The gcp:beyondcorp/securityGatewayIamMember:SecurityGatewayIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual identities on BeyondCorp security gateways without affecting other members or roles. This guide focuses on two capabilities: non-authoritative member grants and time-based access with IAM Conditions.
This resource is one of three IAM management options for security gateways. SecurityGatewayIamMember is non-authoritative, meaning it adds one identity to one role while preserving other members and roles. The examples reference existing security gateways. Combine them with your own gateway infrastructure and identity management.
Grant a single user access to a security gateway
Most IAM configurations add individual users to specific resources without disrupting existing permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.beyondcorp.SecurityGatewayIamMember("member", {
project: example.project,
location: example.location,
securityGatewayId: example.securityGatewayId,
role: "roles/beyondcorp.securityGatewayUser",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.beyondcorp.SecurityGatewayIamMember("member",
project=example["project"],
location=example["location"],
security_gateway_id=example["securityGatewayId"],
role="roles/beyondcorp.securityGatewayUser",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayIamMember(ctx, "member", &beyondcorp.SecurityGatewayIamMemberArgs{
Project: pulumi.Any(example.Project),
Location: pulumi.Any(example.Location),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Beyondcorp.SecurityGatewayIamMember("member", new()
{
Project = example.Project,
Location = example.Location,
SecurityGatewayId = example.SecurityGatewayId,
Role = "roles/beyondcorp.securityGatewayUser",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayIamMember;
import com.pulumi.gcp.beyondcorp.SecurityGatewayIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new SecurityGatewayIamMember("member", SecurityGatewayIamMemberArgs.builder()
.project(example.project())
.location(example.location())
.securityGatewayId(example.securityGatewayId())
.role("roles/beyondcorp.securityGatewayUser")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:beyondcorp:SecurityGatewayIamMember
properties:
project: ${example.project}
location: ${example.location}
securityGatewayId: ${example.securityGatewayId}
role: roles/beyondcorp.securityGatewayUser
member: user:jane@example.com
The member property specifies the identity receiving access, using formats like “user:email@example.com” for Google accounts or “serviceAccount:email@project.iam.gserviceaccount.com” for service accounts. The role property defines the permission level, here “roles/beyondcorp.securityGatewayUser”. The securityGatewayId, project, and location properties identify which gateway receives the binding. This resource is non-authoritative: other members with the same role, and other roles on the gateway, remain unchanged.
Grant time-limited access with IAM Conditions
Organizations requiring temporary access or compliance-driven expiration attach IAM Conditions to automatically revoke permissions after a timestamp.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.beyondcorp.SecurityGatewayIamMember("member", {
project: example.project,
location: example.location,
securityGatewayId: example.securityGatewayId,
role: "roles/beyondcorp.securityGatewayUser",
member: "user:jane@example.com",
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
member = gcp.beyondcorp.SecurityGatewayIamMember("member",
project=example["project"],
location=example["location"],
security_gateway_id=example["securityGatewayId"],
role="roles/beyondcorp.securityGatewayUser",
member="user:jane@example.com",
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayIamMember(ctx, "member", &beyondcorp.SecurityGatewayIamMemberArgs{
Project: pulumi.Any(example.Project),
Location: pulumi.Any(example.Location),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Member: pulumi.String("user:jane@example.com"),
Condition: &beyondcorp.SecurityGatewayIamMemberConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Beyondcorp.SecurityGatewayIamMember("member", new()
{
Project = example.Project,
Location = example.Location,
SecurityGatewayId = example.SecurityGatewayId,
Role = "roles/beyondcorp.securityGatewayUser",
Member = "user:jane@example.com",
Condition = new Gcp.Beyondcorp.Inputs.SecurityGatewayIamMemberConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayIamMember;
import com.pulumi.gcp.beyondcorp.SecurityGatewayIamMemberArgs;
import com.pulumi.gcp.beyondcorp.inputs.SecurityGatewayIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new SecurityGatewayIamMember("member", SecurityGatewayIamMemberArgs.builder()
.project(example.project())
.location(example.location())
.securityGatewayId(example.securityGatewayId())
.role("roles/beyondcorp.securityGatewayUser")
.member("user:jane@example.com")
.condition(SecurityGatewayIamMemberConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
member:
type: gcp:beyondcorp:SecurityGatewayIamMember
properties:
project: ${example.project}
location: ${example.location}
securityGatewayId: ${example.securityGatewayId}
role: roles/beyondcorp.securityGatewayUser
member: user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds constraints to the role binding. The expression property uses CEL (Common Expression Language) to define when access is valid, here checking that the request time is before 2020-01-01. The title and description properties document the condition’s purpose. When the condition evaluates to false, the member loses access even though the binding still exists. IAM Conditions support time-based, attribute-based, and resource-based constraints, though this example shows only time-based expiration.
Beyond these examples
These snippets focus on specific SecurityGatewayIamMember features: non-authoritative member grants and IAM Conditions for time-based access. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as BeyondCorp security gateways and GCP projects with BeyondCorp enabled. They focus on granting individual member access rather than managing complete IAM policies.
To keep things focused, common IAM patterns are omitted, including:
- Authoritative policy management (SecurityGatewayIamPolicy)
- Role-level binding management (SecurityGatewayIamBinding)
- Multiple members or roles in a single resource
- Complex condition expressions (attribute-based, resource-based)
These omissions are intentional: the goal is to illustrate how member-level IAM grants are wired, not provide drop-in access control modules. See the SecurityGatewayIamMember resource reference for all available configuration options.
Let's manage GCP BeyondCorp Security Gateway IAM Members
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
SecurityGatewayIamPolicy is authoritative and replaces the entire IAM policy. SecurityGatewayIamBinding is authoritative for a single role, replacing all members for that role while preserving other roles. SecurityGatewayIamMember is non-authoritative, adding a single member without affecting other members or roles.SecurityGatewayIamPolicy cannot be used with SecurityGatewayIamBinding or SecurityGatewayIamMember as they will conflict. However, SecurityGatewayIamBinding and SecurityGatewayIamMember can be used together only if they don’t grant the same role.IAM Configuration
user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, allUsers, allAuthenticatedUsers, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/....[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/customRole or organizations/my-org/roles/customRole.location property must be omitted or set to global. If not specified, it will be parsed from the parent resource identifier or taken from the provider configuration.condition property with title, description, and expression fields. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") to grant access that expires at a specific time.Import & Migration
pulumi import gcp:beyondcorp/securityGatewayIamMember:SecurityGatewayIamMember editor "projects/{{project}}/locations/{{location}}/securityGateways/{{security_gateway_id}} roles/beyondcorp.securityGatewayUser user:jane@example.com".