The gcp:compute/snapshotIamBinding:SnapshotIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Compute Engine snapshots. This guide focuses on two capabilities: authoritative role binding (which replaces all members for a role) and non-authoritative member addition (which preserves existing members).
IAM bindings reference existing snapshots and require appropriate permissions to modify access policies. The examples are intentionally small. Combine them with your own snapshot resources and identity management workflows.
Grant a role to multiple members
When managing snapshot access, teams often need to grant the same role to multiple users or service accounts at once.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.compute.SnapshotIamBinding("binding", {
project: snapshot.project,
name: snapshot.name,
role: "roles/viewer",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.compute.SnapshotIamBinding("binding",
project=snapshot["project"],
name=snapshot["name"],
role="roles/viewer",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := compute.NewSnapshotIamBinding(ctx, "binding", &compute.SnapshotIamBindingArgs{
Project: pulumi.Any(snapshot.Project),
Name: pulumi.Any(snapshot.Name),
Role: pulumi.String("roles/viewer"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Compute.SnapshotIamBinding("binding", new()
{
Project = snapshot.Project,
Name = snapshot.Name,
Role = "roles/viewer",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.SnapshotIamBinding;
import com.pulumi.gcp.compute.SnapshotIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new SnapshotIamBinding("binding", SnapshotIamBindingArgs.builder()
.project(snapshot.project())
.name(snapshot.name())
.role("roles/viewer")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:compute:SnapshotIamBinding
properties:
project: ${snapshot.project}
name: ${snapshot.name}
role: roles/viewer
members:
- user:jane@example.com
The role property specifies which permission set to grant (e.g., “roles/viewer”). The members array lists all identities that should have this role. SnapshotIamBinding is authoritative for the specified role: it replaces any existing members for that role on the snapshot. The name and project properties identify which snapshot to modify.
Add a single member to a role
When you need to grant access to one additional user without affecting existing members, use SnapshotIamMember.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.compute.SnapshotIamMember("member", {
project: snapshot.project,
name: snapshot.name,
role: "roles/viewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.compute.SnapshotIamMember("member",
project=snapshot["project"],
name=snapshot["name"],
role="roles/viewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := compute.NewSnapshotIamMember(ctx, "member", &compute.SnapshotIamMemberArgs{
Project: pulumi.Any(snapshot.Project),
Name: pulumi.Any(snapshot.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Compute.SnapshotIamMember("member", new()
{
Project = snapshot.Project,
Name = snapshot.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.SnapshotIamMember;
import com.pulumi.gcp.compute.SnapshotIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new SnapshotIamMember("member", SnapshotIamMemberArgs.builder()
.project(snapshot.project())
.name(snapshot.name())
.role("roles/viewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:compute:SnapshotIamMember
properties:
project: ${snapshot.project}
name: ${snapshot.name}
role: roles/viewer
member: user:jane@example.com
The member property specifies a single identity to add (note the singular form, unlike the members array in SnapshotIamBinding). This resource is non-authoritative: it adds the specified member to the role without removing other members. You can use multiple SnapshotIamMember resources for the same role, or combine them with SnapshotIamBinding resources for different roles.
Beyond these examples
These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as Compute Engine snapshots and a GCP project with appropriate IAM permissions. They focus on configuring access bindings rather than creating the underlying snapshot resources.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Full policy replacement (SnapshotIamPolicy resource)
- Custom role definitions
- Federated identity configuration
These omissions are intentional: the goal is to illustrate how each binding type is wired, not provide drop-in access control modules. See the SnapshotIamBinding resource reference for all available configuration options.
Let's configure GCP Compute Snapshot IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.compute.SnapshotIamPolicy is authoritative and replaces the entire IAM policy. gcp.compute.SnapshotIamBinding is authoritative for a given role, preserving other roles. gcp.compute.SnapshotIamMember is non-authoritative, preserving other members for the role.gcp.compute.SnapshotIamPolicy cannot be used with gcp.compute.SnapshotIamBinding or gcp.compute.SnapshotIamMember, as they will conflict. However, SnapshotIamBinding and SnapshotIamMember can be used together only if they manage different roles.gcp.compute.SnapshotIamBinding per role. Each binding must manage a different role to avoid conflicts.IAM Configuration
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/....[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role.Immutability & Limitations
name, project, and role properties are immutable. You must recreate the resource to change any of these values.