Manage GCP Compute Instance Template IAM Access

The gcp:compute/instanceTemplateIamMember:InstanceTemplateIamMember resource, part of the Pulumi GCP provider, grants IAM permissions to individual members on instance templates without affecting other members in the same role. This guide focuses on two capabilities: adding single members to roles and configuring time-limited access with IAM Conditions.

This resource is non-authoritative, meaning it adds one member to a role without removing existing members. It references existing instance templates and requires a configured GCP project. The examples are intentionally small. Combine them with your own instance templates and IAM strategy.

Grant a role to a single member

When you need to give one user or service account access to an instance template, this resource adds that member without affecting other existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.InstanceTemplateIamMember("member", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.InstanceTemplateIamMember("member",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamMember(ctx, "member", &compute.InstanceTemplateIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.InstanceTemplateIamMember("member", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamMember;
import com.pulumi.gcp.compute.InstanceTemplateIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new InstanceTemplateIamMember("member", InstanceTemplateIamMemberArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:InstanceTemplateIamMember
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      member: user:jane@example.com

The member property specifies the identity receiving access, using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property defines what permissions they receive. The name property identifies which instance template to grant access to. This approach preserves other members already assigned to the same role.

Add time-limited access with IAM Conditions

IAM Conditions let you grant temporary access that expires automatically, useful for contractors or time-bound projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.InstanceTemplateIamMember("member", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.InstanceTemplateIamMember("member",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamMember(ctx, "member", &compute.InstanceTemplateIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Member:  pulumi.String("user:jane@example.com"),
			Condition: &compute.InstanceTemplateIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.InstanceTemplateIamMember("member", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Member = "user:jane@example.com",
        Condition = new Gcp.Compute.Inputs.InstanceTemplateIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamMember;
import com.pulumi.gcp.compute.InstanceTemplateIamMemberArgs;
import com.pulumi.gcp.compute.inputs.InstanceTemplateIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new InstanceTemplateIamMember("member", InstanceTemplateIamMemberArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .member("user:jane@example.com")
            .condition(InstanceTemplateIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:compute:InstanceTemplateIamMember
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds time-based restrictions to the member grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here it expires at midnight on 2020-01-01. The title and description properties document the condition’s purpose. When the condition evaluates to false, the member loses access automatically without manual revocation.

Beyond these examples

These snippets focus on specific IAM member features: single-member grants and time-based conditional access. They’re intentionally minimal rather than complete IAM configurations.

The examples reference pre-existing infrastructure such as instance templates and GCP projects. They focus on granting member access rather than provisioning the templates themselves.

To keep things focused, common IAM patterns are omitted, including:

  • Multi-member role bindings (use InstanceTemplateIamBinding)
  • Full policy replacement (use InstanceTemplateIamPolicy)
  • Complex condition expressions beyond time-based expiration
  • Custom role definitions and formats

These omissions are intentional: the goal is to illustrate how member grants are wired, not provide drop-in IAM modules. See the InstanceTemplateIamMember resource reference for all available configuration options.

Let's manage GCP Compute Instance Template IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between InstanceTemplateIamPolicy, IamBinding, and IamMember?
gcp.compute.InstanceTemplateIamPolicy is authoritative and replaces the entire IAM policy. gcp.compute.InstanceTemplateIamBinding is authoritative for a specific role, managing all members for that role while preserving other roles. gcp.compute.InstanceTemplateIamMember is non-authoritative, adding individual members without affecting other members for the same role.
Can I use multiple IAM resource types together?
gcp.compute.InstanceTemplateIamPolicy cannot be used with gcp.compute.InstanceTemplateIamBinding or gcp.compute.InstanceTemplateIamMember as they will conflict. However, gcp.compute.InstanceTemplateIamBinding and gcp.compute.InstanceTemplateIamMember can be used together only if they don’t grant privileges to the same role.
IAM Configuration
What identity formats can I use for the member parameter?
Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/locations/global/workforcePools/....
How do I specify custom roles?
Custom roles must use the full path format [projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.
How do I use IAM Conditions with time-based expiration?
Add a condition block with title, description, and expression fields. For example: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" creates an expiring binding. Note that IAM Conditions have known limitations documented by GCP.
Can I modify IAM bindings after creation?
No, all properties (member, role, name, project, and condition) are immutable. To change any of these, you must destroy and recreate the resource.
Import & Operations
How do I import existing IAM member bindings?
Use space-delimited identifiers: the resource identifier, role, and member identity. For example: pulumi import gcp:compute/instanceTemplateIamMember:InstanceTemplateIamMember editor "projects/{{project}}/global/instanceTemplates/{{instance_template}} roles/compute.instanceAdmin user:jane@example.com". For custom roles, use the full role path.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides