoritative for a specific role, preserving other roles. JobIAMMember is non-authoritative, adding individual members without affecting existing ones.
Can I use JobIAMPolicy with JobIAMBinding or JobIAMMember?
No, JobIAMPolicy cannot be used with JobIAMBinding or JobIAMMember because they’ll conflict over the policy configuration.
Can I use JobIAMBinding and JobIAMMember together?
Yes, but only if they don’t grant privileges to the same role. Each role must be managed by only one resource type.
Why did I lose ownership of my Dataproc job after applying JobIAMPolicy?
JobIAMPolicy replaces the entire IAM policy, which can remove existing ownership permissions. Always include all necessary permissions when using this resource.
IAM Configuration
What member identity formats are supported?
You can use allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, or domain:{domain}.
How do I specify a custom role?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.
Can I use multiple JobIAMBinding resources for the same role?
No, only one JobIAMBinding can be used per role.
Immutability & Limitations
What properties can't be changed after creation?
The jobId, project, region, role, and condition properties are all immutable and require resource replacement if changed.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides