The gcp:bigtable/instanceIamBinding:InstanceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Bigtable instances, controlling which identities can access instance-level operations. This guide focuses on two capabilities: authoritative role binding (which replaces all members for a role) and non-authoritative member addition (which preserves existing members).
IAM bindings reference existing Bigtable instances. The examples are intentionally small. Combine them with your own instance resources and project configuration.
Grant a role to multiple members
Teams managing Bigtable access often need to grant the same role to multiple users, service accounts, or groups at once.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.bigtable.InstanceIamBinding("editor", {
instance: "your-bigtable-instance",
role: "roles/bigtable.user",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.bigtable.InstanceIamBinding("editor",
instance="your-bigtable-instance",
role="roles/bigtable.user",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigtable"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := bigtable.NewInstanceIamBinding(ctx, "editor", &bigtable.InstanceIamBindingArgs{
Instance: pulumi.String("your-bigtable-instance"),
Role: pulumi.String("roles/bigtable.user"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.BigTable.InstanceIamBinding("editor", new()
{
Instance = "your-bigtable-instance",
Role = "roles/bigtable.user",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigtable.InstanceIamBinding;
import com.pulumi.gcp.bigtable.InstanceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new InstanceIamBinding("editor", InstanceIamBindingArgs.builder()
.instance("your-bigtable-instance")
.role("roles/bigtable.user")
.members("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:bigtable:InstanceIamBinding
properties:
instance: your-bigtable-instance
role: roles/bigtable.user
members:
- user:jane@example.com
InstanceIamBinding is authoritative for the specified role: it replaces all members for that role. The instance property identifies the Bigtable instance, role specifies the IAM role (like “roles/bigtable.user”), and members lists all identities that should have this role. If you later update the members list, Pulumi removes any identities not in the new list.
Add a single member to a role
When you need to grant access to one additional user without affecting other members, InstanceIamMember adds a single identity non-authoritatively.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.bigtable.InstanceIamMember("editor", {
instance: "your-bigtable-instance",
role: "roles/bigtable.user",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.bigtable.InstanceIamMember("editor",
instance="your-bigtable-instance",
role="roles/bigtable.user",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/bigtable"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := bigtable.NewInstanceIamMember(ctx, "editor", &bigtable.InstanceIamMemberArgs{
Instance: pulumi.String("your-bigtable-instance"),
Role: pulumi.String("roles/bigtable.user"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.BigTable.InstanceIamMember("editor", new()
{
Instance = "your-bigtable-instance",
Role = "roles/bigtable.user",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.bigtable.InstanceIamMember;
import com.pulumi.gcp.bigtable.InstanceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new InstanceIamMember("editor", InstanceIamMemberArgs.builder()
.instance("your-bigtable-instance")
.role("roles/bigtable.user")
.member("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:bigtable:InstanceIamMember
properties:
instance: your-bigtable-instance
role: roles/bigtable.user
member: user:jane@example.com
InstanceIamMember preserves other members already assigned to the role. The member property (singular) specifies one identity to add. This is useful when multiple teams manage access independently: one team can add their service account without knowing about or affecting other members.
Beyond these examples
These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative binding. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as Bigtable instances. They focus on configuring IAM bindings rather than provisioning the instances themselves.
To keep things focused, common IAM patterns are omitted, including:
- Project specification (project property)
- Conditional IAM bindings (condition block)
- Full policy replacement (InstanceIamPolicy)
- Custom role formatting
These omissions are intentional: the goal is to illustrate how each IAM binding approach is wired, not provide drop-in access control modules. See the Bigtable InstanceIamBinding resource reference for all available configuration options.
Let's manage GCP Bigtable Instance IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Compatibility
InstanceIamPolicy cannot be used with InstanceIamBinding or InstanceIamMember because they’ll conflict over policy control. Use InstanceIamPolicy alone, or use InstanceIamBinding/InstanceIamMember without InstanceIamPolicy.InstanceIamPolicy for complete policy control (replaces entire policy), InstanceIamBinding for managing all members of a specific role (authoritative per role), or InstanceIamMember for adding individual members without affecting others (non-authoritative).InstanceIamPolicy replaces the entire IAM policy, so you can lose instance ownership if you don’t include all necessary permissions. Always ensure ownership roles are included in your policy.Configuration & Syntax
[projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.allUsers (anyone on the internet), allAuthenticatedUsers (anyone with a Google account), user:{email} (specific Google account), serviceAccount:{email} (service account), group:{email} (Google group), or domain:{domain} (G Suite domain).Immutability & Limitations
instance, project, role, and condition properties are immutable. Changing any of these requires recreating the resource. Only members can be updated in place.