The gcp:beyondcorp/securityGatewayApplicationIamMember:SecurityGatewayApplicationIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual members for BeyondCorp Security Gateway Applications. Unlike authoritative IAM resources, this resource adds identities without removing existing access. This guide focuses on two capabilities: single-member role grants and time-based IAM Conditions.
This resource references existing Security Gateway and Application resources rather than creating them. The examples are intentionally small. Combine them with your own BeyondCorp infrastructure and identity management.
Grant access to a single user
Most access control starts by granting a specific user permission to access an application without affecting other members.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.beyondcorp.SecurityGatewayApplicationIamMember("member", {
project: example.project,
securityGatewayId: example.securityGatewayId,
applicationId: example.applicationId,
role: "roles/beyondcorp.securityGatewayUser",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.beyondcorp.SecurityGatewayApplicationIamMember("member",
project=example["project"],
security_gateway_id=example["securityGatewayId"],
application_id=example["applicationId"],
role="roles/beyondcorp.securityGatewayUser",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayApplicationIamMember(ctx, "member", &beyondcorp.SecurityGatewayApplicationIamMemberArgs{
Project: pulumi.Any(example.Project),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
ApplicationId: pulumi.Any(example.ApplicationId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Beyondcorp.SecurityGatewayApplicationIamMember("member", new()
{
Project = example.Project,
SecurityGatewayId = example.SecurityGatewayId,
ApplicationId = example.ApplicationId,
Role = "roles/beyondcorp.securityGatewayUser",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamMember;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new SecurityGatewayApplicationIamMember("member", SecurityGatewayApplicationIamMemberArgs.builder()
.project(example.project())
.securityGatewayId(example.securityGatewayId())
.applicationId(example.applicationId())
.role("roles/beyondcorp.securityGatewayUser")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:beyondcorp:SecurityGatewayApplicationIamMember
properties:
project: ${example.project}
securityGatewayId: ${example.securityGatewayId}
applicationId: ${example.applicationId}
role: roles/beyondcorp.securityGatewayUser
member: user:jane@example.com
The member property identifies who receives access, using formats like “user:jane@example.com” for Google accounts or “serviceAccount:…” for service accounts. The role property specifies what they can do; “roles/beyondcorp.securityGatewayUser” grants application access. The applicationId and securityGatewayId properties identify which application to grant access to. This resource is non-authoritative, meaning it adds this member without removing others who already have the role.
Grant time-limited access with IAM Conditions
Temporary access grants expire automatically when you attach time-based restrictions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.beyondcorp.SecurityGatewayApplicationIamMember("member", {
project: example.project,
securityGatewayId: example.securityGatewayId,
applicationId: example.applicationId,
role: "roles/beyondcorp.securityGatewayUser",
member: "user:jane@example.com",
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
member = gcp.beyondcorp.SecurityGatewayApplicationIamMember("member",
project=example["project"],
security_gateway_id=example["securityGatewayId"],
application_id=example["applicationId"],
role="roles/beyondcorp.securityGatewayUser",
member="user:jane@example.com",
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayApplicationIamMember(ctx, "member", &beyondcorp.SecurityGatewayApplicationIamMemberArgs{
Project: pulumi.Any(example.Project),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
ApplicationId: pulumi.Any(example.ApplicationId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Member: pulumi.String("user:jane@example.com"),
Condition: &beyondcorp.SecurityGatewayApplicationIamMemberConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Beyondcorp.SecurityGatewayApplicationIamMember("member", new()
{
Project = example.Project,
SecurityGatewayId = example.SecurityGatewayId,
ApplicationId = example.ApplicationId,
Role = "roles/beyondcorp.securityGatewayUser",
Member = "user:jane@example.com",
Condition = new Gcp.Beyondcorp.Inputs.SecurityGatewayApplicationIamMemberConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamMember;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamMemberArgs;
import com.pulumi.gcp.beyondcorp.inputs.SecurityGatewayApplicationIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new SecurityGatewayApplicationIamMember("member", SecurityGatewayApplicationIamMemberArgs.builder()
.project(example.project())
.securityGatewayId(example.securityGatewayId())
.applicationId(example.applicationId())
.role("roles/beyondcorp.securityGatewayUser")
.member("user:jane@example.com")
.condition(SecurityGatewayApplicationIamMemberConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
member:
type: gcp:beyondcorp:SecurityGatewayApplicationIamMember
properties:
project: ${example.project}
securityGatewayId: ${example.securityGatewayId}
applicationId: ${example.applicationId}
role: roles/beyondcorp.securityGatewayUser
member: user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition property adds restrictions to the role grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here, “request.time < timestamp(…)” expires access at midnight on 2020-01-01. The title and description properties document the condition’s purpose. IAM evaluates conditions on every request, automatically denying access once the timestamp passes.
Beyond these examples
These snippets focus on specific IAM member features: single-member grants and time-based IAM Conditions. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as BeyondCorp Security Gateway and Application resources, and a GCP project with BeyondCorp enabled. They focus on granting access rather than provisioning the underlying applications.
To keep things focused, common IAM patterns are omitted, including:
- Policy and Binding resources (authoritative alternatives)
- Multiple members or roles in one resource
- Attribute-based conditions beyond time restrictions
- Service account and group identities
These omissions are intentional: the goal is to illustrate how member grants are wired, not provide drop-in access control modules. See the SecurityGatewayApplicationIamMember resource reference for all available configuration options.
Let's manage GCP BeyondCorp Security Gateway Application IAM
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
SecurityGatewayApplicationIamPolicy is authoritative and replaces the entire IAM policy. SecurityGatewayApplicationIamBinding is authoritative for a specific role, replacing all members for that role while preserving other roles. SecurityGatewayApplicationIamMember is non-authoritative and adds a single member to a role without affecting other members.SecurityGatewayApplicationIamPolicy with SecurityGatewayApplicationIamBinding or SecurityGatewayApplicationIamMember, as they will conflict over the policy. However, you can use SecurityGatewayApplicationIamBinding and SecurityGatewayApplicationIamMember together, but only if they don’t grant privileges to the same role.Configuration & Identity Formats
The member field supports multiple formats:
- allUsers or allAuthenticatedUsers for public/authenticated access
- user:{email}, serviceAccount:{email}, group:{email} for specific identities
- domain:{domain} for G Suite domains
- projectOwner/Editor/Viewer:{projectid} for project-level roles
- Federated identities using principal:// format for workload/workforce identity pools
[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.applicationId, securityGatewayId, project, member, role, and condition) are immutable and cannot be changed after creation. You must recreate the resource to make changes.IAM Conditions
condition field with title, description, and expression properties. For example, to expire access at a specific date, use an expression like request.time < timestamp("2020-01-01T00:00:00Z").