google_bigquery_dataset_iam_member

[hden]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

Provides a non-authoritative ways to manage access to a dataset. If #3929 cannot be solved at SDK level, at least we can create or own solutions.

# variables.tf
variable "owners" {
  type    = set(string)
  default = []
}

# main.tf
resource "google_bigquery_dataset" "temp" {
  dataset_id = "temp"
  project    = data.google_project.project.project_id
}

resource "google_project_iam_member" "owner" {
  for_each = var.owners
  dataset  = google_bigquery_dataset.temp.dataset_id
  role     = "roles/owner"
  member   = each.value
}

New or Affected Resource(s)

• google_bigquery_dataset_iam_member

Potential Terraform Configuration

resource "google_bigquery_dataset_iam_member" "editor" {
  dataset = "your-bigquery-dataset"
  member  = "user:jane@example.com"
  role    = "roles/editor"
}

References

• BigQuery dataset access order is still not being ignored #3929
• Add *_iam_* resources (BigQuery / Pubsub) #2051

[danawillow]

Bigquery APIs don't implement IAM the same way as the resources where you see the *_iam_member resources so we wouldn't be able to do exactly that, but there is already a FR open for breaking the access block into its own resource, so marking this as a duplicate of #2686.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!

[danawillow]

Reopening to try to get resources in the traditional iam formats as well

[preston-hf]

How does this differ from the bigquery_dataset_access resource?

[slevenick]

Only in the structure to make it act similarly to other *_iam resources. bigquery_dataset_access would be the preferred way to handle this as it allows assigning access to views

[danawillow]

@slevenick worth adding something in the docs that explains when to use which resource type?

[simonvanderveldt]

What does the change introduced in #6553 do exactly? I haven't been able to find any documentation about IAM supporting BigQuery, AFAIK access can only be managed on the dataset itself, see https://cloud.google.com/bigquery/docs/dataset-access-controls

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!

[slevenick]

@simonvanderveldt the change fits the dataset access controls to the standard terraform IAM binding/member/policy format. Access is still managed on the dataset itself, but this makes it a little more familiar