Manage GCP Cloud DNS IAM Policies

The gcp:dns/dnsManagedZoneIamPolicy:DnsManagedZoneIamPolicy resource, part of the Pulumi GCP provider, controls IAM permissions for Cloud DNS managed zones. Three related resources provide different authority levels: DnsManagedZoneIamPolicy sets the complete policy and replaces existing permissions, DnsManagedZoneIamBinding manages all members for a specific role, and DnsManagedZoneIamMember adds individual members to roles. This guide focuses on three capabilities: authoritative policy replacement, role-level member bindings, and individual member additions.

These resources reference existing managed zones and cannot be mixed arbitrarily. DnsManagedZoneIamPolicy conflicts with both DnsManagedZoneIamBinding and DnsManagedZoneIamMember. DnsManagedZoneIamBinding and DnsManagedZoneIamMember can coexist only if they manage different roles. The examples are intentionally small. Combine them with your own managed zones and IAM principals.

Set the complete IAM policy for a managed zone

When you need full control over all permissions, you can define the entire IAM policy in one place and replace any existing configuration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.dns.DnsManagedZoneIamPolicy("policy", {
    project: _default.project,
    managedZone: _default.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.dns.DnsManagedZoneIamPolicy("policy",
    project=default["project"],
    managed_zone=default["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dns"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = dns.NewDnsManagedZoneIamPolicy(ctx, "policy", &dns.DnsManagedZoneIamPolicyArgs{
			Project:     pulumi.Any(_default.Project),
			ManagedZone: pulumi.Any(_default.Name),
			PolicyData:  pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Dns.DnsManagedZoneIamPolicy("policy", new()
    {
        Project = @default.Project,
        ManagedZone = @default.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.dns.DnsManagedZoneIamPolicy;
import com.pulumi.gcp.dns.DnsManagedZoneIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new DnsManagedZoneIamPolicy("policy", DnsManagedZoneIamPolicyArgs.builder()
            .project(default_.project())
            .managedZone(default_.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:dns:DnsManagedZoneIamPolicy
    properties:
      project: ${default.project}
      managedZone: ${default.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The DnsManagedZoneIamPolicy resource is authoritative: it replaces the entire IAM policy for the managed zone. The policyData property accepts output from the getIAMPolicy data source, which defines bindings between roles and members. This approach gives you complete control but overwrites any permissions not declared in your policy.

Grant a role to multiple members at once

When multiple users or service accounts need the same access level, you can bind them all to a single role without affecting other role assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.dns.DnsManagedZoneIamBinding("binding", {
    project: _default.project,
    managedZone: _default.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.dns.DnsManagedZoneIamBinding("binding",
    project=default["project"],
    managed_zone=default["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dns"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dns.NewDnsManagedZoneIamBinding(ctx, "binding", &dns.DnsManagedZoneIamBindingArgs{
			Project:     pulumi.Any(_default.Project),
			ManagedZone: pulumi.Any(_default.Name),
			Role:        pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Dns.DnsManagedZoneIamBinding("binding", new()
    {
        Project = @default.Project,
        ManagedZone = @default.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dns.DnsManagedZoneIamBinding;
import com.pulumi.gcp.dns.DnsManagedZoneIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new DnsManagedZoneIamBinding("binding", DnsManagedZoneIamBindingArgs.builder()
            .project(default_.project())
            .managedZone(default_.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:dns:DnsManagedZoneIamBinding
    properties:
      project: ${default.project}
      managedZone: ${default.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The DnsManagedZoneIamBinding resource is authoritative for one role: it controls all members assigned to that role but preserves other roles in the policy. The members property accepts a list of principals (users, service accounts, groups). This approach lets you manage role membership as a group while leaving other roles untouched.

Add a single member to a role

When you need to grant access to one additional principal without disrupting existing permissions, you can add them individually.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.dns.DnsManagedZoneIamMember("member", {
    project: _default.project,
    managedZone: _default.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.dns.DnsManagedZoneIamMember("member",
    project=default["project"],
    managed_zone=default["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dns"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dns.NewDnsManagedZoneIamMember(ctx, "member", &dns.DnsManagedZoneIamMemberArgs{
			Project:     pulumi.Any(_default.Project),
			ManagedZone: pulumi.Any(_default.Name),
			Role:        pulumi.String("roles/viewer"),
			Member:      pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Dns.DnsManagedZoneIamMember("member", new()
    {
        Project = @default.Project,
        ManagedZone = @default.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dns.DnsManagedZoneIamMember;
import com.pulumi.gcp.dns.DnsManagedZoneIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new DnsManagedZoneIamMember("member", DnsManagedZoneIamMemberArgs.builder()
            .project(default_.project())
            .managedZone(default_.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:dns:DnsManagedZoneIamMember
    properties:
      project: ${default.project}
      managedZone: ${default.name}
      role: roles/viewer
      member: user:jane@example.com

The DnsManagedZoneIamMember resource is non-authoritative: it adds one member to a role without affecting other members of that role or other roles in the policy. The member property accepts a single principal identifier. This approach is safest when multiple teams manage access to the same managed zone, since it only adds permissions rather than replacing them.

Beyond these examples

These snippets focus on specific IAM management approaches: authoritative policy management, role-level bindings, and individual member grants. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as Cloud DNS managed zones and GCP projects. They focus on IAM policy configuration rather than provisioning the underlying DNS infrastructure.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition blocks)
Custom role definitions
Service account creation and management
Managed zone creation and DNS record configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the DNS Managed Zone IAM Policy resource reference for all available configuration options.

Let's manage GCP Cloud DNS IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Can I use DnsManagedZoneIamPolicy with DnsManagedZoneIamBinding or DnsManagedZoneIamMember?

No, DnsManagedZoneIamPolicy cannot be used with DnsManagedZoneIamBinding or DnsManagedZoneIamMember because they will conflict over policy management. Additionally, DnsManagedZoneIamBinding and DnsManagedZoneIamMember can only be used together if they don’t manage the same role.

What's the difference between DnsManagedZoneIamPolicy, Binding, and Member?

DnsManagedZoneIamPolicy is authoritative and replaces the entire IAM policy. DnsManagedZoneIamBinding is authoritative for a specific role but preserves other roles. DnsManagedZoneIamMember is non-authoritative and adds individual members while preserving existing members for that role.

Configuration & Usage

How do I generate the policyData for DnsManagedZoneIamPolicy?

Use the gcp.organizations.getIAMPolicy data source to generate policyData, as shown in the example where it retrieves policy data with role bindings.

What properties can't be changed after creation?

Both managedZone and project are immutable and cannot be changed after the resource is created.

Import & Migration

How do I import a custom IAM role?

Use the full name format: [projects/my-project|organizations/my-org]/roles/my-custom-role when importing IAM resources with custom roles.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides