Manage GCP Artifact Registry Repository IAM Policies

The gcp:artifactregistry/repositoryIamPolicy:RepositoryIamPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Artifact Registry repositories through three resource types with different authoritativeness levels. This guide focuses on three capabilities: authoritative policy replacement (RepositoryIamPolicy), role-level member management (RepositoryIamBinding), and incremental member addition (RepositoryIamMember).

These resources reference existing Artifact Registry repositories and require project and location configuration. The examples are intentionally small. Combine them with your own repository infrastructure and access requirements. Note that RepositoryIamPolicy cannot be used alongside RepositoryIamBinding or RepositoryIamMember, as they will conflict over policy state.

Replace the entire IAM policy authoritatively

When you need complete control over repository access, RepositoryIamPolicy replaces the entire IAM policy, ensuring no unexpected permissions remain.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/artifactregistry.reader",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.artifactregistry.RepositoryIamPolicy("policy", {
    project: my_repo.project,
    location: my_repo.location,
    repository: my_repo.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/artifactregistry.reader",
    "members": ["user:jane@example.com"],
}])
policy = gcp.artifactregistry.RepositoryIamPolicy("policy",
    project=my_repo["project"],
    location=my_repo["location"],
    repository=my_repo["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/artifactregistry"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/artifactregistry.reader",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = artifactregistry.NewRepositoryIamPolicy(ctx, "policy", &artifactregistry.RepositoryIamPolicyArgs{
			Project:    pulumi.Any(my_repo.Project),
			Location:   pulumi.Any(my_repo.Location),
			Repository: pulumi.Any(my_repo.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/artifactregistry.reader",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.ArtifactRegistry.RepositoryIamPolicy("policy", new()
    {
        Project = my_repo.Project,
        Location = my_repo.Location,
        Repository = my_repo.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.artifactregistry.RepositoryIamPolicy;
import com.pulumi.gcp.artifactregistry.RepositoryIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/artifactregistry.reader")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new RepositoryIamPolicy("policy", RepositoryIamPolicyArgs.builder()
            .project(my_repo.project())
            .location(my_repo.location())
            .repository(my_repo.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:artifactregistry:RepositoryIamPolicy
    properties:
      project: ${["my-repo"].project}
      location: ${["my-repo"].location}
      repository: ${["my-repo"].name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/artifactregistry.reader
            members:
              - user:jane@example.com

The policyData property accepts output from getIAMPolicy, which defines bindings between roles and members. This resource is authoritative: it removes any existing bindings not specified in your configuration. Use this when you want to guarantee the exact state of all repository permissions.

Grant a role to multiple members at once

When multiple users or service accounts need the same access level, RepositoryIamBinding manages all members for a specific role while preserving other roles.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.artifactregistry.RepositoryIamBinding("binding", {
    project: my_repo.project,
    location: my_repo.location,
    repository: my_repo.name,
    role: "roles/artifactregistry.reader",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.artifactregistry.RepositoryIamBinding("binding",
    project=my_repo["project"],
    location=my_repo["location"],
    repository=my_repo["name"],
    role="roles/artifactregistry.reader",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/artifactregistry"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := artifactregistry.NewRepositoryIamBinding(ctx, "binding", &artifactregistry.RepositoryIamBindingArgs{
			Project:    pulumi.Any(my_repo.Project),
			Location:   pulumi.Any(my_repo.Location),
			Repository: pulumi.Any(my_repo.Name),
			Role:       pulumi.String("roles/artifactregistry.reader"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.ArtifactRegistry.RepositoryIamBinding("binding", new()
    {
        Project = my_repo.Project,
        Location = my_repo.Location,
        Repository = my_repo.Name,
        Role = "roles/artifactregistry.reader",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.artifactregistry.RepositoryIamBinding;
import com.pulumi.gcp.artifactregistry.RepositoryIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new RepositoryIamBinding("binding", RepositoryIamBindingArgs.builder()
            .project(my_repo.project())
            .location(my_repo.location())
            .repository(my_repo.name())
            .role("roles/artifactregistry.reader")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:artifactregistry:RepositoryIamBinding
    properties:
      project: ${["my-repo"].project}
      location: ${["my-repo"].location}
      repository: ${["my-repo"].name}
      role: roles/artifactregistry.reader
      members:
        - user:jane@example.com

The members property lists all identities that should have the specified role. This resource is authoritative for its role: it replaces the member list for that role but leaves other roles untouched. You can use multiple RepositoryIamBinding resources for different roles on the same repository.

Add a single member to a role incrementally

When you need to grant access to one user without affecting existing members, RepositoryIamMember adds individual members non-authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.artifactregistry.RepositoryIamMember("member", {
    project: my_repo.project,
    location: my_repo.location,
    repository: my_repo.name,
    role: "roles/artifactregistry.reader",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.artifactregistry.RepositoryIamMember("member",
    project=my_repo["project"],
    location=my_repo["location"],
    repository=my_repo["name"],
    role="roles/artifactregistry.reader",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/artifactregistry"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := artifactregistry.NewRepositoryIamMember(ctx, "member", &artifactregistry.RepositoryIamMemberArgs{
			Project:    pulumi.Any(my_repo.Project),
			Location:   pulumi.Any(my_repo.Location),
			Repository: pulumi.Any(my_repo.Name),
			Role:       pulumi.String("roles/artifactregistry.reader"),
			Member:     pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.ArtifactRegistry.RepositoryIamMember("member", new()
    {
        Project = my_repo.Project,
        Location = my_repo.Location,
        Repository = my_repo.Name,
        Role = "roles/artifactregistry.reader",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.artifactregistry.RepositoryIamMember;
import com.pulumi.gcp.artifactregistry.RepositoryIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RepositoryIamMember("member", RepositoryIamMemberArgs.builder()
            .project(my_repo.project())
            .location(my_repo.location())
            .repository(my_repo.name())
            .role("roles/artifactregistry.reader")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:artifactregistry:RepositoryIamMember
    properties:
      project: ${["my-repo"].project}
      location: ${["my-repo"].location}
      repository: ${["my-repo"].name}
      role: roles/artifactregistry.reader
      member: user:jane@example.com

The member property specifies a single identity to grant the role. This resource is non-authoritative: it adds the member without removing others. Use this when you want to grant access incrementally or when multiple teams manage access to the same repository independently.

Beyond these examples

These snippets focus on specific IAM management approaches: authoritative policy replacement, role-level binding management, and incremental member addition. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Artifact Registry repositories and GCP project with location configured. They focus on IAM resource configuration rather than repository provisioning.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition blocks)
Multiple roles in a single resource
Service account impersonation
Custom role definitions

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Artifact Registry Repository IAM Policy resource reference for all available configuration options.

Let's manage GCP Artifact Registry Repository IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Can I use RepositoryIamPolicy with RepositoryIamBinding or RepositoryIamMember?

No, RepositoryIamPolicy cannot be used with RepositoryIamBinding or RepositoryIamMember because they will conflict over the policy. Use RepositoryIamPolicy alone for full policy control, or use RepositoryIamBinding/RepositoryIamMember without RepositoryIamPolicy.

Can I use RepositoryIamBinding and RepositoryIamMember together?

Yes, but only if they grant different roles. Using both for the same role will cause conflicts.

Which IAM resource should I use for my repository?

Use RepositoryIamPolicy to replace the entire policy, RepositoryIamBinding to manage all members for a specific role (preserving other roles), or RepositoryIamMember to add individual members without affecting others.

Configuration & Setup

How do I generate the policyData for RepositoryIamPolicy?

Use the gcp.organizations.getIAMPolicy data source with your desired bindings, then pass its policyData output to the RepositoryIamPolicy resource.

What location values can I use for multi-region repositories?

Special multi-region values are asia, europe, and us. You can also use specific regional locations.

What happens if I don't specify project or location?

Both project and location can be parsed from the parent repository identifier. If not provided there, project defaults to the provider configuration and location defaults to the provider configuration.

Import & Migration

How do I import an IAM resource with a custom role?

Use the full role name including the project or organization prefix: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides