1. Docs
2. Reference
3. API
4. GCP
5. serviceAccount
6. IAMPolicy

IAMPolicy

When managing IAM roles, you can treat a service account either as a resource or as an identity. This resource is to add iam policy bindings to a service account resource to configure permissions for who can edit the service account. To configure permissions for a service account to act as an identity that can manage other GCP resources, use the google_project_iam set of resources.

Three different resources help you manage your IAM policy for a service account. Each of these resources serves a different use case:

• gcp.serviceAccount.IAMPolicy: Authoritative. Sets the IAM policy for the service account and replaces any existing policy already attached.
• gcp.serviceAccount.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the service account are preserved.
• gcp.serviceAccount.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the service account are preserved.

Note: gcp.serviceAccount.IAMPolicy cannot be used in conjunction with gcp.serviceAccount.IAMBinding and gcp.serviceAccount.IAMMember or they will fight over what your policy should be.

Note: gcp.serviceAccount.IAMBinding resources can be used in conjunction with gcp.serviceAccount.IAMMember resources only if they do not grant privilege to the same role.

Create a IAMPolicy Resource

new IAMPolicy(name: string, args: IAMPolicyArgs, opts?: CustomResourceOptions);

def IAMPolicy(resource_name, opts=None, policy_data=None, service_account_id=None, __props__=None);

func NewIAMPolicy(ctx *Context, name string, args IAMPolicyArgs, opts ...ResourceOption) (*IAMPolicy, error)

public IAMPolicy(string name, IAMPolicyArgs args, CustomResourceOptions? opts = null)

IAMPolicy Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The IAMPolicy resource accepts the following input properties:

Outputs

All input properties are implicitly available as output properties. Additionally, the IAMPolicy resource produces the following output properties:

Look up an Existing IAMPolicy Resource

Get an existing IAMPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: IAMPolicyState, opts?: CustomResourceOptions): IAMPolicy

static get(resource_name, id, opts=None, etag=None, policy_data=None, service_account_id=None, __props__=None);

func GetIAMPolicy(ctx *Context, name string, id IDInput, state *IAMPolicyState, opts ...ResourceOption) (*IAMPolicy, error)

public static IAMPolicy Get(string name, Input<string> id, IAMPolicyState? state, CustomResourceOptions? opts = null)

The following state arguments are supported:

Package Details

Repository

https://github.com/pulumi/pulumi-gcp

License

Apache-2.0

Notes

This Pulumi package is based on the google-beta Terraform Provider.