Class IAMPolicy

Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case:

  • gcp.projects.IAMPolicy: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached.
  • gcp.projects.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.
  • gcp.projects.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved.
  • gcp.projects.IAMAuditConfig: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service.

Note: gcp.projects.IAMPolicy cannot be used in conjunction with gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig or they will fight over what your policy should be.

Note: gcp.projects.IAMBinding resources can be used in conjunction with gcp.projects.IAMMember resources only if they do not grant privilege to the same role.

google_project_iam_policy

Be careful! You can accidentally lock yourself out of your project using this resource. Deleting a gcp.projects.IAMPolicy removes access from anyone without organization-level access to the project. Proceed with caution. It's not recommended to use gcp.projects.IAMPolicy with your provider project to avoid locking yourself out, and it should generally only be used with projects fully managed by this provider. If you do use this resource, it is recommended to import the policy before applying the change.

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var admin = Output.Create(Gcp.Organizations.GetIAMPolicy.InvokeAsync(new Gcp.Organizations.GetIAMPolicyArgs
    {
        Binding = 
        {

            {
                { "role", "roles/editor" },
                { "members", 
                {
                    "user:jane@example.com",
                } },
            },
        },
    }));
    var project = new Gcp.Projects.IAMPolicy("project", new Gcp.Projects.IAMPolicyArgs
    {
        Project = "your-project-id",
        PolicyData = admin.Apply(admin => admin.PolicyData),
    });
}

}

With IAM Conditions):

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var admin = Output.Create(Gcp.Organizations.GetIAMPolicy.InvokeAsync(new Gcp.Organizations.GetIAMPolicyArgs
    {
        Bindings = 
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingArgs
            {
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionArgs
                {
                    Description = "Expiring at midnight of 2019-12-31",
                    Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
                    Title = "expires_after_2019_12_31",
                },
                Members = 
                {
                    "user:jane@example.com",
                },
                Role = "roles/editor",
            },
        },
    }));
    var project = new Gcp.Projects.IAMPolicy("project", new Gcp.Projects.IAMPolicyArgs
    {
        PolicyData = admin.Apply(admin => admin.PolicyData),
        Project = "your-project-id",
    });
}

}

google_project_iam_binding

Note: If role is set to roles/owner and you don't specify a user or service account you have access to in members, you can lock yourself out of your project.

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var project = new Gcp.Projects.IAMBinding("project", new Gcp.Projects.IAMBindingArgs
    {
        Members = 
        {
            "user:jane@example.com",
        },
        Project = "your-project-id",
        Role = "roles/editor",
    });
}

}

With IAM Conditions:

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var project = new Gcp.Projects.IAMBinding("project", new Gcp.Projects.IAMBindingArgs
    {
        Condition = new Gcp.Projects.Inputs.IAMBindingConditionArgs
        {
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            Title = "expires_after_2019_12_31",
        },
        Members = 
        {
            "user:jane@example.com",
        },
        Project = "your-project-id",
        Role = "roles/editor",
    });
}

}

google_project_iam_member

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var project = new Gcp.Projects.IAMMember("project", new Gcp.Projects.IAMMemberArgs
    {
        Member = "user:jane@example.com",
        Project = "your-project-id",
        Role = "roles/editor",
    });
}

}

With IAM Conditions:

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var project = new Gcp.Projects.IAMMember("project", new Gcp.Projects.IAMMemberArgs
    {
        Condition = new Gcp.Projects.Inputs.IAMMemberConditionArgs
        {
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
            Title = "expires_after_2019_12_31",
        },
        Member = "user:jane@example.com",
        Project = "your-project-id",
        Role = "roles/editor",
    });
}

}

google_project_iam_audit_config

using Pulumi;
using Gcp = Pulumi.Gcp;

class MyStack : Stack
{
public MyStack()
{
    var project = new Gcp.Projects.IAMAuditConfig("project", new Gcp.Projects.IAMAuditConfigArgs
    {
        AuditLogConfigs = 
        {
            new Gcp.Projects.Inputs.IAMAuditConfigAuditLogConfigArgs
            {
                LogType = "ADMIN_READ",
            },
            new Gcp.Projects.Inputs.IAMAuditConfigAuditLogConfigArgs
            {
                ExemptedMembers = 
                {
                    "user:joebloggs@hashicorp.com",
                },
                LogType = "DATA_READ",
            },
        },
        Project = "your-project-id",
        Service = "allServices",
    });
}

}
Inheritance
System.Object
Resource
CustomResource
IAMPolicy
Inherited Members
System.Object.Equals(System.Object)
System.Object.Equals(System.Object, System.Object)
System.Object.GetHashCode()
System.Object.GetType()
System.Object.MemberwiseClone()
System.Object.ReferenceEquals(System.Object, System.Object)
System.Object.ToString()
Namespace: Pulumi.Gcp.Projects
Assembly: Pulumi.Gcp.dll
Syntax
public class IAMPolicy : CustomResource

Constructors

View Source

IAMPolicy(String, IAMPolicyArgs, CustomResourceOptions)

Create a IAMPolicy resource with the given unique name, arguments, and options.

Declaration
public IAMPolicy(string name, IAMPolicyArgs args, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resource
IAMPolicyArgs args

The arguments used to populate this resource's properties
CustomResourceOptions options

A bag of options that control this resource's behavior

Properties

View Source

Etag

(Computed) The etag of the project's IAM policy.

Declaration
public Output<string> Etag { get; }
Property Value
Type Description
Output<System.String>
View Source

PolicyData

The gcp.organizations.getIAMPolicy data source that represents the IAM policy that will be applied to the project. The policy will be merged with any existing policy applied to the project.

Declaration
public Output<string> PolicyData { get; }
Property Value
Type Description
Output<System.String>
View Source

Project

The project ID. If not specified for gcp.projects.IAMBinding, gcp.projects.IAMMember, or gcp.projects.IAMAuditConfig, uses the ID of the project configured with the provider. Required for gcp.projects.IAMPolicy - you must explicitly set the project, and it will not be inferred from the provider.

Declaration
public Output<string> Project { get; }
Property Value
Type Description
Output<System.String>

Methods

View Source

Get(String, Input<String>, IAMPolicyState, CustomResourceOptions)

Get an existing IAMPolicy resource's state with the given name, ID, and optional extra properties used to qualify the lookup.

Declaration
public static IAMPolicy Get(string name, Input<string> id, IAMPolicyState state = null, CustomResourceOptions options = null)
Parameters
Type Name Description
System.String name

The unique name of the resulting resource.
Input<System.String> id

The unique provider ID of the resource to lookup.
IAMPolicyState state

Any extra arguments used during the lookup.
CustomResourceOptions options

A bag of options that control this resource's behavior
Returns
Type Description
IAMPolicy