The gcp:beyondcorp/securityGatewayApplicationIamBinding:SecurityGatewayApplicationIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for BeyondCorp Security Gateway Applications. This guide focuses on three capabilities: binding roles to multiple members, adding individual members incrementally, and applying time-based access conditions.
IAM bindings reference existing Security Gateway Applications and require the BeyondCorp API enabled in your project. The examples are intentionally small. Combine them with your own Security Gateway infrastructure and identity management.
Grant a role to multiple members at once
Teams managing BeyondCorp access often grant the same role to multiple users or service accounts simultaneously.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.beyondcorp.SecurityGatewayApplicationIamBinding("binding", {
project: example.project,
securityGatewayId: example.securityGatewayId,
applicationId: example.applicationId,
role: "roles/beyondcorp.securityGatewayUser",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.beyondcorp.SecurityGatewayApplicationIamBinding("binding",
project=example["project"],
security_gateway_id=example["securityGatewayId"],
application_id=example["applicationId"],
role="roles/beyondcorp.securityGatewayUser",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayApplicationIamBinding(ctx, "binding", &beyondcorp.SecurityGatewayApplicationIamBindingArgs{
Project: pulumi.Any(example.Project),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
ApplicationId: pulumi.Any(example.ApplicationId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Beyondcorp.SecurityGatewayApplicationIamBinding("binding", new()
{
Project = example.Project,
SecurityGatewayId = example.SecurityGatewayId,
ApplicationId = example.ApplicationId,
Role = "roles/beyondcorp.securityGatewayUser",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamBinding;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new SecurityGatewayApplicationIamBinding("binding", SecurityGatewayApplicationIamBindingArgs.builder()
.project(example.project())
.securityGatewayId(example.securityGatewayId())
.applicationId(example.applicationId())
.role("roles/beyondcorp.securityGatewayUser")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:beyondcorp:SecurityGatewayApplicationIamBinding
properties:
project: ${example.project}
securityGatewayId: ${example.securityGatewayId}
applicationId: ${example.applicationId}
role: roles/beyondcorp.securityGatewayUser
members:
- user:jane@example.com
The SecurityGatewayApplicationIamBinding resource is authoritative for the specified role: it replaces all members for that role on the target application. The members array accepts various identity formats including users, service accounts, groups, and domains. The applicationId and securityGatewayId properties identify which Security Gateway Application receives the binding.
Add a single member to a role incrementally
When onboarding individual users, you can add them one at a time without affecting existing role members.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.beyondcorp.SecurityGatewayApplicationIamMember("member", {
project: example.project,
securityGatewayId: example.securityGatewayId,
applicationId: example.applicationId,
role: "roles/beyondcorp.securityGatewayUser",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.beyondcorp.SecurityGatewayApplicationIamMember("member",
project=example["project"],
security_gateway_id=example["securityGatewayId"],
application_id=example["applicationId"],
role="roles/beyondcorp.securityGatewayUser",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayApplicationIamMember(ctx, "member", &beyondcorp.SecurityGatewayApplicationIamMemberArgs{
Project: pulumi.Any(example.Project),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
ApplicationId: pulumi.Any(example.ApplicationId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Beyondcorp.SecurityGatewayApplicationIamMember("member", new()
{
Project = example.Project,
SecurityGatewayId = example.SecurityGatewayId,
ApplicationId = example.ApplicationId,
Role = "roles/beyondcorp.securityGatewayUser",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamMember;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new SecurityGatewayApplicationIamMember("member", SecurityGatewayApplicationIamMemberArgs.builder()
.project(example.project())
.securityGatewayId(example.securityGatewayId())
.applicationId(example.applicationId())
.role("roles/beyondcorp.securityGatewayUser")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:beyondcorp:SecurityGatewayApplicationIamMember
properties:
project: ${example.project}
securityGatewayId: ${example.securityGatewayId}
applicationId: ${example.applicationId}
role: roles/beyondcorp.securityGatewayUser
member: user:jane@example.com
The SecurityGatewayApplicationIamMember resource adds a single member to a role non-authoritatively, preserving other members who already have that role. This approach works well for incremental access grants where you don’t want to manage the complete member list. Use member (singular) instead of members (plural) to specify the identity.
Apply time-based access with IAM Conditions
Temporary access scenarios require permissions that expire automatically without manual revocation.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.beyondcorp.SecurityGatewayApplicationIamBinding("binding", {
project: example.project,
securityGatewayId: example.securityGatewayId,
applicationId: example.applicationId,
role: "roles/beyondcorp.securityGatewayUser",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.beyondcorp.SecurityGatewayApplicationIamBinding("binding",
project=example["project"],
security_gateway_id=example["securityGatewayId"],
application_id=example["applicationId"],
role="roles/beyondcorp.securityGatewayUser",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/beyondcorp"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := beyondcorp.NewSecurityGatewayApplicationIamBinding(ctx, "binding", &beyondcorp.SecurityGatewayApplicationIamBindingArgs{
Project: pulumi.Any(example.Project),
SecurityGatewayId: pulumi.Any(example.SecurityGatewayId),
ApplicationId: pulumi.Any(example.ApplicationId),
Role: pulumi.String("roles/beyondcorp.securityGatewayUser"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &beyondcorp.SecurityGatewayApplicationIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Beyondcorp.SecurityGatewayApplicationIamBinding("binding", new()
{
Project = example.Project,
SecurityGatewayId = example.SecurityGatewayId,
ApplicationId = example.ApplicationId,
Role = "roles/beyondcorp.securityGatewayUser",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Beyondcorp.Inputs.SecurityGatewayApplicationIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamBinding;
import com.pulumi.gcp.beyondcorp.SecurityGatewayApplicationIamBindingArgs;
import com.pulumi.gcp.beyondcorp.inputs.SecurityGatewayApplicationIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new SecurityGatewayApplicationIamBinding("binding", SecurityGatewayApplicationIamBindingArgs.builder()
.project(example.project())
.securityGatewayId(example.securityGatewayId())
.applicationId(example.applicationId())
.role("roles/beyondcorp.securityGatewayUser")
.members("user:jane@example.com")
.condition(SecurityGatewayApplicationIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:beyondcorp:SecurityGatewayApplicationIamBinding
properties:
project: ${example.project}
securityGatewayId: ${example.securityGatewayId}
applicationId: ${example.applicationId}
role: roles/beyondcorp.securityGatewayUser
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
IAM Conditions add temporal or contextual constraints to role bindings. The condition block requires a title, optional description, and an expression in Common Expression Language (CEL). Here, the expression compares request.time against a timestamp, automatically revoking access after 2019-12-31. Conditions work with both Binding and Member resources.
Beyond these examples
These snippets focus on specific IAM binding features: role binding for multiple members, incremental member addition, and time-based conditional access. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as BeyondCorp Security Gateway and Application resources, and a Google Cloud project with the BeyondCorp API enabled. They focus on configuring IAM bindings rather than provisioning the underlying Security Gateway infrastructure.
To keep things focused, common IAM patterns are omitted, including:
- Full policy replacement (IamPolicy resource)
- Complex IAM Condition expressions (resource-based, attribute-based)
- Service account and group management
- Custom role definitions
These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the SecurityGatewayApplicationIamBinding resource reference for all available configuration options.
Let's manage GCP BeyondCorp Security Gateway Application IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Conflicts & Compatibility
Can I use IamPolicy together with IamBinding or IamMember?
No,
SecurityGatewayApplicationIamPolicy cannot be used with SecurityGatewayApplicationIamBinding or SecurityGatewayApplicationIamMember as they will conflict over policy management. Choose one approach: use IamPolicy for full policy control, or use IamBinding/IamMember for granular role management.Can I use multiple IamBinding or IamMember resources for the same role?
No, only one
SecurityGatewayApplicationIamBinding per role is allowed. You can use IamBinding with IamMember only if they manage different roles.IAM Configuration & Roles
How do I specify custom roles?
Custom roles must use the format
[projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/customRole or organizations/my-org/roles/customRole.What properties can't be changed after creation?
The following properties are immutable:
applicationId, securityGatewayId, project, role, and condition. Changes to these require recreating the resource.Member Identities & Permissions
What member identity formats are supported?
You can use:
- Public access:
allUsers,allAuthenticatedUsers - Specific accounts:
user:{email},serviceAccount:{email},group:{email},domain:{domain} - Project roles:
projectOwner:{projectid},projectEditor:{projectid},projectViewer:{projectid} - Federated identities:
principal://iam.googleapis.com/...(see Principal identifiers documentation)
Conditions & Advanced Features
How do I add time-based access restrictions?
Use the
condition property with title, description, and expression fields. For example, to expire access at a specific time: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".What limitations exist for IAM Conditions?
IAM Conditions are supported but have known limitations. If you experience issues with conditions, review the IAM Conditions limitations documentation.