The gcp:cloudbuildv2/connectionIAMMember:ConnectionIAMMember resource, part of the Pulumi GCP provider, manages IAM access grants for Cloud Build v2 connections. This guide focuses on three approaches: adding individual members to roles (non-authoritative), managing all members for a role (authoritative per role), and replacing entire IAM policies (fully authoritative).
These resources reference existing Cloud Build v2 connections. ConnectionIAMPolicy cannot be used with ConnectionIAMBinding or ConnectionIAMMember, as they conflict over policy ownership. ConnectionIAMBinding and ConnectionIAMMember can coexist if they manage different roles. The examples are intentionally small. Combine them with your own connection resources and organizational IAM strategy.
Grant a single user access to a connection
Most access grants start by adding individual users or service accounts to specific roles without disrupting existing permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.cloudbuildv2.ConnectionIAMMember("member", {
project: my_connection.project,
location: my_connection.location,
name: my_connection.name,
role: "roles/cloudbuild.connectionViewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.cloudbuildv2.ConnectionIAMMember("member",
project=my_connection["project"],
location=my_connection["location"],
name=my_connection["name"],
role="roles/cloudbuild.connectionViewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudbuildv2"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := cloudbuildv2.NewConnectionIAMMember(ctx, "member", &cloudbuildv2.ConnectionIAMMemberArgs{
Project: pulumi.Any(my_connection.Project),
Location: pulumi.Any(my_connection.Location),
Name: pulumi.Any(my_connection.Name),
Role: pulumi.String("roles/cloudbuild.connectionViewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.CloudBuildV2.ConnectionIAMMember("member", new()
{
Project = my_connection.Project,
Location = my_connection.Location,
Name = my_connection.Name,
Role = "roles/cloudbuild.connectionViewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.cloudbuildv2.ConnectionIAMMember;
import com.pulumi.gcp.cloudbuildv2.ConnectionIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new ConnectionIAMMember("member", ConnectionIAMMemberArgs.builder()
.project(my_connection.project())
.location(my_connection.location())
.name(my_connection.name())
.role("roles/cloudbuild.connectionViewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:cloudbuildv2:ConnectionIAMMember
properties:
project: ${["my-connection"].project}
location: ${["my-connection"].location}
name: ${["my-connection"].name}
role: roles/cloudbuild.connectionViewer
member: user:jane@example.com
The member property specifies one identity in the format user:email, serviceAccount:email, group:email, or other supported formats. The role property sets the permission level (e.g., roles/cloudbuild.connectionViewer). This resource is non-authoritative: it adds one member to one role while preserving other members and roles on the connection.
Grant multiple users the same role
When several users need identical permissions, you can manage all members for a role together.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.cloudbuildv2.ConnectionIAMBinding("binding", {
project: my_connection.project,
location: my_connection.location,
name: my_connection.name,
role: "roles/cloudbuild.connectionViewer",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.cloudbuildv2.ConnectionIAMBinding("binding",
project=my_connection["project"],
location=my_connection["location"],
name=my_connection["name"],
role="roles/cloudbuild.connectionViewer",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudbuildv2"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := cloudbuildv2.NewConnectionIAMBinding(ctx, "binding", &cloudbuildv2.ConnectionIAMBindingArgs{
Project: pulumi.Any(my_connection.Project),
Location: pulumi.Any(my_connection.Location),
Name: pulumi.Any(my_connection.Name),
Role: pulumi.String("roles/cloudbuild.connectionViewer"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.CloudBuildV2.ConnectionIAMBinding("binding", new()
{
Project = my_connection.Project,
Location = my_connection.Location,
Name = my_connection.Name,
Role = "roles/cloudbuild.connectionViewer",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.cloudbuildv2.ConnectionIAMBinding;
import com.pulumi.gcp.cloudbuildv2.ConnectionIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new ConnectionIAMBinding("binding", ConnectionIAMBindingArgs.builder()
.project(my_connection.project())
.location(my_connection.location())
.name(my_connection.name())
.role("roles/cloudbuild.connectionViewer")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:cloudbuildv2:ConnectionIAMBinding
properties:
project: ${["my-connection"].project}
location: ${["my-connection"].location}
name: ${["my-connection"].name}
role: roles/cloudbuild.connectionViewer
members:
- user:jane@example.com
The members property takes a list of identities that all receive the same role. ConnectionIAMBinding is authoritative for the specified role: it replaces all members for that role but leaves other roles unchanged. This differs from ConnectionIAMMember, which adds one member without affecting others in the same role.
Replace the entire IAM policy for a connection
Organizations managing IAM centrally often need to set the complete policy in one operation.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const admin = gcp.organizations.getIAMPolicy({
bindings: [{
role: "roles/cloudbuild.connectionViewer",
members: ["user:jane@example.com"],
}],
});
const policy = new gcp.cloudbuildv2.ConnectionIAMPolicy("policy", {
project: my_connection.project,
location: my_connection.location,
name: my_connection.name,
policyData: admin.then(admin => admin.policyData),
});
import pulumi
import pulumi_gcp as gcp
admin = gcp.organizations.get_iam_policy(bindings=[{
"role": "roles/cloudbuild.connectionViewer",
"members": ["user:jane@example.com"],
}])
policy = gcp.cloudbuildv2.ConnectionIAMPolicy("policy",
project=my_connection["project"],
location=my_connection["location"],
name=my_connection["name"],
policy_data=admin.policy_data)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudbuildv2"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
Bindings: []organizations.GetIAMPolicyBinding{
{
Role: "roles/cloudbuild.connectionViewer",
Members: []string{
"user:jane@example.com",
},
},
},
}, nil)
if err != nil {
return err
}
_, err = cloudbuildv2.NewConnectionIAMPolicy(ctx, "policy", &cloudbuildv2.ConnectionIAMPolicyArgs{
Project: pulumi.Any(my_connection.Project),
Location: pulumi.Any(my_connection.Location),
Name: pulumi.Any(my_connection.Name),
PolicyData: pulumi.String(admin.PolicyData),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
{
Bindings = new[]
{
new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
{
Role = "roles/cloudbuild.connectionViewer",
Members = new[]
{
"user:jane@example.com",
},
},
},
});
var policy = new Gcp.CloudBuildV2.ConnectionIAMPolicy("policy", new()
{
Project = my_connection.Project,
Location = my_connection.Location,
Name = my_connection.Name,
PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.cloudbuildv2.ConnectionIAMPolicy;
import com.pulumi.gcp.cloudbuildv2.ConnectionIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
.bindings(GetIAMPolicyBindingArgs.builder()
.role("roles/cloudbuild.connectionViewer")
.members("user:jane@example.com")
.build())
.build());
var policy = new ConnectionIAMPolicy("policy", ConnectionIAMPolicyArgs.builder()
.project(my_connection.project())
.location(my_connection.location())
.name(my_connection.name())
.policyData(admin.policyData())
.build());
}
}
resources:
policy:
type: gcp:cloudbuildv2:ConnectionIAMPolicy
properties:
project: ${["my-connection"].project}
location: ${["my-connection"].location}
name: ${["my-connection"].name}
policyData: ${admin.policyData}
variables:
admin:
fn::invoke:
function: gcp:organizations:getIAMPolicy
arguments:
bindings:
- role: roles/cloudbuild.connectionViewer
members:
- user:jane@example.com
The policyData property accepts a complete IAM policy document, typically retrieved from gcp.organizations.getIAMPolicy. ConnectionIAMPolicy is fully authoritative: it replaces the entire IAM policy for the connection. This resource cannot coexist with ConnectionIAMBinding or ConnectionIAMMember, as they would conflict over policy ownership.
Beyond these examples
These snippets focus on specific IAM management approaches: incremental member grants, role-level binding management, and full policy replacement. They’re intentionally minimal rather than complete access control configurations.
The examples reference pre-existing infrastructure such as Cloud Build v2 connections (by name, location, and project). They focus on IAM grant configuration rather than provisioning the underlying connections.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Custom role definitions
- Federated identity configuration
- Policy conflict resolution between resource types
These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the ConnectionIAMMember resource reference for all available configuration options.
Let's manage GCP Cloud Build Connection IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
ConnectionIAMPolicy is authoritative and replaces the entire IAM policy. ConnectionIAMBinding is authoritative for a specific role, preserving other roles in the policy. ConnectionIAMMember is non-authoritative, adding a single member to a role while preserving other members for that role.ConnectionIAMPolicy cannot be used with ConnectionIAMBinding or ConnectionIAMMember, as they will conflict over policy management. However, ConnectionIAMBinding and ConnectionIAMMember can be used together only if they don’t grant privileges to the same role.Configuration & Identity Formats
member property supports multiple formats: allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, and federated identities (e.g., principal://iam.googleapis.com/...).[projects|organizations]/{parent-name}/roles/{role-name} (e.g., projects/my-project/roles/my-custom-role).member, role, location, name, and project properties are all immutable and cannot be changed after resource creation.