Manage GCP Cloud Run IAM Permissions

The gcp:cloudrun/iamBinding:IamBinding resource, part of the Pulumi GCP provider, grants an IAM role to a list of members on a Cloud Run service. It replaces any existing members for that specific role while preserving other roles on the service. This guide focuses on two capabilities: authoritative role binding for multiple members and non-authoritative member addition.

IamBinding references existing Cloud Run services and requires project and location configuration. The examples are intentionally small. Combine them with your own service references and identity management.

Grant a role to multiple members

Teams managing Cloud Run services need to grant IAM roles to groups of users or service accounts.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.cloudrun.IamBinding("binding", {
    location: _default.location,
    project: _default.project,
    service: _default.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.cloudrun.IamBinding("binding",
    location=default["location"],
    project=default["project"],
    service=default["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudrun"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudrun.NewIamBinding(ctx, "binding", &cloudrun.IamBindingArgs{
			Location: pulumi.Any(_default.Location),
			Project:  pulumi.Any(_default.Project),
			Service:  pulumi.Any(_default.Name),
			Role:     pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.CloudRun.IamBinding("binding", new()
    {
        Location = @default.Location,
        Project = @default.Project,
        Service = @default.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.cloudrun.IamBinding;
import com.pulumi.gcp.cloudrun.IamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new IamBinding("binding", IamBindingArgs.builder()
            .location(default_.location())
            .project(default_.project())
            .service(default_.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:cloudrun:IamBinding
    properties:
      location: ${default.location}
      project: ${default.project}
      service: ${default.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The role property specifies which IAM role to grant (e.g., “roles/viewer”). The members array lists all identities that should have this role; IamBinding replaces any existing members for this role. The service, location, and project properties identify which Cloud Run service to configure. This is authoritative for the specified role: any members not in the list will lose access.

Add a single member to a role

When you need to grant access to one additional user without affecting existing members, use IamMember instead.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.cloudrun.IamMember("member", {
    location: _default.location,
    project: _default.project,
    service: _default.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.cloudrun.IamMember("member",
    location=default["location"],
    project=default["project"],
    service=default["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudrun"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudrun.NewIamMember(ctx, "member", &cloudrun.IamMemberArgs{
			Location: pulumi.Any(_default.Location),
			Project:  pulumi.Any(_default.Project),
			Service:  pulumi.Any(_default.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.CloudRun.IamMember("member", new()
    {
        Location = @default.Location,
        Project = @default.Project,
        Service = @default.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.cloudrun.IamMember;
import com.pulumi.gcp.cloudrun.IamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new IamMember("member", IamMemberArgs.builder()
            .location(default_.location())
            .project(default_.project())
            .service(default_.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:cloudrun:IamMember
    properties:
      location: ${default.location}
      project: ${default.project}
      service: ${default.name}
      role: roles/viewer
      member: user:jane@example.com

The member property (singular) specifies one identity to add. Unlike IamBinding, IamMember is non-authoritative: it adds this member to the role without removing existing members. Use IamMember when you want incremental changes; use IamBinding when you want to define the complete member list for a role.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative binding. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Cloud Run services and GCP project and location configuration. They focus on configuring IAM bindings rather than provisioning the services themselves.

To keep things focused, common IAM patterns are omitted, including:

  • Conditional IAM bindings (condition property)
  • Custom role definitions
  • Policy-level management (IamPolicy resource)
  • Federated identity configuration

These omissions are intentional: the goal is to illustrate how IAM binding is wired, not provide drop-in access control modules. See the Cloud Run IamBinding resource reference for all available configuration options.

Let's manage GCP Cloud Run IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility
Can I mix different IAM resource types for the same Cloud Run service?
You cannot use gcp.cloudrun.IamPolicy with gcp.cloudrun.IamBinding or gcp.cloudrun.IamMember, as they will conflict. However, you can use gcp.cloudrun.IamBinding and gcp.cloudrun.IamMember together only if they grant different roles.
Why am I getting conflicts when using multiple IamBinding resources?
Only one gcp.cloudrun.IamBinding can be used per role. If you need to grant the same role to multiple members, include all members in a single gcp.cloudrun.IamBinding, or use gcp.cloudrun.IamMember for individual grants.
IAM Member Configuration
What member identity formats are supported?

The members property supports:

  • allUsers (anyone on the internet)
  • allAuthenticatedUsers (anyone with a Google account)
  • user:{emailid} (specific Google account)
  • serviceAccount:{emailid} (service account)
  • group:{emailid} (Google group)
  • domain:{domain} (G Suite domain)
  • projectOwner:projectid, projectEditor:projectid, projectViewer:projectid (project roles)
  • Federated identities (workload/workforce identity pools)
How do I grant public access to my Cloud Run service?
Add allUsers to the members list to allow anyone on the internet to access your service.
How do I grant access to all authenticated users?
Add allAuthenticatedUsers to the members list to allow anyone with a Google account or service account.
Role Configuration
What's the correct format for custom IAM roles?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.
Resource Properties & Immutability
Which properties can't be changed after creation?
The role, location, project, service, and condition properties are immutable. Changing any of these will force resource replacement.
What's the difference between IamPolicy, IamBinding, and IamMember?
gcp.cloudrun.IamPolicy is fully authoritative and replaces the entire policy. gcp.cloudrun.IamBinding is authoritative for a specific role and preserves other roles. gcp.cloudrun.IamMember is non-authoritative and adds individual members without affecting others.
How do I import an existing IAM binding?
Use the format pulumi import gcp:cloudrun/iamBinding:IamBinding editor "projects/{{project}}/locations/{{location}}/services/{{service}} roles/viewer" with space-delimited identifiers for the resource and role.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides