Manage GCP Access Context Manager IAM Policies

The gcp:accesscontextmanager/accessPolicyIamMember:AccessPolicyIamMember resource, part of the Pulumi GCP provider, grants IAM permissions on Access Context Manager access policies, controlling who can manage VPC Service Controls perimeters and access levels. This guide focuses on three approaches: single-member grants (Member), multi-member role assignments (Binding), and complete policy replacement (Policy).

The three IAM resources (Member, Binding, Policy) reference an existing access policy and differ in how they manage permissions. Member adds one identity without affecting others; Binding manages all members for one role; Policy replaces the entire IAM policy. The examples are intentionally small. Choose the resource that matches your permission management strategy.

Grant a single user access to an access policy

Most IAM configurations add individual users to specific roles without disrupting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.accesscontextmanager.AccessPolicyIamMember("member", {
    name: access_policy.name,
    role: "roles/accesscontextmanager.policyAdmin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.accesscontextmanager.AccessPolicyIamMember("member",
    name=access_policy["name"],
    role="roles/accesscontextmanager.policyAdmin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/accesscontextmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := accesscontextmanager.NewAccessPolicyIamMember(ctx, "member", &accesscontextmanager.AccessPolicyIamMemberArgs{
			Name:   pulumi.Any(access_policy.Name),
			Role:   pulumi.String("roles/accesscontextmanager.policyAdmin"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.AccessContextManager.AccessPolicyIamMember("member", new()
    {
        Name = access_policy.Name,
        Role = "roles/accesscontextmanager.policyAdmin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyIamMember;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new AccessPolicyIamMember("member", AccessPolicyIamMemberArgs.builder()
            .name(access_policy.name())
            .role("roles/accesscontextmanager.policyAdmin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:accesscontextmanager:AccessPolicyIamMember
    properties:
      name: ${["access-policy"].name}
      role: roles/accesscontextmanager.policyAdmin
      member: user:jane@example.com

The Member resource is non-authoritative: it adds one identity to one role while preserving other members and roles. The name property identifies the access policy, role specifies the permission level (like roles/accesscontextmanager.policyAdmin), and member identifies the user, service account, or group. This approach works well when multiple teams manage different roles independently.

Grant multiple users the same role

When several identities need identical permissions, the Binding resource manages the complete member list for a single role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.accesscontextmanager.AccessPolicyIamBinding("binding", {
    name: access_policy.name,
    role: "roles/accesscontextmanager.policyAdmin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.accesscontextmanager.AccessPolicyIamBinding("binding",
    name=access_policy["name"],
    role="roles/accesscontextmanager.policyAdmin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/accesscontextmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := accesscontextmanager.NewAccessPolicyIamBinding(ctx, "binding", &accesscontextmanager.AccessPolicyIamBindingArgs{
			Name: pulumi.Any(access_policy.Name),
			Role: pulumi.String("roles/accesscontextmanager.policyAdmin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.AccessContextManager.AccessPolicyIamBinding("binding", new()
    {
        Name = access_policy.Name,
        Role = "roles/accesscontextmanager.policyAdmin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyIamBinding;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new AccessPolicyIamBinding("binding", AccessPolicyIamBindingArgs.builder()
            .name(access_policy.name())
            .role("roles/accesscontextmanager.policyAdmin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:accesscontextmanager:AccessPolicyIamBinding
    properties:
      name: ${["access-policy"].name}
      role: roles/accesscontextmanager.policyAdmin
      members:
        - user:jane@example.com

The Binding resource is authoritative for its role: it defines all members who should have that role, replacing any existing members. The members property takes an array of identity strings. If you later add a Member resource for the same role, they will conflict. Use Binding when you want one resource to control all access for a specific role.

Replace the entire IAM policy

Organizations that manage IAM centrally or need complete control use the Policy resource to define all roles and members together.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/accesscontextmanager.policyAdmin",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.accesscontextmanager.AccessPolicyIamPolicy("policy", {
    name: access_policy.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/accesscontextmanager.policyAdmin",
    "members": ["user:jane@example.com"],
}])
policy = gcp.accesscontextmanager.AccessPolicyIamPolicy("policy",
    name=access_policy["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/accesscontextmanager"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/accesscontextmanager.policyAdmin",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = accesscontextmanager.NewAccessPolicyIamPolicy(ctx, "policy", &accesscontextmanager.AccessPolicyIamPolicyArgs{
			Name:       pulumi.Any(access_policy.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/accesscontextmanager.policyAdmin",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.AccessContextManager.AccessPolicyIamPolicy("policy", new()
    {
        Name = access_policy.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyIamPolicy;
import com.pulumi.gcp.accesscontextmanager.AccessPolicyIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/accesscontextmanager.policyAdmin")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new AccessPolicyIamPolicy("policy", AccessPolicyIamPolicyArgs.builder()
            .name(access_policy.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:accesscontextmanager:AccessPolicyIamPolicy
    properties:
      name: ${["access-policy"].name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/accesscontextmanager.policyAdmin
            members:
              - user:jane@example.com

The Policy resource is fully authoritative: it replaces the entire IAM policy with the document you provide. The policyData property comes from the getIAMPolicy data source, which constructs a policy document from bindings (role and member lists). This approach cannot coexist with Member or Binding resources on the same access policy, as they will conflict over policy ownership.

Beyond these examples

These snippets focus on specific IAM management patterns: single-member grants (Member), role-level member lists (Binding), and complete policy replacement (Policy). They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as an Access Context Manager access policy (referenced by name). They focus on granting permissions rather than creating the underlying access policy.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Service account and group identity formats
Federated identity principals

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the AccessPolicyIamMember resource reference for all available configuration options.

Let's manage GCP Access Context Manager IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Can I use multiple IAM resources together on the same access policy?

AccessPolicyIamPolicy cannot be used with AccessPolicyIamBinding or AccessPolicyIamMember, as they will conflict over the policy. However, AccessPolicyIamBinding and AccessPolicyIamMember can be used together only if they don’t grant privilege to the same role.

What's the difference between AccessPolicyIamPolicy, AccessPolicyIamBinding, and AccessPolicyIamMember?

AccessPolicyIamPolicy is authoritative and replaces the entire IAM policy. AccessPolicyIamBinding is authoritative for a given role but preserves other roles. AccessPolicyIamMember is non-authoritative and preserves other members for the role.

Which IAM resource should I use for my access policy?

Use AccessPolicyIamPolicy for full policy control, AccessPolicyIamBinding to manage all members for a specific role, or AccessPolicyIamMember to add individual members without affecting others.

Configuration & Constraints

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, and federated identities like principal://iam.googleapis.com/....

How do I specify custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. When importing, use the full custom role name (e.g., projects/my-project/roles/my-custom-role).

What properties can't I change after creating the resource?

The member, name, role, and condition properties are all immutable and cannot be changed after creation.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides