The gcp:dataproc/metastoreServiceIamBinding:MetastoreServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Dataproc Metastore services. This guide focuses on two approaches: authoritative role binding that replaces all members for a role, and non-authoritative member addition that preserves existing members.
IAM bindings reference existing Metastore services and require valid IAM principals. The examples are intentionally small. Combine them with your own Metastore services and identity management.
Grant a role to multiple members at once
When onboarding teams or configuring service-to-service access, you often need to grant the same role to multiple identities simultaneously.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.dataproc.MetastoreServiceIamBinding("binding", {
project: _default.project,
location: _default.location,
serviceId: _default.serviceId,
role: "roles/viewer",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.dataproc.MetastoreServiceIamBinding("binding",
project=default["project"],
location=default["location"],
service_id=default["serviceId"],
role="roles/viewer",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := dataproc.NewMetastoreServiceIamBinding(ctx, "binding", &dataproc.MetastoreServiceIamBindingArgs{
Project: pulumi.Any(_default.Project),
Location: pulumi.Any(_default.Location),
ServiceId: pulumi.Any(_default.ServiceId),
Role: pulumi.String("roles/viewer"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Dataproc.MetastoreServiceIamBinding("binding", new()
{
Project = @default.Project,
Location = @default.Location,
ServiceId = @default.ServiceId,
Role = "roles/viewer",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.MetastoreServiceIamBinding;
import com.pulumi.gcp.dataproc.MetastoreServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new MetastoreServiceIamBinding("binding", MetastoreServiceIamBindingArgs.builder()
.project(default_.project())
.location(default_.location())
.serviceId(default_.serviceId())
.role("roles/viewer")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:dataproc:MetastoreServiceIamBinding
properties:
project: ${default.project}
location: ${default.location}
serviceId: ${default.serviceId}
role: roles/viewer
members:
- user:jane@example.com
The Binding resource is authoritative for the specified role: it replaces all members for that role on the Metastore service. The members array accepts user emails, service accounts, groups, and special identifiers like allUsers. The serviceId identifies which Metastore service to configure, and location specifies the service’s region (defaults to “global” if not set).
Add a single member to a role incrementally
When you need to grant access to one user without affecting others who already have the same role, the Member resource adds identities incrementally.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.dataproc.MetastoreServiceIamMember("member", {
project: _default.project,
location: _default.location,
serviceId: _default.serviceId,
role: "roles/viewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.dataproc.MetastoreServiceIamMember("member",
project=default["project"],
location=default["location"],
service_id=default["serviceId"],
role="roles/viewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := dataproc.NewMetastoreServiceIamMember(ctx, "member", &dataproc.MetastoreServiceIamMemberArgs{
Project: pulumi.Any(_default.Project),
Location: pulumi.Any(_default.Location),
ServiceId: pulumi.Any(_default.ServiceId),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Dataproc.MetastoreServiceIamMember("member", new()
{
Project = @default.Project,
Location = @default.Location,
ServiceId = @default.ServiceId,
Role = "roles/viewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.MetastoreServiceIamMember;
import com.pulumi.gcp.dataproc.MetastoreServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new MetastoreServiceIamMember("member", MetastoreServiceIamMemberArgs.builder()
.project(default_.project())
.location(default_.location())
.serviceId(default_.serviceId())
.role("roles/viewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:dataproc:MetastoreServiceIamMember
properties:
project: ${default.project}
location: ${default.location}
serviceId: ${default.serviceId}
role: roles/viewer
member: user:jane@example.com
The Member resource is non-authoritative: it adds one identity to a role without removing existing members. This is useful when multiple teams manage access independently. The member property takes a single identity string (e.g., “user:jane@example.com”), while the Binding resource uses a members array. You can use Member and Binding together as long as they don’t grant the same role.
Beyond these examples
These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as Dataproc Metastore services and IAM principals (users, service accounts, groups). They focus on configuring access bindings rather than provisioning the underlying services.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Policy-level management (MetastoreServiceIamPolicy)
- Custom role definitions
- Federated identity configuration
These omissions are intentional: the goal is to illustrate how each binding approach is wired, not provide drop-in access control modules. See the Dataproc Metastore Service IAM Binding resource reference for all available configuration options.
Let's manage GCP Dataproc Metastore Service IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
MetastoreServiceIamPolicy is authoritative and replaces the entire IAM policy. MetastoreServiceIamBinding is authoritative for a specific role, replacing all members for that role while preserving other roles. MetastoreServiceIamMember is non-authoritative and adds a single member to a role without affecting other members.MetastoreServiceIamPolicy cannot be used with MetastoreServiceIamBinding or MetastoreServiceIamMember as they will conflict. However, MetastoreServiceIamBinding and MetastoreServiceIamMember can be used together only if they grant different roles.MetastoreServiceIamPolicy for full policy control, MetastoreServiceIamBinding to manage all members for a specific role, or MetastoreServiceIamMember to add individual members without affecting existing permissions.Roles & Permissions
[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.MetastoreServiceIamBinding can be used per role, as it authoritatively manages all members for that role.Member Identities
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....serviceAccount:{emailid} to the members array, for example serviceAccount:my-app@appspot.gserviceaccount.com.Configuration & Constraints
location, role, serviceId, project, and condition properties are all immutable and cannot be modified after the resource is created.global if not specified. The location is immutable after creation.