Manage GCP Compute Instance Template IAM Access

The gcp:compute/instanceTemplateIamMember:InstanceTemplateIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual members on Compute Engine instance templates without affecting other members of the same role. This guide focuses on two capabilities: non-authoritative single-member grants and time-based access conditions.

This resource operates non-authoritatively, adding members to roles without removing existing members. The examples are intentionally small. Combine them with your own instance templates and IAM strategy.

Grant a role to a single member

When you need to give one user or service account access to an instance template, use InstanceTemplateIamMember to add them without affecting others who already have the same role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.InstanceTemplateIamMember("member", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.InstanceTemplateIamMember("member",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamMember(ctx, "member", &compute.InstanceTemplateIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.InstanceTemplateIamMember("member", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamMember;
import com.pulumi.gcp.compute.InstanceTemplateIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new InstanceTemplateIamMember("member", InstanceTemplateIamMemberArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:InstanceTemplateIamMember
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      member: user:jane@example.com

The member property identifies who receives access using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property specifies the permission level, such as “roles/compute.instanceAdmin”. Because this resource is non-authoritative, it adds the member to the role without removing other members who were granted access through different resources or the console.

Grant time-limited access with IAM Conditions

Organizations implementing temporary access can attach conditions that automatically expire or evaluate based on request attributes.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.InstanceTemplateIamMember("member", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.InstanceTemplateIamMember("member",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamMember(ctx, "member", &compute.InstanceTemplateIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Member:  pulumi.String("user:jane@example.com"),
			Condition: &compute.InstanceTemplateIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.InstanceTemplateIamMember("member", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Member = "user:jane@example.com",
        Condition = new Gcp.Compute.Inputs.InstanceTemplateIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamMember;
import com.pulumi.gcp.compute.InstanceTemplateIamMemberArgs;
import com.pulumi.gcp.compute.inputs.InstanceTemplateIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new InstanceTemplateIamMember("member", InstanceTemplateIamMemberArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .member("user:jane@example.com")
            .condition(InstanceTemplateIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:compute:InstanceTemplateIamMember
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal or contextual constraints to the role grant. The expression property uses Common Expression Language (CEL) to define when access is valid; here, it expires at midnight on 2020-01-01. The title and description properties document the condition’s purpose. IAM Conditions have known limitations documented by Google Cloud, including restrictions on certain resource types and condition complexity.

Beyond these examples

These snippets focus on specific IAM member features: single-member role grants and time-based access expiration. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as instance templates and GCP projects with IAM Conditions enabled. They focus on granting access to individual members rather than managing complete IAM policies.

To keep things focused, common IAM patterns are omitted, including:

  • Authoritative policy management (InstanceTemplateIamPolicy)
  • Multi-member role bindings (InstanceTemplateIamBinding)
  • Complex condition expressions (resource attributes, request context)
  • Custom role definitions and formatting

These omissions are intentional: the goal is to illustrate how each IAM member feature is wired, not provide drop-in access control modules. See the InstanceTemplateIamMember resource reference for all available configuration options.

Let's manage GCP Compute Instance Template IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between IamPolicy, IamBinding, and IamMember?
gcp.compute.InstanceTemplateIamPolicy is authoritative and replaces the entire IAM policy. gcp.compute.InstanceTemplateIamBinding is authoritative for a specific role, replacing all members for that role while preserving other roles. gcp.compute.InstanceTemplateIamMember is non-authoritative, adding a single member to a role without affecting other members.
Can I use IamPolicy together with IamBinding or IamMember?
No, gcp.compute.InstanceTemplateIamPolicy cannot be used with gcp.compute.InstanceTemplateIamBinding or gcp.compute.InstanceTemplateIamMember as they will conflict over policy control.
Can I use IamBinding and IamMember together?
Yes, but only if they manage different roles. Using gcp.compute.InstanceTemplateIamBinding and gcp.compute.InstanceTemplateIamMember for the same role will cause conflicts.
IAM Configuration
What identity formats can I use for the member property?

You can use multiple formats:

  • Special identifiers: allUsers, allAuthenticatedUsers
  • Specific accounts: user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}
  • Project roles: projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}
  • Federated identities: principal://iam.googleapis.com/locations/global/workforcePools/...
How do I specify custom IAM roles?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.
How do I add IAM Conditions to my bindings?
Set the condition property with title, description, and expression fields. For example, to create a time-based expiration: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".
What are the limitations of IAM Conditions?
IAM Conditions are supported but have known limitations. Review the GCP documentation on IAM Conditions limitations if you encounter issues.
Resource Management
What properties can't be changed after creation?
All input properties are immutable: member, role, name, project, and condition. Changes to any of these require resource replacement.
What import formats are supported?
Three formats are supported: projects/{{project}}/global/instanceTemplates/{{name}}, {{project}}/{{name}}, or just {{name}}. For IamMember imports, include the role and member identity space-delimited.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides