Manage GCP Compute Image IAM Policies

The gcp:compute/imageIamPolicy:ImageIamPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Compute Engine images. It determines which users and service accounts can use images to create instances. This guide focuses on four capabilities: authoritative policy replacement (ImageIamPolicy), role-level member management (ImageIamBinding), individual member grants (ImageIamMember), and time-based access with IAM Conditions.

These resources reference existing Compute Engine images by name and project. The examples are intentionally small. Combine them with your own image resources and organizational access patterns.

Replace the entire IAM policy for an image

When you need complete control over image access, ImageIamPolicy replaces the entire IAM policy with your configuration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/compute.imageUser",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.compute.ImageIamPolicy("policy", {
    project: example.project,
    image: example.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/compute.imageUser",
    "members": ["user:jane@example.com"],
}])
policy = gcp.compute.ImageIamPolicy("policy",
    project=example["project"],
    image=example["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/compute.imageUser",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = compute.NewImageIamPolicy(ctx, "policy", &compute.ImageIamPolicyArgs{
			Project:    pulumi.Any(example.Project),
			Image:      pulumi.Any(example.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/compute.imageUser",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Compute.ImageIamPolicy("policy", new()
    {
        Project = example.Project,
        Image = example.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.compute.ImageIamPolicy;
import com.pulumi.gcp.compute.ImageIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/compute.imageUser")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new ImageIamPolicy("policy", ImageIamPolicyArgs.builder()
            .project(example.project())
            .image(example.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:compute:ImageIamPolicy
    properties:
      project: ${example.project}
      image: ${example.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/compute.imageUser
            members:
              - user:jane@example.com

ImageIamPolicy is authoritative: it replaces any existing policy on the image. The policyData comes from the getIAMPolicy data source, which constructs the policy JSON from your bindings. The image and project properties identify which image to configure. This approach gives you full control but cannot coexist with ImageIamBinding or ImageIamMember on the same image.

Grant a role to multiple members at once

When multiple users need the same access level, ImageIamBinding grants a role to a list of members while preserving other roles.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.ImageIamBinding("binding", {
    project: example.project,
    image: example.name,
    role: "roles/compute.imageUser",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.ImageIamBinding("binding",
    project=example["project"],
    image=example["name"],
    role="roles/compute.imageUser",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewImageIamBinding(ctx, "binding", &compute.ImageIamBindingArgs{
			Project: pulumi.Any(example.Project),
			Image:   pulumi.Any(example.Name),
			Role:    pulumi.String("roles/compute.imageUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.ImageIamBinding("binding", new()
    {
        Project = example.Project,
        Image = example.Name,
        Role = "roles/compute.imageUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ImageIamBinding;
import com.pulumi.gcp.compute.ImageIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new ImageIamBinding("binding", ImageIamBindingArgs.builder()
            .project(example.project())
            .image(example.name())
            .role("roles/compute.imageUser")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:ImageIamBinding
    properties:
      project: ${example.project}
      image: ${example.name}
      role: roles/compute.imageUser
      members:
        - user:jane@example.com

ImageIamBinding is authoritative for the specified role but preserves other roles on the image. The members array lists all identities that should have this role. If you later remove a member from this list, Pulumi revokes their access. You can use ImageIamBinding alongside ImageIamMember as long as they manage different roles.

Add a single member to an existing role

When you need to grant access to one user without affecting existing permissions, ImageIamMember adds a single member non-authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.ImageIamMember("member", {
    project: example.project,
    image: example.name,
    role: "roles/compute.imageUser",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.ImageIamMember("member",
    project=example["project"],
    image=example["name"],
    role="roles/compute.imageUser",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewImageIamMember(ctx, "member", &compute.ImageIamMemberArgs{
			Project: pulumi.Any(example.Project),
			Image:   pulumi.Any(example.Name),
			Role:    pulumi.String("roles/compute.imageUser"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.ImageIamMember("member", new()
    {
        Project = example.Project,
        Image = example.Name,
        Role = "roles/compute.imageUser",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ImageIamMember;
import com.pulumi.gcp.compute.ImageIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new ImageIamMember("member", ImageIamMemberArgs.builder()
            .project(example.project())
            .image(example.name())
            .role("roles/compute.imageUser")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:ImageIamMember
    properties:
      project: ${example.project}
      image: ${example.name}
      role: roles/compute.imageUser
      member: user:jane@example.com

ImageIamMember is non-authoritative: it adds one member to a role without removing others. The member property specifies a single identity (user, service account, or group). This is the safest option when multiple teams manage access to the same image, since it won’t conflict with other ImageIamMember resources for the same role.

Apply time-based access with IAM Conditions

Some access grants should expire automatically, such as temporary contractor access or time-limited testing.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/compute.imageUser",
        members: ["user:jane@example.com"],
        condition: {
            title: "expires_after_2019_12_31",
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    }],
});
const policy = new gcp.compute.ImageIamPolicy("policy", {
    project: example.project,
    image: example.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/compute.imageUser",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
}])
policy = gcp.compute.ImageIamPolicy("policy",
    project=example["project"],
    image=example["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/compute.imageUser",
					Members: []string{
						"user:jane@example.com",
					},
					Condition: {
						Title:       "expires_after_2019_12_31",
						Description: pulumi.StringRef("Expiring at midnight of 2019-12-31"),
						Expression:  "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = compute.NewImageIamPolicy(ctx, "policy", &compute.ImageIamPolicyArgs{
			Project:    pulumi.Any(example.Project),
			Image:      pulumi.Any(example.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/compute.imageUser",
                Members = new[]
                {
                    "user:jane@example.com",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "expires_after_2019_12_31",
                    Description = "Expiring at midnight of 2019-12-31",
                    Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
                },
            },
        },
    });

    var policy = new Gcp.Compute.ImageIamPolicy("policy", new()
    {
        Project = example.Project,
        Image = example.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.compute.ImageIamPolicy;
import com.pulumi.gcp.compute.ImageIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/compute.imageUser")
                .members("user:jane@example.com")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("expires_after_2019_12_31")
                    .description("Expiring at midnight of 2019-12-31")
                    .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                    .build())
                .build())
            .build());

        var policy = new ImageIamPolicy("policy", ImageIamPolicyArgs.builder()
            .project(example.project())
            .image(example.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:compute:ImageIamPolicy
    properties:
      project: ${example.project}
      image: ${example.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/compute.imageUser
            members:
              - user:jane@example.com
            condition:
              title: expires_after_2019_12_31
              description: Expiring at midnight of 2019-12-31
              expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions add temporal or attribute-based constraints to access grants. The condition block requires a title, optional description, and expression. The expression uses Common Expression Language (CEL) to define when access is valid. Here, request.time < timestamp(…) grants access until midnight on December 31, 2019. Conditions work with all three resource types (ImageIamPolicy, ImageIamBinding, ImageIamMember) but have known limitations documented by Google Cloud.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management, role-based and member-based access control, and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control systems.

The examples reference pre-existing infrastructure such as Compute Engine images (by name and project). They focus on configuring IAM policies rather than creating the images themselves.

To keep things focused, common IAM patterns are omitted, including:

Combining ImageIamBinding with ImageIamMember for different roles
Condition expressions beyond time-based expiration
Service account and group member formats
Custom role references (projects/my-project/roles/my-role)

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Compute Image IAM Policy resource reference for all available configuration options.

Let's manage GCP Compute Image IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between ImageIamPolicy, ImageIamBinding, and ImageIamMember?

ImageIamPolicy is authoritative and replaces the entire IAM policy. ImageIamBinding is authoritative for a specific role, preserving other roles. ImageIamMember is non-authoritative, adding a single member while preserving other members for that role.

Can I use ImageIamPolicy with ImageIamBinding or ImageIamMember?

No, ImageIamPolicy cannot be used with ImageIamBinding or ImageIamMember as they will conflict over the policy. Choose one approach for managing your image’s IAM policy.

Can I use ImageIamBinding and ImageIamMember together?

Yes, but only if they manage different roles. Using both for the same role will cause conflicts.

IAM Conditions

Does this resource support IAM Conditions?

Yes, but IAM Conditions have known limitations. If you encounter issues, review GCP’s IAM Conditions limitations documentation.

How do I add time-based access expiration?

Use the condition property with title, description, and expression. For example, expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" expires access at midnight on 2020-01-01.

Configuration & Properties

What properties can't be changed after creation?

Both image and project are immutable and cannot be changed after the resource is created.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides