hunfabric/examples/data-solutions/data-platform-foundations/IAM.md

IAM bindings reference

Legend: + additive, • conditional.

Project cmn

members	roles
gcp-data-analysts group	roles/datacatalog.viewer
gcp-data-engineers group	roles/dlp.estimatesAdmin roles/dlp.reader roles/dlp.user
gcp-data-security group	roles/datacatalog.admin roles/dlp.admin
load-df-0 serviceAccount	roles/datacatalog.viewer roles/dlp.user
trf-bq-0 serviceAccount	roles/datacatalog.categoryFineGrainedReader roles/datacatalog.viewer
trf-df-0 serviceAccount	roles/datacatalog.categoryFineGrainedReader roles/datacatalog.viewer roles/dlp.user

Project dtl-0

members	roles
gcp-data-analysts group	roles/bigquery.dataViewer roles/bigquery.jobUser roles/bigquery.metadataViewer roles/bigquery.user roles/datacatalog.tagTemplateViewer roles/datacatalog.viewer roles/storage.objectViewer
gcp-data-engineers group	roles/bigquery.dataEditor roles/storage.admin
load-df-0 serviceAccount	roles/bigquery.dataOwner roles/bigquery.jobUser roles/storage.objectCreator
service-390266833555 serviceAccount	roles/servicenetworking.serviceAgent +
trf-bq-0 serviceAccount	roles/bigquery.dataOwner roles/datacatalog.categoryAdmin
trf-df-0 serviceAccount	roles/bigquery.dataOwner

Project dtl-1

members	roles
gcp-data-analysts group	roles/bigquery.dataViewer roles/bigquery.jobUser roles/bigquery.metadataViewer roles/bigquery.user roles/datacatalog.tagTemplateViewer roles/datacatalog.viewer roles/storage.objectViewer
gcp-data-engineers group	roles/bigquery.dataEditor roles/storage.admin
load-df-0 serviceAccount	roles/datacatalog.categoryAdmin
service-914571197251 serviceAccount	roles/servicenetworking.serviceAgent +
trf-bq-0 serviceAccount	roles/bigquery.dataOwner roles/bigquery.jobUser
trf-df-0 serviceAccount	roles/bigquery.dataOwner roles/storage.objectCreator roles/storage.objectViewer

Project dtl-2

members	roles
gcp-data-analysts group	roles/bigquery.dataViewer roles/bigquery.jobUser roles/bigquery.metadataViewer roles/bigquery.user roles/datacatalog.tagTemplateViewer roles/datacatalog.viewer roles/storage.objectViewer
gcp-data-engineers group	roles/bigquery.dataEditor roles/storage.admin
load-df-0 serviceAccount	roles/datacatalog.categoryAdmin
service-272101441067 serviceAccount	roles/servicenetworking.serviceAgent +
trf-bq-0 serviceAccount	roles/bigquery.dataOwner roles/bigquery.jobUser
trf-df-0 serviceAccount	roles/bigquery.dataOwner roles/storage.objectCreator roles/storage.objectViewer

Project dtl-plg

members	roles
gcp-data-analysts group	roles/bigquery.dataEditor roles/bigquery.jobUser roles/bigquery.metadataViewer roles/bigquery.user roles/datacatalog.tagTemplateViewer roles/datacatalog.viewer roles/storage.objectAdmin
gcp-data-engineers group	roles/bigquery.dataEditor roles/storage.admin
service-185415295897 serviceAccount	roles/servicenetworking.serviceAgent +

Project lnd

members	roles
gcp-data-engineers group	roles/bigquery.dataEditor roles/pubsub.editor roles/storage.admin
lnd-bq-0 serviceAccount	roles/bigquery.dataEditor
lnd-cs-0 serviceAccount	roles/storage.objectCreator
lnd-ps-0 serviceAccount	roles/pubsub.publisher
load-df-0 serviceAccount	roles/bigquery.user roles/pubsub.subscriber roles/storage.admin roles/storage.objectAdmin
orc-cmp-0 serviceAccount	roles/pubsub.subscriber roles/storage.objectViewer

Project lod

members	roles
gcp-data-engineers group	roles/compute.viewer roles/dataflow.admin roles/dataflow.developer roles/viewer
load-df-0 serviceAccount	roles/bigquery.jobUser roles/dataflow.admin roles/dataflow.worker roles/storage.objectAdmin
orc-cmp-0 serviceAccount	roles/dataflow.admin
service-1027982570085 serviceAccount	roles/storage.objectAdmin roles/servicenetworking.serviceAgent +

Project orc

members	roles
gcp-data-engineers group	roles/bigquery.dataEditor roles/bigquery.jobUser roles/cloudbuild.builds.editor roles/composer.admin roles/composer.environmentAndStorageObjectAdmin roles/iam.serviceAccountUser roles/iap.httpsResourceAccessor roles/storage.admin roles/storage.objectAdmin
load-df-0 serviceAccount	roles/bigquery.dataEditor roles/storage.objectViewer
orc-cmp-0 serviceAccount	roles/bigquery.jobUser roles/composer.worker roles/iam.serviceAccountUser roles/storage.objectAdmin
service-466251568699 serviceAccount	roles/storage.objectAdmin roles/servicenetworking.serviceAgent +
trf-df-0 serviceAccount	roles/bigquery.dataEditor

Project trf

members	roles
gcp-data-engineers group	roles/bigquery.jobUser roles/dataflow.admin
orc-cmp-0 serviceAccount	roles/dataflow.admin
service-838656561422 serviceAccount	roles/storage.objectAdmin roles/servicenetworking.serviceAgent +
trf-bq-0 serviceAccount	roles/bigquery.jobUser
trf-df-0 serviceAccount	roles/dataflow.worker roles/storage.objectAdmin