Manage GCP Cloud Tasks Queue IAM Access

The gcp:cloudtasks/queueIamMember:QueueIamMember resource, part of the Pulumi GCP provider, manages IAM permissions for Cloud Tasks queues by adding individual members to roles without affecting other permissions. This guide focuses on three capabilities: adding single members, binding multiple members to roles, and replacing entire IAM policies.

IAM resources for Cloud Tasks queues come in three variants with different behaviors. QueueIamMember adds members incrementally, QueueIamBinding manages all members for a role, and QueueIamPolicy replaces the entire policy. QueueIamPolicy cannot be used with the other two resources, as they will conflict. The examples are intentionally small. Combine them with your own queue infrastructure and access requirements.

Grant a single member access to a queue

Most IAM configurations add individual users or service accounts to specific queues without affecting other permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.cloudtasks.QueueIamMember("member", {
    project: _default.project,
    location: _default.location,
    name: _default.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.cloudtasks.QueueIamMember("member",
    project=default["project"],
    location=default["location"],
    name=default["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudtasks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudtasks.NewQueueIamMember(ctx, "member", &cloudtasks.QueueIamMemberArgs{
			Project:  pulumi.Any(_default.Project),
			Location: pulumi.Any(_default.Location),
			Name:     pulumi.Any(_default.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.CloudTasks.QueueIamMember("member", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        Name = @default.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.cloudtasks.QueueIamMember;
import com.pulumi.gcp.cloudtasks.QueueIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new QueueIamMember("member", QueueIamMemberArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .name(default_.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:cloudtasks:QueueIamMember
    properties:
      project: ${default.project}
      location: ${default.location}
      name: ${default.name}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies who receives access using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property defines what they can do (e.g., “roles/viewer” for read-only access). This resource is non-authoritative: it adds the member without removing others who already have the same role.

Grant a role to multiple members at once

When multiple users or service accounts need the same level of access, binding them to a role together simplifies management.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.cloudtasks.QueueIamBinding("binding", {
    project: _default.project,
    location: _default.location,
    name: _default.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.cloudtasks.QueueIamBinding("binding",
    project=default["project"],
    location=default["location"],
    name=default["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudtasks"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudtasks.NewQueueIamBinding(ctx, "binding", &cloudtasks.QueueIamBindingArgs{
			Project:  pulumi.Any(_default.Project),
			Location: pulumi.Any(_default.Location),
			Name:     pulumi.Any(_default.Name),
			Role:     pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.CloudTasks.QueueIamBinding("binding", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        Name = @default.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.cloudtasks.QueueIamBinding;
import com.pulumi.gcp.cloudtasks.QueueIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new QueueIamBinding("binding", QueueIamBindingArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .name(default_.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:cloudtasks:QueueIamBinding
    properties:
      project: ${default.project}
      location: ${default.location}
      name: ${default.name}
      role: roles/viewer
      members:
        - user:jane@example.com

QueueIamBinding uses a members array instead of a single member string. This resource is authoritative for the specified role: it replaces all members for that role with the list you provide. Other roles on the queue remain unchanged. You can use QueueIamBinding alongside QueueIamMember as long as they don’t manage the same role.

Replace the entire IAM policy for a queue

Organizations with strict access control requirements sometimes define the complete IAM policy from scratch, replacing any existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.cloudtasks.QueueIamPolicy("policy", {
    project: _default.project,
    location: _default.location,
    name: _default.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.cloudtasks.QueueIamPolicy("policy",
    project=default["project"],
    location=default["location"],
    name=default["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/cloudtasks"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = cloudtasks.NewQueueIamPolicy(ctx, "policy", &cloudtasks.QueueIamPolicyArgs{
			Project:    pulumi.Any(_default.Project),
			Location:   pulumi.Any(_default.Location),
			Name:       pulumi.Any(_default.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.CloudTasks.QueueIamPolicy("policy", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        Name = @default.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.cloudtasks.QueueIamPolicy;
import com.pulumi.gcp.cloudtasks.QueueIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new QueueIamPolicy("policy", QueueIamPolicyArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .name(default_.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:cloudtasks:QueueIamPolicy
    properties:
      project: ${default.project}
      location: ${default.location}
      name: ${default.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

QueueIamPolicy takes a policyData property generated by the getIAMPolicy data source. This resource is fully authoritative: it replaces the entire IAM policy for the queue. Any permissions not included in the policy are removed. Use this approach only when you need complete control over all queue access, and never combine it with QueueIamBinding or QueueIamMember.

Beyond these examples

These snippets focus on specific IAM management features: incremental member grants, role-based binding, and full policy replacement. They’re intentionally minimal rather than complete access control solutions.

The examples reference pre-existing infrastructure such as Cloud Tasks queues and a GCP project with appropriate permissions. They focus on configuring IAM permissions rather than provisioning the queues themselves.

To keep things focused, common IAM patterns are omitted, including:

  • Conditional IAM bindings (condition property)
  • Custom role definitions
  • Cross-project or cross-organization access
  • Service account creation and management

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Cloud Tasks QueueIamMember resource reference for all available configuration options.

Let's manage GCP Cloud Tasks Queue IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between QueueIamPolicy, QueueIamBinding, and QueueIamMember?
QueueIamPolicy is authoritative and replaces the entire IAM policy. QueueIamBinding is authoritative for a specific role, granting it to multiple members while preserving other roles. QueueIamMember is non-authoritative, adding a single member to a role while preserving other members.
Can I use QueueIamPolicy with QueueIamBinding or QueueIamMember?
No, QueueIamPolicy cannot be used with QueueIamBinding or QueueIamMember because they will conflict over the policy configuration.
Can I use QueueIamBinding and QueueIamMember together?
Yes, but only if they don’t grant privileges to the same role. If they target the same role, they will conflict.
Which IAM resource should I use to add a single user to a queue?
Use QueueIamMember to add a single member without affecting other members or roles.
Member Identity Formats
What member identity formats are supported?
Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....
How do I grant access to all authenticated users?
Set member to allAuthenticatedUsers to grant access to anyone authenticated with a Google account or service account.
How do I use federated identities with workload identity pools?
Use the format principal://iam.googleapis.com/locations/global/workforcePools/{pool}/subject/{subject} for federated identities in workload or workforce identity pools.
Custom Roles & Configuration
What format do custom roles require?
Custom roles must use the full format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.
Are the name, role, and member properties immutable?
Yes, name, role, member, location, and project are all immutable and cannot be changed after creation.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides