The gcp:dns/dnsManagedZoneIamMember:DnsManagedZoneIamMember resource, part of the Pulumi GCP provider, grants IAM permissions to individual members on Cloud DNS managed zones without replacing existing permissions. This guide focuses on one capability: non-authoritative member grants.
This resource is one of three IAM resources for managed zones. DnsManagedZoneIamMember adds a single member to a role without affecting other members or roles, making it safe to use alongside other IAM configurations. The example is intentionally small. Combine it with your own managed zones and identity management.
Grant a single user access to a managed zone
Most IAM configurations add individual users or service accounts to specific roles without disrupting existing permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.dns.DnsManagedZoneIamMember("member", {
project: _default.project,
managedZone: _default.name,
role: "roles/viewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.dns.DnsManagedZoneIamMember("member",
project=default["project"],
managed_zone=default["name"],
role="roles/viewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dns"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := dns.NewDnsManagedZoneIamMember(ctx, "member", &dns.DnsManagedZoneIamMemberArgs{
Project: pulumi.Any(_default.Project),
ManagedZone: pulumi.Any(_default.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Dns.DnsManagedZoneIamMember("member", new()
{
Project = @default.Project,
ManagedZone = @default.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dns.DnsManagedZoneIamMember;
import com.pulumi.gcp.dns.DnsManagedZoneIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new DnsManagedZoneIamMember("member", DnsManagedZoneIamMemberArgs.builder()
.project(default_.project())
.managedZone(default_.name())
.role("roles/viewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:dns:DnsManagedZoneIamMember
properties:
project: ${default.project}
managedZone: ${default.name}
role: roles/viewer
member: user:jane@example.com
The member property specifies the identity to grant access, using formats like “user:email@example.com” or “serviceAccount:name@project.iam.gserviceaccount.com”. The role property defines the permission level (e.g., “roles/viewer” for read-only access). Because this resource is non-authoritative, it preserves other members already assigned to the role and other roles on the managed zone.
Beyond these examples
This snippet focuses on non-authoritative member grants. It’s intentionally minimal rather than a complete IAM configuration.
The example references pre-existing infrastructure such as Cloud DNS managed zones and a GCP project with the DNS API enabled. It focuses on granting permissions rather than provisioning zones or managing complete policies.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Multiple members per role (use DnsManagedZoneIamBinding)
- Complete policy replacement (use DnsManagedZoneIamPolicy)
- Service account and group identities
These omissions are intentional: the goal is to illustrate how member grants are wired, not provide drop-in IAM modules. See the DnsManagedZoneIamMember resource reference for all available configuration options.
Let's manage GCP Cloud DNS IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
DnsManagedZoneIamPolicy is authoritative and replaces the entire IAM policy. DnsManagedZoneIamBinding is authoritative for a specific role, managing all members for that role while preserving other roles. DnsManagedZoneIamMember is non-authoritative, adding individual members to a role without affecting other members.DnsManagedZoneIamPolicy cannot be used with DnsManagedZoneIamBinding or DnsManagedZoneIamMember, as they will conflict over policy management. However, DnsManagedZoneIamBinding and DnsManagedZoneIamMember can be used together only if they don’t grant privilege to the same role.Configuration & Identity Formats
allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, and federated identities like principal://iam.googleapis.com/locations/global/workforcePools/example-contractors/subject/joe@example.com.[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.project parameter is required but can be parsed from the parent resource identifier if not explicitly provided. If no project is available from the parent or specified directly, the provider project is used.Immutability & Lifecycle
managedZone, member, role, project, and condition) are immutable and require resource replacement if changed.pulumi import gcp:dns/dnsManagedZoneIamMember:DnsManagedZoneIamMember editor "projects/{{project}}/managedZones/{{managed_zone}} roles/viewer user:jane@example.com".