Google Data Studio Add
CertifiedGrant Data Studio access
Google Data Studio Add
Grant Data Studio access
Add members to a role on a report or data source. role is VIEWER or EDITOR and applies to user: , group: , serviceAccount: , and domain: members. linkRole is LINK_VIEWER or LINK_EDITOR and applies only to allUsers and domain: members. One call uses one role, so named members and link members cannot be mixed. allUsers and domain: require allowLinkSharing: true.
type: io.kestra.plugin.datastudio.permissions.AddExamples
Grant a group read access to a report
id: permissions_add
namespace: company.team
inputs:
- id: asset_id
type: STRING
tasks:
- id: add
type: io.kestra.plugin.datastudio.permissions.Add
serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
assetName: "{{ inputs.asset_id }}"
members:
- "group:analysts@acme.com"
role: VIEWER
Properties
assetName *string
Asset name
The Data Studio asset ID.
members *array
Members
Members to add. user: , group: , and serviceAccount: take role. allUsers takes linkRole. domain: takes role or linkRole. allUsers and domain: require allowLinkSharing.
accessToken string
Access token
OAuth access token. When set, the service account exchange is skipped, so the token must already include datastudio.readonly for read tasks or datastudio for Add and Revoke.
allowLinkSharing booleanstring
falseAllow link sharing
Permit allUsers, domain: members, and linkRole. Leave false unless the flow should make an asset public or domain-wide.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://datastudio.googleapis.com/v1API base URL
Data Studio API root. Defaults to https://datastudio.googleapis.com/v1.
linkRole string
LINK_VIEWERLINK_EDITORLink role
LINK_VIEWER or LINK_EDITOR. Used only when every member is allUsers or domain: . Requires allowLinkSharing. Do not set this when granting role to user: , group: , or serviceAccount: members.
role string
VIEWERVIEWEREDITORRole
Role to grant. VIEWER or EDITOR. OWNER, LINK_VIEWER, and LINK_EDITOR are not accepted here.
serviceAccount string
Service account JSON
Google service account key JSON. Read tasks request https://www.googleapis.com/auth/datastudio.readonly. Add and Revoke request https://www.googleapis.com/auth/datastudio. Grant the scope through domain-wide delegation in a Google Workspace or Cloud Identity organization. Use this or accessToken.
subject string
Delegated user
Workspace user email the service account impersonates. Required for domain-wide delegation. Ignored when accessToken is set.
tokenUri string
https://oauth2.googleapis.com/tokenToken URI
OAuth token endpoint used to exchange a service account JWT.
Outputs
permissions object
Updated permissions by role
size integer
Number of members on the asset after the update
