Configure GCP Compute Image IAM Bindings

The gcp:compute/imageIamBinding:ImageIamBinding resource, part of the Pulumi GCP provider, grants a specific IAM role to a list of members for a Compute Engine image. This resource is authoritative for the specified role, replacing any previous members while preserving other roles on the image. This guide focuses on three capabilities: authoritative role binding for multiple members, non-authoritative single-member grants, and time-based access with IAM Conditions.

IAM bindings reference existing Compute Engine images and operate within a GCP project. The examples are intentionally small. Combine them with your own image resources and identity management.

Grant a role to multiple members at once

When managing shared compute images, teams often need to grant the same role to multiple users or service accounts simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.ImageIamBinding("binding", {
    project: example.project,
    image: example.name,
    role: "roles/compute.imageUser",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.ImageIamBinding("binding",
    project=example["project"],
    image=example["name"],
    role="roles/compute.imageUser",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewImageIamBinding(ctx, "binding", &compute.ImageIamBindingArgs{
			Project: pulumi.Any(example.Project),
			Image:   pulumi.Any(example.Name),
			Role:    pulumi.String("roles/compute.imageUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.ImageIamBinding("binding", new()
    {
        Project = example.Project,
        Image = example.Name,
        Role = "roles/compute.imageUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ImageIamBinding;
import com.pulumi.gcp.compute.ImageIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new ImageIamBinding("binding", ImageIamBindingArgs.builder()
            .project(example.project())
            .image(example.name())
            .role("roles/compute.imageUser")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:ImageIamBinding
    properties:
      project: ${example.project}
      image: ${example.name}
      role: roles/compute.imageUser
      members:
        - user:jane@example.com

The binding resource is authoritative for the specified role. When you set members to a list of identities, any previous members for that role are replaced. The role property specifies which permission set to grant, and members lists all identities that should receive it. Other roles on the image remain unchanged.

Add a single member to an existing role

When onboarding new team members or service accounts, you need to grant access without affecting existing members.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.ImageIamMember("member", {
    project: example.project,
    image: example.name,
    role: "roles/compute.imageUser",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.ImageIamMember("member",
    project=example["project"],
    image=example["name"],
    role="roles/compute.imageUser",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewImageIamMember(ctx, "member", &compute.ImageIamMemberArgs{
			Project: pulumi.Any(example.Project),
			Image:   pulumi.Any(example.Name),
			Role:    pulumi.String("roles/compute.imageUser"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.ImageIamMember("member", new()
    {
        Project = example.Project,
        Image = example.Name,
        Role = "roles/compute.imageUser",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ImageIamMember;
import com.pulumi.gcp.compute.ImageIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new ImageIamMember("member", ImageIamMemberArgs.builder()
            .project(example.project())
            .image(example.name())
            .role("roles/compute.imageUser")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:ImageIamMember
    properties:
      project: ${example.project}
      image: ${example.name}
      role: roles/compute.imageUser
      member: user:jane@example.com

The ImageIamMember resource is non-authoritative. It adds a single member to a role without replacing others who already have it. Use this when you want to incrementally grant access. The member property takes a single identity string, while ImageIamBinding takes an array.

Apply time-based access with IAM Conditions

Temporary access scenarios, such as contractor engagements or time-limited projects, require permissions that automatically expire.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.ImageIamBinding("binding", {
    project: example.project,
    image: example.name,
    role: "roles/compute.imageUser",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.ImageIamBinding("binding",
    project=example["project"],
    image=example["name"],
    role="roles/compute.imageUser",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewImageIamBinding(ctx, "binding", &compute.ImageIamBindingArgs{
			Project: pulumi.Any(example.Project),
			Image:   pulumi.Any(example.Name),
			Role:    pulumi.String("roles/compute.imageUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &compute.ImageIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.ImageIamBinding("binding", new()
    {
        Project = example.Project,
        Image = example.Name,
        Role = "roles/compute.imageUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Compute.Inputs.ImageIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ImageIamBinding;
import com.pulumi.gcp.compute.ImageIamBindingArgs;
import com.pulumi.gcp.compute.inputs.ImageIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new ImageIamBinding("binding", ImageIamBindingArgs.builder()
            .project(example.project())
            .image(example.name())
            .role("roles/compute.imageUser")
            .members("user:jane@example.com")
            .condition(ImageIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:ImageIamBinding
    properties:
      project: ${example.project}
      image: ${example.name}
      role: roles/compute.imageUser
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions add temporal or attribute-based constraints to role bindings. The condition block requires a title, optional description, and an expression in Common Expression Language (CEL). Here, the expression compares request.time against a timestamp, automatically revoking access after 2019-12-31. Conditions work with both ImageIamBinding and ImageIamMember resources.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control, authoritative vs non-authoritative member management, and time-based IAM Conditions. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as Compute Engine images and GCP projects. They focus on configuring IAM bindings rather than provisioning the underlying resources.

To keep things focused, common IAM patterns are omitted, including:

Full IAM policy replacement (ImageIamPolicy)
Complex condition expressions (attribute-based, resource-based)
Custom role definitions
Federated identity and workload identity pool configuration

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the Compute Image IAM Binding resource reference for all available configuration options.

Let's configure GCP Compute Image IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between ImageIamPolicy, ImageIamBinding, and ImageIamMember?

ImageIamPolicy is authoritative and replaces the entire IAM policy. ImageIamBinding is authoritative for a specific role, preserving other roles. ImageIamMember is non-authoritative, adding a single member while preserving other members for that role.

Can I mix different IAM resource types for the same image?

ImageIamPolicy cannot be used with ImageIamBinding or ImageIamMember as they will conflict. However, ImageIamBinding and ImageIamMember can coexist if they manage different roles.

Configuration & Member Identities

What member identity formats are supported?

You can use:

Special identifiers: allUsers, allAuthenticatedUsers
Specific accounts: user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}
Project roles: projectOwner:projectid, projectEditor:projectid, projectViewer:projectid
Federated identities: principal://iam.googleapis.com/...

How do I specify custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/customImageRole.

IAM Conditions & Advanced Features

How do I add time-based or conditional access?

Use the condition property with title, description, and expression fields. Example: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" for expiring access.

Are there limitations with IAM Conditions?

Yes, IAM Conditions have known limitations. Review the GCP documentation on IAM Conditions limitations if you encounter issues.

Immutability & Constraints

What properties can't I change after creation?

The image, project, role, and condition properties are immutable. Changing any of these requires recreating the resource.

Can I use multiple ImageIamBinding resources for the same role?

No, only one ImageIamBinding can be used per role. Multiple bindings for the same role will conflict.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides