Manage GCP Colab Runtime Template IAM Members

The gcp:colab/runtimeTemplateIamMember:RuntimeTemplateIamMember resource, part of the Pulumi GCP provider, manages IAM permissions for Colab Enterprise runtime templates by adding individual members to roles. This guide focuses on three approaches to IAM management and the difference between authoritative and non-authoritative permission grants.

All three IAM resources (RuntimeTemplateIamPolicy, RuntimeTemplateIamBinding, RuntimeTemplateIamMember) reference existing runtime templates by project, location, and name. The examples are intentionally small. Combine them with your own runtime template infrastructure and identity management.

Replace the entire IAM policy for a runtime template

When you need complete control over who can access a runtime template, you can set the entire IAM policy at once.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.colab.RuntimeTemplateIamPolicy("policy", {
    project: runtime_template.project,
    location: runtime_template.location,
    runtimeTemplate: runtime_template.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.colab.RuntimeTemplateIamPolicy("policy",
    project=runtime_template["project"],
    location=runtime_template["location"],
    runtime_template=runtime_template["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/colab"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = colab.NewRuntimeTemplateIamPolicy(ctx, "policy", &colab.RuntimeTemplateIamPolicyArgs{
			Project:         pulumi.Any(runtime_template.Project),
			Location:        pulumi.Any(runtime_template.Location),
			RuntimeTemplate: pulumi.Any(runtime_template.Name),
			PolicyData:      pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Colab.RuntimeTemplateIamPolicy("policy", new()
    {
        Project = runtime_template.Project,
        Location = runtime_template.Location,
        RuntimeTemplate = runtime_template.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.colab.RuntimeTemplateIamPolicy;
import com.pulumi.gcp.colab.RuntimeTemplateIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new RuntimeTemplateIamPolicy("policy", RuntimeTemplateIamPolicyArgs.builder()
            .project(runtime_template.project())
            .location(runtime_template.location())
            .runtimeTemplate(runtime_template.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:colab:RuntimeTemplateIamPolicy
    properties:
      project: ${["runtime-template"].project}
      location: ${["runtime-template"].location}
      runtimeTemplate: ${["runtime-template"].name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

RuntimeTemplateIamPolicy is authoritative: it replaces the entire IAM policy with the bindings you specify. The getIAMPolicy data source constructs the policy document, and policyData contains the serialized policy. Any permissions not included in policyData are removed when this resource applies.

Grant a role to multiple members at once

When multiple users or service accounts need the same level of access, you can bind them all to a single role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.colab.RuntimeTemplateIamBinding("binding", {
    project: runtime_template.project,
    location: runtime_template.location,
    runtimeTemplate: runtime_template.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.colab.RuntimeTemplateIamBinding("binding",
    project=runtime_template["project"],
    location=runtime_template["location"],
    runtime_template=runtime_template["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/colab"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := colab.NewRuntimeTemplateIamBinding(ctx, "binding", &colab.RuntimeTemplateIamBindingArgs{
			Project:         pulumi.Any(runtime_template.Project),
			Location:        pulumi.Any(runtime_template.Location),
			RuntimeTemplate: pulumi.Any(runtime_template.Name),
			Role:            pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Colab.RuntimeTemplateIamBinding("binding", new()
    {
        Project = runtime_template.Project,
        Location = runtime_template.Location,
        RuntimeTemplate = runtime_template.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.colab.RuntimeTemplateIamBinding;
import com.pulumi.gcp.colab.RuntimeTemplateIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new RuntimeTemplateIamBinding("binding", RuntimeTemplateIamBindingArgs.builder()
            .project(runtime_template.project())
            .location(runtime_template.location())
            .runtimeTemplate(runtime_template.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:colab:RuntimeTemplateIamBinding
    properties:
      project: ${["runtime-template"].project}
      location: ${["runtime-template"].location}
      runtimeTemplate: ${["runtime-template"].name}
      role: roles/viewer
      members:
        - user:jane@example.com

RuntimeTemplateIamBinding is authoritative for a specific role: it replaces all members for that role while preserving other roles. The members array lists all identities that should have this role. If you later remove a member from the array, they lose access.

Add a single member to a role

When you need to grant access to one additional user without affecting existing permissions, you can add a single member.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.colab.RuntimeTemplateIamMember("member", {
    project: runtime_template.project,
    location: runtime_template.location,
    runtimeTemplate: runtime_template.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.colab.RuntimeTemplateIamMember("member",
    project=runtime_template["project"],
    location=runtime_template["location"],
    runtime_template=runtime_template["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/colab"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := colab.NewRuntimeTemplateIamMember(ctx, "member", &colab.RuntimeTemplateIamMemberArgs{
			Project:         pulumi.Any(runtime_template.Project),
			Location:        pulumi.Any(runtime_template.Location),
			RuntimeTemplate: pulumi.Any(runtime_template.Name),
			Role:            pulumi.String("roles/viewer"),
			Member:          pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Colab.RuntimeTemplateIamMember("member", new()
    {
        Project = runtime_template.Project,
        Location = runtime_template.Location,
        RuntimeTemplate = runtime_template.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.colab.RuntimeTemplateIamMember;
import com.pulumi.gcp.colab.RuntimeTemplateIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RuntimeTemplateIamMember("member", RuntimeTemplateIamMemberArgs.builder()
            .project(runtime_template.project())
            .location(runtime_template.location())
            .runtimeTemplate(runtime_template.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:colab:RuntimeTemplateIamMember
    properties:
      project: ${["runtime-template"].project}
      location: ${["runtime-template"].location}
      runtimeTemplate: ${["runtime-template"].name}
      role: roles/viewer
      member: user:jane@example.com

RuntimeTemplateIamMember is non-authoritative: it adds one member to a role without modifying other members. This is the safest option when multiple teams manage access independently. The member property accepts user accounts, service accounts, groups, domains, or federated identities.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management and role-based access control. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Colab Enterprise runtime templates (referenced by project, location, and name). They focus on configuring IAM permissions rather than provisioning the runtime templates themselves.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Federated identity configuration
IAM policy retrieval (data source)

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the RuntimeTemplateIamMember resource reference for all available configuration options.

Let's manage GCP Colab Runtime Template IAM Members

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

Why am I getting IAM policy conflicts between my resources?

RuntimeTemplateIamPolicy cannot be used with RuntimeTemplateIamBinding or RuntimeTemplateIamMember because they’ll conflict over policy control. Choose one approach: use IamPolicy alone for full control, or use IamBinding/IamMember together.

Can I use RuntimeTemplateIamBinding and RuntimeTemplateIamMember together?

Yes, but only if they don’t grant privileges to the same role. If both resources target the same role, they’ll conflict.

Resource Selection

Which IAM resource should I use for managing permissions?

Choose based on your needs:

RuntimeTemplateIamPolicy - Authoritative control of entire policy (replaces existing)
RuntimeTemplateIamBinding - Authoritative control of all members for a specific role
RuntimeTemplateIamMember - Non-authoritative, adds individual members without affecting others

Configuration & Identity Formats

What member identity formats are supported?

The member property supports multiple formats:

allUsers - Anyone on the internet
allAuthenticatedUsers - Anyone with a Google account
user:{email} - Specific Google account (e.g., user:alice@gmail.com)
serviceAccount:{email} - Service account (e.g., serviceAccount:my-app@appspot.gserviceaccount.com)
group:{email} - Google group (e.g., group:admins@example.com)
domain:{domain} - G Suite domain (e.g., domain:example.com)
projectOwner:projectid, projectEditor:projectid, projectViewer:projectid - Project-level roles
Federated identities (see Principal identifiers documentation)

How do I specify custom IAM roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

Resource Properties

What properties can't be changed after creation?

All input properties are immutable: location, member, project, role, runtimeTemplate, and condition. You must recreate the resource to change any of these.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides