Configure GCP Compute Instance Template IAM Bindings

The gcp:compute/instanceTemplateIamBinding:InstanceTemplateIamBinding resource, part of the Pulumi GCP provider, grants IAM roles to members for a specific instance template, controlling who can view, modify, or manage the template. This guide focuses on three capabilities: authoritative role bindings that replace all members for a role, non-authoritative member additions that preserve existing members, and time-based access with IAM Conditions.

IAM bindings reference existing instance templates by name and require a configured GCP project. The examples are intentionally small. Combine them with your own instance templates and member lists.

Grant a role to multiple members at once

Teams managing template access often assign the same role to multiple users or service accounts simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.InstanceTemplateIamBinding("binding", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.InstanceTemplateIamBinding("binding",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamBinding(ctx, "binding", &compute.InstanceTemplateIamBindingArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.InstanceTemplateIamBinding("binding", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamBinding;
import com.pulumi.gcp.compute.InstanceTemplateIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new InstanceTemplateIamBinding("binding", InstanceTemplateIamBindingArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:InstanceTemplateIamBinding
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      members:
        - user:jane@example.com

The binding resource is authoritative for the specified role: it replaces any existing members for that role on the template. The members array accepts user accounts, service accounts, groups, and special identifiers. The role property specifies which permission set to grant (e.g., roles/compute.instanceAdmin).

Add a single member to a role incrementally

When onboarding individual users, you can add them one at a time without affecting existing role assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.InstanceTemplateIamMember("member", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.InstanceTemplateIamMember("member",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamMember(ctx, "member", &compute.InstanceTemplateIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.InstanceTemplateIamMember("member", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamMember;
import com.pulumi.gcp.compute.InstanceTemplateIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new InstanceTemplateIamMember("member", InstanceTemplateIamMemberArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:InstanceTemplateIamMember
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      member: user:jane@example.com

The member resource is non-authoritative: it adds one member to a role without replacing others who already have that role. This approach works well for incremental access grants where you don’t want to manage the complete member list in one place. Use InstanceTemplateIamMember when multiple teams manage access independently.

Apply time-based access with IAM Conditions

Temporary access grants, such as contractor permissions or time-limited testing, require automatic expiration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.InstanceTemplateIamBinding("binding", {
    project: _default.project,
    name: _default.name,
    role: "roles/compute.instanceAdmin",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.InstanceTemplateIamBinding("binding",
    project=default["project"],
    name=default["name"],
    role="roles/compute.instanceAdmin",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewInstanceTemplateIamBinding(ctx, "binding", &compute.InstanceTemplateIamBindingArgs{
			Project: pulumi.Any(_default.Project),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.instanceAdmin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &compute.InstanceTemplateIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.InstanceTemplateIamBinding("binding", new()
    {
        Project = @default.Project,
        Name = @default.Name,
        Role = "roles/compute.instanceAdmin",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Compute.Inputs.InstanceTemplateIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.InstanceTemplateIamBinding;
import com.pulumi.gcp.compute.InstanceTemplateIamBindingArgs;
import com.pulumi.gcp.compute.inputs.InstanceTemplateIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new InstanceTemplateIamBinding("binding", InstanceTemplateIamBindingArgs.builder()
            .project(default_.project())
            .name(default_.name())
            .role("roles/compute.instanceAdmin")
            .members("user:jane@example.com")
            .condition(InstanceTemplateIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:InstanceTemplateIamBinding
    properties:
      project: ${default.project}
      name: ${default.name}
      role: roles/compute.instanceAdmin
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions add logic to role bindings through the condition block. The expression property uses CEL (Common Expression Language) to define when access is valid. Here, the condition checks request.time against a timestamp, automatically revoking access after the deadline. The title and description properties document the condition’s purpose.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control (binding vs member) and IAM Conditions for time-based access. They’re intentionally minimal rather than full access management solutions.

The examples reference pre-existing infrastructure such as instance templates (by name) and a GCP project with configured provider. They focus on granting access rather than creating the templates themselves.

To keep things focused, common IAM patterns are omitted, including:

Full policy replacement (InstanceTemplateIamPolicy)
Policy data retrieval (getIAMPolicy data source)
Custom role formatting ([projects|organizations]/{parent}/roles/{name})
Special member identifiers (allUsers, domain:, projectOwner:, federated identities)

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the InstanceTemplateIamBinding resource reference for all available configuration options.

Let's configure GCP Compute Instance Template IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between InstanceTemplateIamPolicy, InstanceTemplateIamBinding, and InstanceTemplateIamMember?

gcp.compute.InstanceTemplateIamPolicy is authoritative and replaces the entire IAM policy. gcp.compute.InstanceTemplateIamBinding is authoritative for a specific role, preserving other roles in the policy. gcp.compute.InstanceTemplateIamMember is non-authoritative, adding a single member to a role while preserving other members.

Can I use these IAM resources together?

gcp.compute.InstanceTemplateIamPolicy cannot be used with gcp.compute.InstanceTemplateIamBinding or gcp.compute.InstanceTemplateIamMember, as they’ll conflict over the policy. You can use gcp.compute.InstanceTemplateIamBinding and gcp.compute.InstanceTemplateIamMember together only if they manage different roles.

IAM Configuration

What member identity formats are supported?

The members property supports multiple formats:

allUsers and allAuthenticatedUsers for public/authenticated access
user:{emailid} for specific Google accounts
serviceAccount:{emailid} for service accounts
group:{emailid} for Google groups
domain:{domain} for G Suite domains
projectOwner:projectid, projectEditor:projectid, projectViewer:projectid for project roles
Federated identities using principal:// format for workload/workforce identity pools

What format do custom roles need?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

Can I use multiple InstanceTemplateIamBinding resources for the same instance template?

Yes, but only one gcp.compute.InstanceTemplateIamBinding per role. Each binding manages a different role independently.

Conditions & Advanced Features

How do I add time-based or conditional access with IAM Conditions?

Add a condition block with title, description, and expression fields. For example, to expire access at a specific date, use expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".

Are there limitations with IAM Conditions?

Yes, IAM Conditions have known limitations. Review the GCP documentation on IAM Conditions limitations before implementing them in production.

Immutability & Lifecycle

What properties can't be changed after creation?

The name, project, role, and condition properties are immutable. Changing any of these requires recreating the resource.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides