google_bigquery_dataset_iam does not support jobUser and user roles

[aymericbbc]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

google_bigquery_dataset_iam allows users to give roles/bigquery.dataEditor, roles/bigquery.dataOwner
or roles/bigquery.dataViewer roles but roles/bigquery.jobUser or roles/bigquery.user seem to not be supported although they can be given at dataset level

New or Affected Resource(s)

• google_bigquery_dataset_iam

Potential Terraform Configuration

resource "google_bigquery_dataset_iam_binding" "default" {
  dataset_id = google_bigquery_dataset.my-dataset.dataset_id
  role = "roles/bigquery.jobUser"
  members = [
    "user:user@mycompany.com",
  ]
}

References

[megan07]

Hi @aymericbbc ! Thanks for letting us know about this. I took a look and the error I got was being returned by the API, so I looked to see if I could do it in the console, and I don't see that I'm able to. The BigQuery permission options that I see can be applied to the dataset are BigQuery Admin, BigQuery Data Editor, BigQuery Data Owner, BigQuery Data Viewer, BigQuery Metadata Viewer and BigQuery User.

If you're looking for BigQuery User I think the role you want to use is roles/bigquery.user

Please let me know if I misunderstood what you're looking for, or if this fixes the problem. Thanks!

[aymericbbc]

Hello @megan07, roles/bigquery.user does not grant job.create at the dataset level. Actually I realised we can only give job.create at the project level, so there's no way to do what I want.
Sorry for the late answer

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!