IAM policy for BigQuery Dataset

Three different resources help you manage your IAM policy for BigQuery dataset. Each of these resources serves a different use case:

These resources are intended to convert the permissions system for BigQuery datasets to the standard IAM interface. For advanced usages, including creating authorized views, please use either google_bigquery_dataset_access or the access field on google_bigquery_dataset.

google_bigquery_dataset_iam_policy

data "google_iam_policy" "owner" {
  binding {
    role = "roles/bigquery.dataOwner"

    members = [
      "user:jane@example.com",
    ]
  }
}

resource "google_bigquery_dataset_iam_policy" "dataset" {
  dataset_id  = google_bigquery_dataset.dataset.dataset_id
  policy_data = data.google_iam_policy.owner.policy_data
}

resource "google_bigquery_dataset" "dataset" {
  dataset_id = "example_dataset"
}

google_bigquery_dataset_iam_binding

resource "google_bigquery_dataset_iam_binding" "reader" {
  dataset_id = google_bigquery_dataset.dataset.dataset_id
  role       = "roles/bigquery.dataViewer"

  members = [
    "user:jane@example.com",
  ]
}

resource "google_bigquery_dataset" "dataset" {
  dataset_id = "example_dataset"
}

google_bigquery_dataset_iam_member

resource "google_bigquery_dataset_iam_member" "editor" {
  dataset_id = google_bigquery_dataset.dataset.dataset_id
  role       = "roles/bigquery.dataEditor"
  member     = "user:jane@example.com"
}

resource "google_bigquery_dataset" "dataset" {
  dataset_id = "example_dataset"
}

Argument Reference

The following arguments are supported:

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

Import

Importing IAM members

IAM member imports use space-delimited identifiers that contains the dataset_id, role, and member. For example:

An import block (Terraform v1.5.0 and later) can be used to import IAM members:

import {
  id = "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer user:foo@example.com"
  to = google_bigquery_dataset_iam_member.default
}

The terraform import command can also be used:

$ terraform import google_bigquery_dataset_iam_member.default "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer user:foo@example.com"

Importing IAM bindings

IAM binding imports use space-delimited identifiers that contain the resource's dataset_id and role. For example:

An import block (Terraform v1.5.0 and later) can be used to import IAM bindings:

import {
  id = "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer"
  to = google_bigquery_dataset_iam_binding.default
}

The terraform import command can also be used:

$ terraform import google_bigquery_dataset_iam_binding.default "projects/{{project_id}}/datasets/{{dataset_id}} roles/viewer"

Importing IAM policies

IAM policy imports use the identifier of the BigQuery Dataset resource. For example:

An import block (Terraform v1.5.0 and later) can be used to import IAM policies:

import {
  id = projects/{{project_id}}/datasets/{{dataset_id}}
  to = google_bigquery_dataset_iam_policy.default
}

The terraform import command can also be used:

$ terraform import google_bigquery_dataset_iam_policy.default projects/{{project_id}}/datasets/{{dataset_id}}