Manage GCP API Gateway IAM Access

The gcp:apigateway/gatewayIamMember:GatewayIamMember resource, part of the Pulumi GCP provider, grants IAM roles to members for API Gateway gateways. This guide focuses on three approaches: non-authoritative single-member grants, authoritative role-level member lists, and complete policy replacement.

GCP provides three related resources for gateway IAM: GatewayIamMember (non-authoritative, adds one member), GatewayIamBinding (authoritative for a role, sets all members), and GatewayIamPolicy (authoritative for all roles, replaces entire policy). GatewayIamPolicy conflicts with the other two; GatewayIamBinding and GatewayIamMember can coexist if they manage different roles. The examples are intentionally small. Combine them with your own gateway infrastructure and identity management.

Grant a role to a single member

Most IAM configurations start by granting a role to one user or service account without affecting other members who already have that role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.apigateway.GatewayIamMember("member", {
    project: apiGw.project,
    region: apiGw.region,
    gateway: apiGw.gatewayId,
    role: "roles/apigateway.viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.apigateway.GatewayIamMember("member",
    project=api_gw["project"],
    region=api_gw["region"],
    gateway=api_gw["gatewayId"],
    role="roles/apigateway.viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/apigateway"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := apigateway.NewGatewayIamMember(ctx, "member", &apigateway.GatewayIamMemberArgs{
			Project: pulumi.Any(apiGw.Project),
			Region:  pulumi.Any(apiGw.Region),
			Gateway: pulumi.Any(apiGw.GatewayId),
			Role:    pulumi.String("roles/apigateway.viewer"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.ApiGateway.GatewayIamMember("member", new()
    {
        Project = apiGw.Project,
        Region = apiGw.Region,
        Gateway = apiGw.GatewayId,
        Role = "roles/apigateway.viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.apigateway.GatewayIamMember;
import com.pulumi.gcp.apigateway.GatewayIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new GatewayIamMember("member", GatewayIamMemberArgs.builder()
            .project(apiGw.project())
            .region(apiGw.region())
            .gateway(apiGw.gatewayId())
            .role("roles/apigateway.viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:apigateway:GatewayIamMember
    properties:
      project: ${apiGw.project}
      region: ${apiGw.region}
      gateway: ${apiGw.gatewayId}
      role: roles/apigateway.viewer
      member: user:jane@example.com

The member property specifies who receives access, using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property defines what they can do. GatewayIamMember is non-authoritative: it adds this member to the role without removing others.

Grant a role to multiple members authoritatively

When you need to define the complete list of members for a role, GatewayIamBinding replaces any existing members with your specified list.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.apigateway.GatewayIamBinding("binding", {
    project: apiGw.project,
    region: apiGw.region,
    gateway: apiGw.gatewayId,
    role: "roles/apigateway.viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.apigateway.GatewayIamBinding("binding",
    project=api_gw["project"],
    region=api_gw["region"],
    gateway=api_gw["gatewayId"],
    role="roles/apigateway.viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/apigateway"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := apigateway.NewGatewayIamBinding(ctx, "binding", &apigateway.GatewayIamBindingArgs{
			Project: pulumi.Any(apiGw.Project),
			Region:  pulumi.Any(apiGw.Region),
			Gateway: pulumi.Any(apiGw.GatewayId),
			Role:    pulumi.String("roles/apigateway.viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.ApiGateway.GatewayIamBinding("binding", new()
    {
        Project = apiGw.Project,
        Region = apiGw.Region,
        Gateway = apiGw.GatewayId,
        Role = "roles/apigateway.viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.apigateway.GatewayIamBinding;
import com.pulumi.gcp.apigateway.GatewayIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new GatewayIamBinding("binding", GatewayIamBindingArgs.builder()
            .project(apiGw.project())
            .region(apiGw.region())
            .gateway(apiGw.gatewayId())
            .role("roles/apigateway.viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:apigateway:GatewayIamBinding
    properties:
      project: ${apiGw.project}
      region: ${apiGw.region}
      gateway: ${apiGw.gatewayId}
      role: roles/apigateway.viewer
      members:
        - user:jane@example.com

The members property takes an array of identities. GatewayIamBinding is authoritative for this role: it sets exactly these members and removes anyone else. Other roles on the gateway remain unchanged.

Replace the entire IAM policy

For complete control over all roles and members, GatewayIamPolicy replaces the entire IAM policy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/apigateway.viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.apigateway.GatewayIamPolicy("policy", {
    project: apiGw.project,
    region: apiGw.region,
    gateway: apiGw.gatewayId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/apigateway.viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.apigateway.GatewayIamPolicy("policy",
    project=api_gw["project"],
    region=api_gw["region"],
    gateway=api_gw["gatewayId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/apigateway"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/apigateway.viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = apigateway.NewGatewayIamPolicy(ctx, "policy", &apigateway.GatewayIamPolicyArgs{
			Project:    pulumi.Any(apiGw.Project),
			Region:     pulumi.Any(apiGw.Region),
			Gateway:    pulumi.Any(apiGw.GatewayId),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/apigateway.viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.ApiGateway.GatewayIamPolicy("policy", new()
    {
        Project = apiGw.Project,
        Region = apiGw.Region,
        Gateway = apiGw.GatewayId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.apigateway.GatewayIamPolicy;
import com.pulumi.gcp.apigateway.GatewayIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/apigateway.viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new GatewayIamPolicy("policy", GatewayIamPolicyArgs.builder()
            .project(apiGw.project())
            .region(apiGw.region())
            .gateway(apiGw.gatewayId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:apigateway:GatewayIamPolicy
    properties:
      project: ${apiGw.project}
      region: ${apiGw.region}
      gateway: ${apiGw.gatewayId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/apigateway.viewer
            members:
              - user:jane@example.com

The policyData property comes from getIAMPolicy, which defines bindings (role-to-members mappings). GatewayIamPolicy is fully authoritative: it replaces all roles and members. This conflicts with GatewayIamBinding and GatewayIamMember; use one approach or the other, not both.

Beyond these examples

These snippets focus on specific IAM management features: single-member grants, role-level member lists, and complete policy replacement. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as API Gateway gateways and GCP project and region configuration. They focus on granting permissions rather than provisioning gateways or managing service accounts.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Service account creation and management
Gateway provisioning and configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the GatewayIamMember resource reference for all available configuration options.

Let's manage GCP API Gateway IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between GatewayIamPolicy, GatewayIamBinding, and GatewayIamMember?

gcp.apigateway.GatewayIamPolicy is authoritative and replaces the entire IAM policy. gcp.apigateway.GatewayIamBinding is authoritative for a specific role, preserving other roles. gcp.apigateway.GatewayIamMember is non-authoritative, adding a single member to a role while preserving other members.

Can I use GatewayIamPolicy with GatewayIamBinding or GatewayIamMember?

No, gcp.apigateway.GatewayIamPolicy cannot be used with gcp.apigateway.GatewayIamBinding or gcp.apigateway.GatewayIamMember because they will conflict over the policy configuration.

Can I use GatewayIamBinding and GatewayIamMember together?

Yes, but only if they grant privileges to different roles. Using both for the same role will cause conflicts.

Identity & Role Configuration

What identity formats can I use for the member property?

You can use allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, or federated identities like principal://iam.googleapis.com/....

How do I specify a custom IAM role?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.

What properties can't I change after creating the resource?

All main properties are immutable: gateway, member, project, region, and role.

Beta Status & Limitations

Is this resource production-ready?

This resource is in beta and requires the terraform-provider-google-beta provider.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides