Manage GCP Healthcare Dataset IAM Permissions

The gcp:healthcare/datasetIamBinding:DatasetIamBinding resource, part of the Pulumi Google Cloud provider, manages IAM role bindings for Healthcare datasets by granting a specific role to a list of members. This guide focuses on two capabilities: granting roles to multiple members and adding individual members to roles.

DatasetIamBinding is authoritative for a given role, meaning it replaces all members for that role. It can be used alongside DatasetIamMember for different roles, but cannot be combined with DatasetIamPolicy. The examples are intentionally small. Combine them with your own dataset references and identity management.

Grant a role to multiple members

Teams managing Healthcare datasets often need to grant the same role to multiple users, service accounts, or groups at once.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const dataset = new gcp.healthcare.DatasetIamBinding("dataset", {
    datasetId: "your-dataset-id",
    role: "roles/editor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

dataset = gcp.healthcare.DatasetIamBinding("dataset",
    dataset_id="your-dataset-id",
    role="roles/editor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := healthcare.NewDatasetIamBinding(ctx, "dataset", &healthcare.DatasetIamBindingArgs{
			DatasetId: pulumi.String("your-dataset-id"),
			Role:      pulumi.String("roles/editor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var dataset = new Gcp.Healthcare.DatasetIamBinding("dataset", new()
    {
        DatasetId = "your-dataset-id",
        Role = "roles/editor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.DatasetIamBinding;
import com.pulumi.gcp.healthcare.DatasetIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var dataset = new DatasetIamBinding("dataset", DatasetIamBindingArgs.builder()
            .datasetId("your-dataset-id")
            .role("roles/editor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  dataset:
    type: gcp:healthcare:DatasetIamBinding
    properties:
      datasetId: your-dataset-id
      role: roles/editor
      members:
        - user:jane@example.com

The members property accepts an array of identity strings. Each identity follows a specific format: user:email, serviceAccount:email, group:email, domain:domain, or the special identifiers allUsers and allAuthenticatedUsers. DatasetIamBinding manages all members for the specified role as a unit; any members not listed will be removed from that role.

Add a single member to a role

When you need to grant access to one additional user without affecting other members, DatasetIamMember adds a single identity non-authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const dataset = new gcp.healthcare.DatasetIamMember("dataset", {
    datasetId: "your-dataset-id",
    role: "roles/editor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

dataset = gcp.healthcare.DatasetIamMember("dataset",
    dataset_id="your-dataset-id",
    role="roles/editor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := healthcare.NewDatasetIamMember(ctx, "dataset", &healthcare.DatasetIamMemberArgs{
			DatasetId: pulumi.String("your-dataset-id"),
			Role:      pulumi.String("roles/editor"),
			Member:    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var dataset = new Gcp.Healthcare.DatasetIamMember("dataset", new()
    {
        DatasetId = "your-dataset-id",
        Role = "roles/editor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.DatasetIamMember;
import com.pulumi.gcp.healthcare.DatasetIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var dataset = new DatasetIamMember("dataset", DatasetIamMemberArgs.builder()
            .datasetId("your-dataset-id")
            .role("roles/editor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  dataset:
    type: gcp:healthcare:DatasetIamMember
    properties:
      datasetId: your-dataset-id
      role: roles/editor
      member: user:jane@example.com

The member property accepts a single identity string in the same formats as the members array. Unlike DatasetIamBinding, DatasetIamMember preserves other members already assigned to the role. You can use multiple DatasetIamMember resources for the same role, or combine them with DatasetIamBinding resources that manage different roles.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and member identity formats. They’re intentionally minimal rather than full access management solutions.

The examples reference pre-existing infrastructure such as Healthcare datasets. They focus on configuring IAM bindings rather than provisioning datasets or managing policies.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy-level management (DatasetIamPolicy)
Custom role definitions
Project and location specification in dataset IDs

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the Healthcare DatasetIamBinding resource reference for all available configuration options.

Let's manage GCP Healthcare Dataset IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between DatasetIamPolicy, DatasetIamBinding, and DatasetIamMember?

DatasetIamPolicy is authoritative for the entire IAM policy and replaces any existing policy. DatasetIamBinding is authoritative for a specific role, updating members for that role while preserving other roles. DatasetIamMember is non-authoritative, adding a single member to a role while preserving other members.

Can I use these IAM resources together?

DatasetIamPolicy cannot be used with DatasetIamBinding or DatasetIamMember, as they will conflict over the policy. However, DatasetIamBinding and DatasetIamMember can be used together only if they don’t grant privileges to the same role.

Configuration & Formats

What format does datasetId accept?

Use {project_id}/{location_name}/{dataset_name} or {location_name}/{dataset_name}. The second form uses your provider’s project setting as a fallback.

What member formats are supported?

You can use allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, or domain:{domain}. For example: user:jane@example.com or serviceAccount:my-app@appspot.gserviceaccount.com.

What's the format for custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. Note that only one DatasetIamBinding can be used per role.

Immutability & Limitations

What properties can't I change after creation?

The datasetId, role, and condition properties are immutable and cannot be changed after the resource is created.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides