Manage GCP Backend Service IAM Policies

The gcp:compute/backendServiceIamPolicy:BackendServiceIamPolicy resource, part of the Pulumi GCP provider, manages IAM policies for Compute Engine Backend Services. Three related resources provide different levels of control: BackendServiceIamPolicy replaces the entire policy, BackendServiceIamBinding manages all members for a specific role, and BackendServiceIamMember adds individual members non-authoritatively. This guide focuses on four capabilities: authoritative policy replacement, role-level member management, individual member grants, and time-based access with IAM Conditions.

These resources reference existing Backend Services and require project configuration. The examples are intentionally small. Combine them with your own backend service infrastructure and organizational access patterns.

Grant a role to multiple members with IamBinding

When you need to grant the same role to multiple users or service accounts, BackendServiceIamBinding manages the complete member list for that role while preserving other roles in the policy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.BackendServiceIamBinding("binding", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.admin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.BackendServiceIamBinding("binding",
    project=default["project"],
    name=default["name"],
    role="roles/compute.admin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewBackendServiceIamBinding(ctx, "binding", &compute.BackendServiceIamBindingArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.BackendServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.BackendServiceIamBinding;
import com.pulumi.gcp.compute.BackendServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new BackendServiceIamBinding("binding", BackendServiceIamBindingArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.admin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:BackendServiceIamBinding
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.admin
      members:
        - user:jane@example.com

The role property specifies which permission set to grant. The members array lists all identities that should have this role; BackendServiceIamBinding replaces any existing members for this role but leaves other roles untouched. This is authoritative for the specified role only.

Add a single member to a role with IamMember

Teams often need to grant access to individual users without affecting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.BackendServiceIamMember("member", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.BackendServiceIamMember("member",
    project=default["project"],
    name=default["name"],
    role="roles/compute.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewBackendServiceIamMember(ctx, "member", &compute.BackendServiceIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.admin"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.BackendServiceIamMember("member", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.BackendServiceIamMember;
import com.pulumi.gcp.compute.BackendServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new BackendServiceIamMember("member", BackendServiceIamMemberArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:BackendServiceIamMember
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.admin
      member: user:jane@example.com

BackendServiceIamMember adds one member to a role non-authoritatively. The member property specifies a single identity (user, service account, or group). Unlike IamBinding, this preserves other members already assigned to the same role, making it safe to use alongside other IamMember resources for the same role.

Replace the entire IAM policy with IamPolicy

When you need complete control over all IAM bindings for a backend service, BackendServiceIamPolicy sets the entire policy authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/compute.admin",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.compute.BackendServiceIamPolicy("policy", {
    project: _default.project,
    name: _default.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/compute.admin",
    "members": ["user:jane@example.com"],
}])
policy = gcp.compute.BackendServiceIamPolicy("policy",
    project=default["project"],
    name=default["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/compute.admin",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = compute.NewBackendServiceIamPolicy(ctx, "policy", &compute.BackendServiceIamPolicyArgs{
			Project:    pulumi.Any(_default.Project),
			Name:       pulumi.Any(_default.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/compute.admin",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Compute.BackendServiceIamPolicy("policy", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.compute.BackendServiceIamPolicy;
import com.pulumi.gcp.compute.BackendServiceIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/compute.admin")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new BackendServiceIamPolicy("policy", BackendServiceIamPolicyArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:compute:BackendServiceIamPolicy
    properties:
      project: ${default.project}
      name: ${default.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/compute.admin
            members:
              - user:jane@example.com

The policyData property accepts output from gcp.organizations.getIAMPolicy, which defines all role bindings in a single data source. This resource replaces the entire IAM policy, removing any bindings not specified in policyData. Use this when you need full policy control; it cannot coexist with IamBinding or IamMember resources on the same backend service.

Apply time-based access with IAM Conditions

Temporary access grants often require expiration dates to limit permissions to specific time windows.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.BackendServiceIamBinding("binding", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.admin",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.BackendServiceIamBinding("binding",
    project=default["project"],
    name=default["name"],
    role="roles/compute.admin",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewBackendServiceIamBinding(ctx, "binding", &compute.BackendServiceIamBindingArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &compute.BackendServiceIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.BackendServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Compute.Inputs.BackendServiceIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.BackendServiceIamBinding;
import com.pulumi.gcp.compute.BackendServiceIamBindingArgs;
import com.pulumi.gcp.compute.inputs.BackendServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new BackendServiceIamBinding("binding", BackendServiceIamBindingArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.admin")
            .members("user:jane@example.com")
            .condition(BackendServiceIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:BackendServiceIamBinding
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.admin
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions attach constraints to role bindings. The condition block requires a title, optional description, and an expression using Common Expression Language (CEL). Here, the expression compares request.time against a timestamp to automatically revoke access after 2019-12-31. Conditions work with all three IAM resource types but have known limitations documented in the GCP IAM Conditions overview.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative policy management, role binding with single and multiple members, and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Backend Service resources and GCP project configuration. They focus on configuring IAM policies rather than provisioning the backend services themselves.

To keep things focused, common IAM patterns are omitted, including:

  • Custom role definitions and management
  • Service account creation and key management
  • Audit logging configuration
  • Policy conflict resolution between resource types

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the BackendServiceIamPolicy resource reference for all available configuration options.

Let's manage GCP Backend Service IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between BackendServiceIamPolicy, BackendServiceIamBinding, and BackendServiceIamMember?
BackendServiceIamPolicy is authoritative and replaces the entire IAM policy. BackendServiceIamBinding is authoritative for a specific role, preserving other roles. BackendServiceIamMember is non-authoritative, adding a single member while preserving other members for that role.
Can I mix these IAM resources together?
BackendServiceIamPolicy cannot be used with BackendServiceIamBinding or BackendServiceIamMember, as they will conflict over policy state. However, BackendServiceIamBinding and BackendServiceIamMember can be used together if they don’t grant the same role.
IAM Conditions
How do I use IAM Conditions, and what are the limitations?
Add a condition block with title, description, and expression (e.g., request.time < timestamp("2020-01-01T00:00:00Z") for expiration). IAM Conditions have known limitations that should be reviewed in the GCP documentation.
How do I set up time-based access that expires?
Use a condition with an expression like request.time < timestamp("2020-01-01T00:00:00Z") to grant access until a specific date.
Configuration & Import
How do I generate the policyData for BackendServiceIamPolicy?
Use the gcp.organizations.getIAMPolicy data source with bindings to generate policyData, then reference it in your BackendServiceIamPolicy resource.
What formats can I use when importing these resources?
You can import using the full path (projects/{{project}}/global/backendServices/{{name}}), short form ({{project}}/{{name}}), or just the name ({{name}}). Variables not provided will be taken from the provider configuration.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides