The gcp:healthcare/dicomStoreIamBinding:DicomStoreIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Healthcare DICOM stores, controlling which identities can access medical imaging data. This guide focuses on two capabilities: granting roles to multiple members and adding individual members non-authoritatively.
This resource manages access to an existing DICOM store rather than creating the store itself. The examples are intentionally small. Combine them with your own DICOM store infrastructure and identity management.
Grant a role to multiple members
Teams managing DICOM store access often need to grant the same role to multiple users or service accounts at once, ensuring consistent permissions across a group.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const dicomStore = new gcp.healthcare.DicomStoreIamBinding("dicom_store", {
dicomStoreId: "your-dicom-store-id",
role: "roles/editor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
dicom_store = gcp.healthcare.DicomStoreIamBinding("dicom_store",
dicom_store_id="your-dicom-store-id",
role="roles/editor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := healthcare.NewDicomStoreIamBinding(ctx, "dicom_store", &healthcare.DicomStoreIamBindingArgs{
DicomStoreId: pulumi.String("your-dicom-store-id"),
Role: pulumi.String("roles/editor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var dicomStore = new Gcp.Healthcare.DicomStoreIamBinding("dicom_store", new()
{
DicomStoreId = "your-dicom-store-id",
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.DicomStoreIamBinding;
import com.pulumi.gcp.healthcare.DicomStoreIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var dicomStore = new DicomStoreIamBinding("dicomStore", DicomStoreIamBindingArgs.builder()
.dicomStoreId("your-dicom-store-id")
.role("roles/editor")
.members("user:jane@example.com")
.build());
}
}
resources:
dicomStore:
type: gcp:healthcare:DicomStoreIamBinding
name: dicom_store
properties:
dicomStoreId: your-dicom-store-id
role: roles/editor
members:
- user:jane@example.com
The members array lists all identities that receive the specified role. DicomStoreIamBinding is authoritative for the role: it replaces any existing members for that role but preserves other roles on the DICOM store. The dicomStoreId identifies the target store using the format {project_id}/{location}/{dataset}/{dicom_store}.
Add a single member to a role
When onboarding individual users or service accounts, teams add them one at a time without affecting other members who already have the same role.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const dicomStore = new gcp.healthcare.DicomStoreIamMember("dicom_store", {
dicomStoreId: "your-dicom-store-id",
role: "roles/editor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
dicom_store = gcp.healthcare.DicomStoreIamMember("dicom_store",
dicom_store_id="your-dicom-store-id",
role="roles/editor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := healthcare.NewDicomStoreIamMember(ctx, "dicom_store", &healthcare.DicomStoreIamMemberArgs{
DicomStoreId: pulumi.String("your-dicom-store-id"),
Role: pulumi.String("roles/editor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var dicomStore = new Gcp.Healthcare.DicomStoreIamMember("dicom_store", new()
{
DicomStoreId = "your-dicom-store-id",
Role = "roles/editor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.DicomStoreIamMember;
import com.pulumi.gcp.healthcare.DicomStoreIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var dicomStore = new DicomStoreIamMember("dicomStore", DicomStoreIamMemberArgs.builder()
.dicomStoreId("your-dicom-store-id")
.role("roles/editor")
.member("user:jane@example.com")
.build());
}
}
resources:
dicomStore:
type: gcp:healthcare:DicomStoreIamMember
name: dicom_store
properties:
dicomStoreId: your-dicom-store-id
role: roles/editor
member: user:jane@example.com
The member property specifies a single identity to grant access. DicomStoreIamMember is non-authoritative: it adds the member without removing others who already have the role. This approach works well for incremental access grants where you don’t want to manage the complete member list.
Beyond these examples
These snippets focus on specific DICOM store IAM features: role-based access control and member identity formats. They’re intentionally minimal rather than full access management solutions.
The examples reference pre-existing infrastructure such as the DICOM store itself (by ID) and a Google Cloud project with Healthcare API enabled. They focus on configuring access bindings rather than provisioning the underlying storage.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Full policy replacement (DicomStoreIamPolicy)
- Custom role definitions
- Service account creation
These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access management modules. See the DICOM Store IAM Binding resource reference for all available configuration options.
Let's manage GCP Healthcare DICOM Store IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Compatibility
DicomStoreIamPolicy is authoritative and replaces the entire IAM policy. DicomStoreIamBinding is authoritative for a specific role but preserves other roles. DicomStoreIamMember is non-authoritative and preserves other members for the same role.DicomStoreIamPolicy cannot be used with DicomStoreIamBinding or DicomStoreIamMember because they will conflict over the policy state.Configuration & Identity Management
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, and domain:{domain}.[projects|organizations]/{parent-name}/roles/{role-name}.Immutability & Updates
dicomStoreId, role, and condition properties are immutable and require resource replacement if changed.