The gcp:dataproc/jobIAMBinding:JobIAMBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Dataproc jobs by granting a specific role to a list of members. This guide focuses on two capabilities: granting roles to multiple members at once and adding individual members to existing roles.
JobIAMBinding is one of three IAM resources for Dataproc jobs. It’s authoritative for a single role, meaning it replaces all members for that role while preserving other roles. JobIAMPolicy replaces the entire policy, while JobIAMMember adds individual members non-authoritatively. The examples are intentionally small. Combine them with your own job references and identity management.
Grant a role to multiple members
When managing team access, you often need to grant the same role to multiple users or service accounts at once.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.dataproc.JobIAMBinding("editor", {
jobId: "your-dataproc-job",
role: "roles/editor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.dataproc.JobIAMBinding("editor",
job_id="your-dataproc-job",
role="roles/editor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := dataproc.NewJobIAMBinding(ctx, "editor", &dataproc.JobIAMBindingArgs{
JobId: pulumi.String("your-dataproc-job"),
Role: pulumi.String("roles/editor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.Dataproc.JobIAMBinding("editor", new()
{
JobId = "your-dataproc-job",
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.JobIAMBinding;
import com.pulumi.gcp.dataproc.JobIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new JobIAMBinding("editor", JobIAMBindingArgs.builder()
.jobId("your-dataproc-job")
.role("roles/editor")
.members("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:dataproc:JobIAMBinding
properties:
jobId: your-dataproc-job
role: roles/editor
members:
- user:jane@example.com
The members property lists all identities that receive the specified role. JobIAMBinding is authoritative for this role, so the members list replaces any existing grants for roles/editor. Other roles on the job remain unchanged. The jobId references an existing Dataproc job.
Add a single member to a role
For individual grants, JobIAMMember adds one identity without affecting other members of the same role.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.dataproc.JobIAMMember("editor", {
jobId: "your-dataproc-job",
role: "roles/editor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.dataproc.JobIAMMember("editor",
job_id="your-dataproc-job",
role="roles/editor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := dataproc.NewJobIAMMember(ctx, "editor", &dataproc.JobIAMMemberArgs{
JobId: pulumi.String("your-dataproc-job"),
Role: pulumi.String("roles/editor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.Dataproc.JobIAMMember("editor", new()
{
JobId = "your-dataproc-job",
Role = "roles/editor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.JobIAMMember;
import com.pulumi.gcp.dataproc.JobIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new JobIAMMember("editor", JobIAMMemberArgs.builder()
.jobId("your-dataproc-job")
.role("roles/editor")
.member("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:dataproc:JobIAMMember
properties:
jobId: your-dataproc-job
role: roles/editor
member: user:jane@example.com
Unlike JobIAMBinding, JobIAMMember is non-authoritative. It adds the specified member to the role without replacing existing members. Use this when onboarding users incrementally or granting access to specific service accounts. Multiple JobIAMMember resources can target the same role.
Beyond these examples
These snippets focus on specific job IAM features: role-based access control and batch and incremental member grants. They’re intentionally minimal rather than full access control policies.
The examples reference pre-existing infrastructure such as Dataproc jobs (by jobId) and GCP project and region configuration. They focus on configuring IAM bindings rather than provisioning jobs or managing full policies.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Project and region specification (defaults to provider config)
- Policy-level management (JobIAMPolicy for full policy replacement)
- Custom role formatting ([projects|organizations]/{parent}/roles/{name})
These omissions are intentional: the goal is to illustrate how job IAM bindings are wired, not provide drop-in access control modules. See the Dataproc JobIAMBinding resource reference for all available configuration options.
Let's manage GCP Dataproc Job IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.dataproc.JobIAMPolicy is authoritative and replaces the entire IAM policy. gcp.dataproc.JobIAMBinding is authoritative for a specific role, preserving other roles. gcp.dataproc.JobIAMMember is non-authoritative and adds a single member to a role without affecting other members.gcp.dataproc.JobIAMPolicy cannot be used alongside gcp.dataproc.JobIAMBinding or gcp.dataproc.JobIAMMember because they’ll conflict over the policy. Additionally, gcp.dataproc.JobIAMPolicy replaces the entire policy, which can accidentally remove existing permissions including job ownership.gcp.dataproc.JobIAMBinding and gcp.dataproc.JobIAMMember for the same role will cause conflicts.Configuration & Permissions
The members property accepts these formats:
allUsers(anyone on the internet)allAuthenticatedUsers(anyone with a Google account)user:{emailid}(specific Google account)serviceAccount:{emailid}(service account)group:{emailid}(Google group)domain:{domain}(G Suite domain)
[projects|organizations]/{parent-name}/roles/{role-name}, for example: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.Immutability & Constraints
jobId, project, region, role, and condition properties are all immutable and cannot be changed after the resource is created.