Skip to content

googleBigqueryDatasetAccess

Gives dataset access for a single entity. This resource is intended to be used in cases where it is not possible to compile a full list of access blocks to include in a googleBigqueryDataset resource, to enable them to be added separately.

\~> Note: If this resource is used alongside a googleBigqueryDataset resource, the dataset resource must either have no defined access blocks or a lifecycle block with ignoreChanges = [access] so they don't fight over which accesses should be on the dataset. Additionally, both resource cannot be modified in the same apply.

To get more information about DatasetAccess, see:

\~> Warning: You must specify the role field using the legacy format owner instead of roles/bigqueryDataOwner. The API does accept both formats but it will always return the legacy format which results in Terraform showing permanent diff on each plan and apply operation.

Example Usage - Bigquery Dataset Access Basic User

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleBigqueryDatasetDataset = new google.bigqueryDataset.BigqueryDataset(
  this,
  "dataset",
  {
    dataset_id: "example_dataset",
  }
);
const googleServiceAccountBqowner = new google.serviceAccount.ServiceAccount(
  this,
  "bqowner",
  {
    account_id: "bqowner",
  }
);
new google.bigqueryDatasetAccess.BigqueryDatasetAccess(this, "access", {
  dataset_id: googleBigqueryDatasetDataset.datasetId,
  role: "OWNER",
  user_by_email: googleServiceAccountBqowner.email,
});

Example Usage - Bigquery Dataset Access View

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleBigqueryDatasetPrivate = new google.bigqueryDataset.BigqueryDataset(
  this,
  "private",
  {
    dataset_id: "example_dataset",
  }
);
const googleBigqueryDatasetPublic = new google.bigqueryDataset.BigqueryDataset(
  this,
  "public",
  {
    dataset_id: "example_dataset2",
  }
);
const googleBigqueryTablePublic = new google.bigqueryTable.BigqueryTable(
  this,
  "public_2",
  {
    dataset_id: googleBigqueryDatasetPublic.datasetId,
    deletion_protection: false,
    table_id: "example_table",
    view: [
      {
        query: "SELECT state FROM [lookerdata:cdc.project_tycho_reports]",
        use_legacy_sql: false,
      },
    ],
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
googleBigqueryTablePublic.overrideLogicalId("public");
new google.bigqueryDatasetAccess.BigqueryDatasetAccess(this, "access", {
  dataset_id: googleBigqueryDatasetPrivate.datasetId,
  view: [
    {
      dataset_id: googleBigqueryDatasetPublic.datasetId,
      project_id: googleBigqueryTablePublic.project,
      table_id: googleBigqueryTablePublic.tableId,
    },
  ],
});

Example Usage - Bigquery Dataset Access Authorized Dataset

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleBigqueryDatasetPrivate = new google.bigqueryDataset.BigqueryDataset(
  this,
  "private",
  {
    dataset_id: "private",
  }
);
const googleBigqueryDatasetPublic = new google.bigqueryDataset.BigqueryDataset(
  this,
  "public",
  {
    dataset_id: "public",
  }
);
new google.bigqueryDatasetAccess.BigqueryDatasetAccess(this, "access", {
  dataset: [
    {
      dataset: [
        {
          dataset_id: googleBigqueryDatasetPublic.datasetId,
          project_id: googleBigqueryDatasetPublic.project,
        },
      ],
      target_types: ["VIEWS"],
    },
  ],
  dataset_id: googleBigqueryDatasetPrivate.datasetId,
});

Example Usage - Bigquery Dataset Access Authorized Routine

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleBigqueryDatasetPrivate = new google.bigqueryDataset.BigqueryDataset(
  this,
  "private",
  {
    dataset_id: "private_dataset",
    description: "This dataset is private",
  }
);
const googleBigqueryDatasetPublic = new google.bigqueryDataset.BigqueryDataset(
  this,
  "public",
  {
    dataset_id: "public_dataset",
    description: "This dataset is public",
  }
);
const googleBigqueryRoutinePublic = new google.bigqueryRoutine.BigqueryRoutine(
  this,
  "public_2",
  {
    arguments: [
      {
        argument_kind: "FIXED_TYPE",
        data_type: '${jsonencode({ "typeKind" = "INT64" })}',
        name: "value",
      },
    ],
    dataset_id: googleBigqueryDatasetPublic.datasetId,
    definition_body: "SELECT 1 + value AS value\n",
    language: "SQL",
    return_table_type:
      '${jsonencode({ "columns" = [\n    { "name" = "value", "type" = { "typeKind" = "INT64" } },\n  ] })}',
    routine_id: "public_routine",
    routine_type: "TABLE_VALUED_FUNCTION",
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
googleBigqueryRoutinePublic.overrideLogicalId("public");
new google.bigqueryDatasetAccess.BigqueryDatasetAccess(
  this,
  "authorized_routine",
  {
    dataset_id: googleBigqueryDatasetPrivate.datasetId,
    routine: [
      {
        dataset_id: googleBigqueryRoutinePublic.datasetId,
        project_id: googleBigqueryRoutinePublic.project,
        routine_id: googleBigqueryRoutinePublic.routineId,
      },
    ],
  }
);

Argument Reference

The following arguments are supported:

  • datasetId - (Required) A unique ID for this dataset, without the project name. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 1,024 characters.

  • role - (Optional) Describes the rights granted to the user specified by the other member of the access object. Basic, predefined, and custom roles are supported. Predefined roles that have equivalent basic roles are swapped by the API to their basic counterparts, and will show a diff post-create. See official docs.

  • userByEmail - (Optional) An email address of a user to grant access to. For example: fred@example.com

  • groupByEmail - (Optional) An email address of a Google Group to grant access to.

  • domain - (Optional) A domain to grant access to. Any users signed in with the domain specified will be granted the specified access

  • specialGroup - (Optional) A special group to grant access to. Possible values include:

    • projectOwners: Owners of the enclosing project.

    • projectReaders: Readers of the enclosing project.

    • projectWriters: Writers of the enclosing project.

    • allAuthenticatedUsers: All authenticated BigQuery users.

  • iamMember - (Optional) Some other type of member that appears in the IAM Policy but isn't a user, group, domain, or special group. For example: allUsers

  • view - (Optional) A view from a different dataset to grant access to. Queries executed against that view will have read access to tables in this dataset. The role field is not required when this field is set. If that view is updated by any user, access to the view needs to be granted again via an update operation. Structure is documented below.

  • dataset - (Optional) Grants all resources of particular types in a particular dataset read access to the current dataset. Structure is documented below.

  • routine - (Optional) A routine from a different dataset to grant access to. Queries executed against that routine will have read access to tables in this dataset. The role field is not required when this field is set. If that routine is updated by any user, access to the routine needs to be granted again via an update operation. Structure is documented below.

  • project - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

The view block supports:

  • datasetId - (Required) The ID of the dataset containing this table.

  • projectId - (Required) The ID of the project containing this table.

  • tableId - (Required) The ID of the table. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 1,024 characters.

The dataset block supports:

  • dataset - (Required) The dataset this entry applies to Structure is documented below.

  • targetTypes - (Required) Which resources in the dataset this entry applies to. Currently, only views are supported, but additional target types may be added in the future. Possible values: VIEWS

The dataset block supports:

  • datasetId - (Required) The ID of the dataset containing this table.

  • projectId - (Required) The ID of the project containing this table.

The routine block supports:

  • datasetId - (Required) The ID of the dataset containing this table.

  • projectId - (Required) The ID of the project containing this table.

  • routineId - (Required) The ID of the routine. The ID must contain only letters (a-z, A-Z), numbers (0-9), or underscores (_). The maximum length is 256 characters.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • id - an identifier for the resource with format projects/{{project}}/datasets/{{datasetId}}

Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 20 minutes.
  • delete - Default is 20 minutes.

Import

This resource does not support import.

User Project Overrides

This resource supports User Project Overrides.