Manage GCP Dataproc Metastore Service IAM Bindings

The gcp:dataproc/metastoreServiceIamBinding:MetastoreServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Dataproc Metastore services. This guide focuses on two approaches: authoritative role binding that replaces all members for a role, and non-authoritative member addition that preserves existing members.

IAM bindings reference existing Metastore services and require valid IAM principals. The examples are intentionally small. Combine them with your own Metastore services and identity management.

Grant a role to multiple members at once

When onboarding teams or configuring service-to-service access, you often need to grant the same role to multiple identities simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.dataproc.MetastoreServiceIamBinding("binding", {
    project: _default.project,
    location: _default.location,
    serviceId: _default.serviceId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp

binding = gcp.dataproc.MetastoreServiceIamBinding("binding",
    project=default["project"],
    location=default["location"],
    service_id=default["serviceId"],
    role="roles/viewer",
    members=["user:jane@example.com"])
package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataproc.NewMetastoreServiceIamBinding(ctx, "binding", &dataproc.MetastoreServiceIamBindingArgs{
			Project:   pulumi.Any(_default.Project),
			Location:  pulumi.Any(_default.Location),
			ServiceId: pulumi.Any(_default.ServiceId),
			Role:      pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Dataproc.MetastoreServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        ServiceId = @default.ServiceId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.MetastoreServiceIamBinding;
import com.pulumi.gcp.dataproc.MetastoreServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new MetastoreServiceIamBinding("binding", MetastoreServiceIamBindingArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .serviceId(default_.serviceId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}
resources:
  binding:
    type: gcp:dataproc:MetastoreServiceIamBinding
    properties:
      project: ${default.project}
      location: ${default.location}
      serviceId: ${default.serviceId}
      role: roles/viewer
      members:
        - user:jane@example.com

The Binding resource is authoritative for the specified role: it replaces all members for that role on the Metastore service. The members array accepts user emails, service accounts, groups, and special identifiers like allUsers. The serviceId identifies which Metastore service to configure, and location specifies the service’s region (defaults to “global” if not set).

Add a single member to a role incrementally

When you need to grant access to one user without affecting others who already have the same role, the Member resource adds identities incrementally.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.dataproc.MetastoreServiceIamMember("member", {
    project: _default.project,
    location: _default.location,
    serviceId: _default.serviceId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp

member = gcp.dataproc.MetastoreServiceIamMember("member",
    project=default["project"],
    location=default["location"],
    service_id=default["serviceId"],
    role="roles/viewer",
    member="user:jane@example.com")
package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataproc.NewMetastoreServiceIamMember(ctx, "member", &dataproc.MetastoreServiceIamMemberArgs{
			Project:   pulumi.Any(_default.Project),
			Location:  pulumi.Any(_default.Location),
			ServiceId: pulumi.Any(_default.ServiceId),
			Role:      pulumi.String("roles/viewer"),
			Member:    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Dataproc.MetastoreServiceIamMember("member", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        ServiceId = @default.ServiceId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.MetastoreServiceIamMember;
import com.pulumi.gcp.dataproc.MetastoreServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new MetastoreServiceIamMember("member", MetastoreServiceIamMemberArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .serviceId(default_.serviceId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}
resources:
  member:
    type: gcp:dataproc:MetastoreServiceIamMember
    properties:
      project: ${default.project}
      location: ${default.location}
      serviceId: ${default.serviceId}
      role: roles/viewer
      member: user:jane@example.com

The Member resource is non-authoritative: it adds one identity to a role without removing existing members. This is useful when multiple teams manage access independently. The member property takes a single identity string (e.g., “user:jane@example.com”), while the Binding resource uses a members array. You can use Member and Binding together as long as they don’t grant the same role.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Dataproc Metastore services and IAM principals (users, service accounts, groups). They focus on configuring access bindings rather than provisioning the underlying services.

To keep things focused, common IAM patterns are omitted, including:

  • Conditional IAM bindings (condition property)
  • Policy-level management (MetastoreServiceIamPolicy)
  • Custom role definitions
  • Federated identity configuration

These omissions are intentional: the goal is to illustrate how each binding approach is wired, not provide drop-in access control modules. See the Dataproc Metastore Service IAM Binding resource reference for all available configuration options.

Let's manage GCP Dataproc Metastore Service IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between IamPolicy, IamBinding, and IamMember?
MetastoreServiceIamPolicy is authoritative and replaces the entire IAM policy. MetastoreServiceIamBinding is authoritative for a specific role, replacing all members for that role while preserving other roles. MetastoreServiceIamMember is non-authoritative and adds a single member to a role without affecting other members.
Can I use these IAM resources together?
MetastoreServiceIamPolicy cannot be used with MetastoreServiceIamBinding or MetastoreServiceIamMember as they will conflict. However, MetastoreServiceIamBinding and MetastoreServiceIamMember can be used together only if they grant different roles.
Which IAM resource should I use?
Use MetastoreServiceIamPolicy for full policy control, MetastoreServiceIamBinding to manage all members for a specific role, or MetastoreServiceIamMember to add individual members without affecting existing permissions.
Roles & Permissions
How do I specify custom roles?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.
Can I have multiple IamBinding resources for the same role?
No, only one MetastoreServiceIamBinding can be used per role, as it authoritatively manages all members for that role.
Member Identities
What member identity formats are supported?
Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....
How do I grant access to a service account?
Add serviceAccount:{emailid} to the members array, for example serviceAccount:my-app@appspot.gserviceaccount.com.
Configuration & Constraints
What properties can't be changed after creation?
The location, role, serviceId, project, and condition properties are all immutable and cannot be modified after the resource is created.
What's the default location for a metastore service?
The default location is global if not specified. The location is immutable after creation.

Using a different cloud?

Explore security guides for other cloud providers: