Manage GCP Gemini Repository Group IAM Bindings

The gcp:gemini/repositoryGroupIamBinding:RepositoryGroupIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Gemini repository groups, controlling which users and service accounts can access repository collections. This guide focuses on two capabilities: granting roles to multiple members and adding individual members incrementally.

IAM bindings reference existing repository groups and code repository indexes within a GCP project and location. The examples are intentionally small. Combine them with your own repository infrastructure and identity management.

Grant a role to multiple members at once

Teams managing repository group access often need to assign the same role to multiple users or service accounts simultaneously, ensuring consistent permissions across a team.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.gemini.RepositoryGroupIamBinding("binding", {
    project: example.project,
    location: example.location,
    codeRepositoryIndex: example.codeRepositoryIndex,
    repositoryGroupId: example.repositoryGroupId,
    role: "roles/cloudaicompanion.repositoryGroupsUser",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.gemini.RepositoryGroupIamBinding("binding",
    project=example["project"],
    location=example["location"],
    code_repository_index=example["codeRepositoryIndex"],
    repository_group_id=example["repositoryGroupId"],
    role="roles/cloudaicompanion.repositoryGroupsUser",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/gemini"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gemini.NewRepositoryGroupIamBinding(ctx, "binding", &gemini.RepositoryGroupIamBindingArgs{
			Project:             pulumi.Any(example.Project),
			Location:            pulumi.Any(example.Location),
			CodeRepositoryIndex: pulumi.Any(example.CodeRepositoryIndex),
			RepositoryGroupId:   pulumi.Any(example.RepositoryGroupId),
			Role:                pulumi.String("roles/cloudaicompanion.repositoryGroupsUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Gemini.RepositoryGroupIamBinding("binding", new()
    {
        Project = example.Project,
        Location = example.Location,
        CodeRepositoryIndex = example.CodeRepositoryIndex,
        RepositoryGroupId = example.RepositoryGroupId,
        Role = "roles/cloudaicompanion.repositoryGroupsUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.gemini.RepositoryGroupIamBinding;
import com.pulumi.gcp.gemini.RepositoryGroupIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new RepositoryGroupIamBinding("binding", RepositoryGroupIamBindingArgs.builder()
            .project(example.project())
            .location(example.location())
            .codeRepositoryIndex(example.codeRepositoryIndex())
            .repositoryGroupId(example.repositoryGroupId())
            .role("roles/cloudaicompanion.repositoryGroupsUser")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:gemini:RepositoryGroupIamBinding
    properties:
      project: ${example.project}
      location: ${example.location}
      codeRepositoryIndex: ${example.codeRepositoryIndex}
      repositoryGroupId: ${example.repositoryGroupId}
      role: roles/cloudaicompanion.repositoryGroupsUser
      members:
        - user:jane@example.com

The role property specifies which permission set to grant (e.g., roles/cloudaicompanion.repositoryGroupsUser). The members array lists all identities that receive this role; this resource is authoritative for the role, meaning it replaces any existing member list. The repositoryGroupId and codeRepositoryIndex properties identify which repository group to manage.

Add individual members to a role incrementally

When access needs evolve, teams add members one at a time without replacing the entire member list.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.gemini.RepositoryGroupIamMember("member", {
    project: example.project,
    location: example.location,
    codeRepositoryIndex: example.codeRepositoryIndex,
    repositoryGroupId: example.repositoryGroupId,
    role: "roles/cloudaicompanion.repositoryGroupsUser",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.gemini.RepositoryGroupIamMember("member",
    project=example["project"],
    location=example["location"],
    code_repository_index=example["codeRepositoryIndex"],
    repository_group_id=example["repositoryGroupId"],
    role="roles/cloudaicompanion.repositoryGroupsUser",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/gemini"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := gemini.NewRepositoryGroupIamMember(ctx, "member", &gemini.RepositoryGroupIamMemberArgs{
			Project:             pulumi.Any(example.Project),
			Location:            pulumi.Any(example.Location),
			CodeRepositoryIndex: pulumi.Any(example.CodeRepositoryIndex),
			RepositoryGroupId:   pulumi.Any(example.RepositoryGroupId),
			Role:                pulumi.String("roles/cloudaicompanion.repositoryGroupsUser"),
			Member:              pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Gemini.RepositoryGroupIamMember("member", new()
    {
        Project = example.Project,
        Location = example.Location,
        CodeRepositoryIndex = example.CodeRepositoryIndex,
        RepositoryGroupId = example.RepositoryGroupId,
        Role = "roles/cloudaicompanion.repositoryGroupsUser",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.gemini.RepositoryGroupIamMember;
import com.pulumi.gcp.gemini.RepositoryGroupIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RepositoryGroupIamMember("member", RepositoryGroupIamMemberArgs.builder()
            .project(example.project())
            .location(example.location())
            .codeRepositoryIndex(example.codeRepositoryIndex())
            .repositoryGroupId(example.repositoryGroupId())
            .role("roles/cloudaicompanion.repositoryGroupsUser")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:gemini:RepositoryGroupIamMember
    properties:
      project: ${example.project}
      location: ${example.location}
      codeRepositoryIndex: ${example.codeRepositoryIndex}
      repositoryGroupId: ${example.repositoryGroupId}
      role: roles/cloudaicompanion.repositoryGroupsUser
      member: user:jane@example.com

The member property (singular) adds one identity to the role without affecting other members. This resource is non-authoritative, preserving existing members for the role. Use this approach when onboarding new team members or granting access to additional service accounts.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and batch and incremental member management. They’re intentionally minimal rather than full access control systems.

The examples reference pre-existing infrastructure such as Gemini repository groups and code repository indexes, and GCP projects with configured locations. They focus on configuring IAM bindings rather than provisioning the underlying repository infrastructure.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy-level management (RepositoryGroupIamPolicy resource)
Custom role definitions
Federated identity configuration

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the RepositoryGroupIamBinding resource reference for all available configuration options.

Let's manage GCP Gemini Repository Group IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Can I use IamPolicy, IamBinding, and IamMember resources together?

No, RepositoryGroupIamPolicy cannot be used with RepositoryGroupIamBinding or RepositoryGroupIamMember as they will conflict. However, RepositoryGroupIamBinding and RepositoryGroupIamMember can be used together only if they don’t grant privileges to the same role.

What's the difference between IamPolicy, IamBinding, and IamMember?

RepositoryGroupIamPolicy is authoritative and replaces the entire IAM policy. RepositoryGroupIamBinding is authoritative for a specific role, managing all members for that role while preserving other roles. RepositoryGroupIamMember is non-authoritative, adding individual members without affecting existing members for the role.

Which IAM resource should I use for my use case?

Use RepositoryGroupIamPolicy for complete policy control, RepositoryGroupIamBinding to manage all members for a specific role, or RepositoryGroupIamMember to add individual members without affecting others. Choose based on whether you need full control or granular additions.

Configuration & Identity Management

How do I grant access to a single user?

Use RepositoryGroupIamMember with the role property set to your desired role (e.g., roles/cloudaicompanion.repositoryGroupsUser) and member set to user:jane@example.com.

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities using principal:// format.

How do I use custom IAM roles?

Custom roles must follow the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

What identifiers are required to configure IAM bindings?

You must provide codeRepositoryIndex, location, repositoryGroupId, and project. All of these are immutable after creation. If not specified, location and project can be parsed from the parent resource identifier or provider configuration.

Can I change the role or members after creating an IamBinding?

The role is immutable and cannot be changed after creation. However, the members array can be updated to add or remove identities for that role.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides