Manage GCP Endpoints Service IAM Permissions

The gcp:endpoints/serviceIamBinding:ServiceIamBinding resource, part of the Pulumi GCP provider, grants IAM roles to members for Cloud Endpoints services. It manages access control authoritatively for a single role while preserving other roles on the service. This guide focuses on two capabilities: granting roles to multiple members and adding individual members non-authoritatively.

ServiceIamBinding manages IAM for existing Cloud Endpoints services. It cannot be used with ServiceIamPolicy (they conflict over policy ownership). The examples are intentionally small. Combine them with your own service definitions and member lists.

Grant a role to multiple members

Teams managing Cloud Endpoints services grant IAM roles to groups of users or service accounts. ServiceIamBinding assigns a single role to a list of members while preserving other roles.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.endpoints.ServiceIamBinding("binding", {
    serviceName: endpointsService.serviceName,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.endpoints.ServiceIamBinding("binding",
    service_name=endpoints_service["serviceName"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/endpoints"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := endpoints.NewServiceIamBinding(ctx, "binding", &endpoints.ServiceIamBindingArgs{
			ServiceName: pulumi.Any(endpointsService.ServiceName),
			Role:        pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Endpoints.ServiceIamBinding("binding", new()
    {
        ServiceName = endpointsService.ServiceName,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.endpoints.ServiceIamBinding;
import com.pulumi.gcp.endpoints.ServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new ServiceIamBinding("binding", ServiceIamBindingArgs.builder()
            .serviceName(endpointsService.serviceName())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:endpoints:ServiceIamBinding
    properties:
      serviceName: ${endpointsService.serviceName}
      role: roles/viewer
      members:
        - user:jane@example.com

The serviceName property identifies the Cloud Endpoints service. The role property specifies which IAM role to grant (e.g., “roles/viewer”). The members array lists identities that receive the role. ServiceIamBinding is authoritative for this specific role: it replaces any existing members for “roles/viewer” but leaves other roles untouched.

Add a single member to a role

When you need to grant access to one additional user without affecting existing members, use ServiceIamMember for non-authoritative updates.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.endpoints.ServiceIamMember("member", {
    serviceName: endpointsService.serviceName,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.endpoints.ServiceIamMember("member",
    service_name=endpoints_service["serviceName"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/endpoints"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := endpoints.NewServiceIamMember(ctx, "member", &endpoints.ServiceIamMemberArgs{
			ServiceName: pulumi.Any(endpointsService.ServiceName),
			Role:        pulumi.String("roles/viewer"),
			Member:      pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Endpoints.ServiceIamMember("member", new()
    {
        ServiceName = endpointsService.ServiceName,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.endpoints.ServiceIamMember;
import com.pulumi.gcp.endpoints.ServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new ServiceIamMember("member", ServiceIamMemberArgs.builder()
            .serviceName(endpointsService.serviceName())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:endpoints:ServiceIamMember
    properties:
      serviceName: ${endpointsService.serviceName}
      role: roles/viewer
      member: user:jane@example.com

ServiceIamMember adds a single member to a role without replacing existing members. The member property takes one identity (not an array). This resource is non-authoritative: multiple ServiceIamMember resources can grant the same role to different members, and they won’t conflict. Use this when you want to add access incrementally rather than manage the complete member list.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and member identity formats. They’re intentionally minimal rather than full access control policies.

The examples reference pre-existing infrastructure such as Cloud Endpoints services. They focus on configuring IAM bindings rather than provisioning the services themselves.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
ServiceIamPolicy for full policy replacement
Custom role configuration
Federated identity pool integration

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the Cloud Endpoints ServiceIamBinding resource reference for all available configuration options.

Let's manage GCP Endpoints Service IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between ServiceIamPolicy, ServiceIamBinding, and ServiceIamMember?

ServiceIamPolicy is authoritative and replaces the entire IAM policy. ServiceIamBinding is authoritative for a specific role, preserving other roles. ServiceIamMember is non-authoritative, adding a single member while preserving other members for that role.

Can I use ServiceIamPolicy with ServiceIamBinding or ServiceIamMember?

No, ServiceIamPolicy cannot be used with ServiceIamBinding or ServiceIamMember because they will conflict over the policy configuration.

Can I use ServiceIamBinding and ServiceIamMember together?

Yes, but only if they grant different roles. Using both for the same role will cause conflicts.

Configuration & Syntax

How do I specify a custom IAM role?

Use the full format [projects|organizations]/{parent-name}/roles/{role-name}, for example: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, and federated identities like principal://iam.googleapis.com/....

Immutability & Limitations

What properties are immutable after creation?

The role, serviceName, and condition properties cannot be changed after the resource is created.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides