Manage GCP Apigee Environment IAM Bindings

The gcp:apigee/environmentIamBinding:EnvironmentIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Apigee environments by granting a specific role to a list of members. This guide focuses on two capabilities: batch role assignment to multiple members and incremental member addition.

IAM bindings reference existing Apigee environments and are authoritative for a given role, meaning they replace the entire member list for that role while preserving other roles. The examples are intentionally small. Combine them with your own Apigee organization and environment infrastructure.

Grant a role to multiple members at once

Teams managing environments often assign the same role to multiple users or service accounts simultaneously, such as giving viewer access to a development team.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.apigee.EnvironmentIamBinding("binding", {
    orgId: apigeeEnvironment.orgId,
    envId: apigeeEnvironment.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.apigee.EnvironmentIamBinding("binding",
    org_id=apigee_environment["orgId"],
    env_id=apigee_environment["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/apigee"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := apigee.NewEnvironmentIamBinding(ctx, "binding", &apigee.EnvironmentIamBindingArgs{
			OrgId: pulumi.Any(apigeeEnvironment.OrgId),
			EnvId: pulumi.Any(apigeeEnvironment.Name),
			Role:  pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Apigee.EnvironmentIamBinding("binding", new()
    {
        OrgId = apigeeEnvironment.OrgId,
        EnvId = apigeeEnvironment.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.apigee.EnvironmentIamBinding;
import com.pulumi.gcp.apigee.EnvironmentIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new EnvironmentIamBinding("binding", EnvironmentIamBindingArgs.builder()
            .orgId(apigeeEnvironment.orgId())
            .envId(apigeeEnvironment.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:apigee:EnvironmentIamBinding
    properties:
      orgId: ${apigeeEnvironment.orgId}
      envId: ${apigeeEnvironment.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The EnvironmentIamBinding resource is authoritative for the specified role: it replaces the complete member list for that role while leaving other roles untouched. The members array accepts various identity formats including users, service accounts, groups, and domains. The orgId and envId properties identify the target Apigee environment.

Add a single member to a role incrementally

When onboarding individual users, teams add them one at a time without affecting existing assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.apigee.EnvironmentIamMember("member", {
    orgId: apigeeEnvironment.orgId,
    envId: apigeeEnvironment.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.apigee.EnvironmentIamMember("member",
    org_id=apigee_environment["orgId"],
    env_id=apigee_environment["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/apigee"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := apigee.NewEnvironmentIamMember(ctx, "member", &apigee.EnvironmentIamMemberArgs{
			OrgId:  pulumi.Any(apigeeEnvironment.OrgId),
			EnvId:  pulumi.Any(apigeeEnvironment.Name),
			Role:   pulumi.String("roles/viewer"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Apigee.EnvironmentIamMember("member", new()
    {
        OrgId = apigeeEnvironment.OrgId,
        EnvId = apigeeEnvironment.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.apigee.EnvironmentIamMember;
import com.pulumi.gcp.apigee.EnvironmentIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new EnvironmentIamMember("member", EnvironmentIamMemberArgs.builder()
            .orgId(apigeeEnvironment.orgId())
            .envId(apigeeEnvironment.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:apigee:EnvironmentIamMember
    properties:
      orgId: ${apigeeEnvironment.orgId}
      envId: ${apigeeEnvironment.name}
      role: roles/viewer
      member: user:jane@example.com

The EnvironmentIamMember resource (shown here for comparison) adds a single member to a role non-authoritatively, preserving other members. Use this when you need to grant access incrementally rather than managing the full member list. The member property takes a single identity string in the same formats as the members array.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and batch and incremental member assignment. They’re intentionally minimal rather than full access management solutions.

The examples reference pre-existing infrastructure such as Apigee environments (orgId and envId references). They focus on configuring IAM bindings rather than provisioning the underlying Apigee infrastructure.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Full policy replacement (EnvironmentIamPolicy resource)
Custom role definitions and formatting
Policy data retrieval (data source usage)

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the Apigee Environment IAM Binding resource reference for all available configuration options.

Let's manage GCP Apigee Environment IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resource should I use for managing Apigee environment permissions?

Choose based on your needs: gcp.apigee.EnvironmentIamPolicy for full policy control (replaces entire policy), gcp.apigee.EnvironmentIamBinding for managing all members of a specific role, or gcp.apigee.EnvironmentIamMember for adding individual members to a role.

Can I use EnvironmentIamPolicy with EnvironmentIamBinding or EnvironmentIamMember?

No, gcp.apigee.EnvironmentIamPolicy cannot be used together with gcp.apigee.EnvironmentIamBinding or gcp.apigee.EnvironmentIamMember because they will conflict over policy control.

Can I use EnvironmentIamBinding and EnvironmentIamMember together?

Yes, but only if they manage different roles. Using both resources for the same role will cause conflicts.

Configuration & Formats

How do I specify custom roles?

Custom roles must use the full path format: [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

What member identity formats are supported?

The members property supports multiple formats: allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

What format should I use for the orgId parameter?

The orgId must be in the format organizations/{{org_name}}, for example organizations/my-apigee-org.

Immutability & Updates

What properties can't I change after creating an EnvironmentIamBinding?

The envId, orgId, role, and condition properties are immutable and cannot be changed after creation. Only the members list can be updated.

Can I use only one EnvironmentIamBinding per role?

Yes, only one gcp.apigee.EnvironmentIamBinding resource can be used per role. To add multiple members to a role, include them all in the members array of a single binding.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides