The gcp:healthcare/dicomStoreIamBinding:DicomStoreIamBinding resource, part of the Pulumi Google Cloud provider, grants IAM roles to members for a specific DICOM store, controlling who can access medical imaging data. This guide focuses on two capabilities: granting roles to multiple members and adding individual members to roles.
IAM bindings reference existing DICOM stores within Healthcare datasets and IAM identities such as users, service accounts, and groups. The examples are intentionally small. Combine them with your own DICOM store infrastructure and identity management.
Grant a role to multiple members
Teams managing DICOM store access often need to assign the same role to multiple users or service accounts at once.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const dicomStore = new gcp.healthcare.DicomStoreIamBinding("dicom_store", {
dicomStoreId: "your-dicom-store-id",
role: "roles/editor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
dicom_store = gcp.healthcare.DicomStoreIamBinding("dicom_store",
dicom_store_id="your-dicom-store-id",
role="roles/editor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := healthcare.NewDicomStoreIamBinding(ctx, "dicom_store", &healthcare.DicomStoreIamBindingArgs{
DicomStoreId: pulumi.String("your-dicom-store-id"),
Role: pulumi.String("roles/editor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var dicomStore = new Gcp.Healthcare.DicomStoreIamBinding("dicom_store", new()
{
DicomStoreId = "your-dicom-store-id",
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.DicomStoreIamBinding;
import com.pulumi.gcp.healthcare.DicomStoreIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var dicomStore = new DicomStoreIamBinding("dicomStore", DicomStoreIamBindingArgs.builder()
.dicomStoreId("your-dicom-store-id")
.role("roles/editor")
.members("user:jane@example.com")
.build());
}
}
resources:
dicomStore:
type: gcp:healthcare:DicomStoreIamBinding
name: dicom_store
properties:
dicomStoreId: your-dicom-store-id
role: roles/editor
members:
- user:jane@example.com
The binding is authoritative for the specified role: it replaces all members for that role on the DICOM store. The members array accepts multiple identity formats including user:email, serviceAccount:email, group:email, and special identifiers like allUsers or allAuthenticatedUsers. The dicomStoreId follows the format {project_id}/{location_name}/{dataset_name}/{dicom_store_name}.
Add a single member to a role
When onboarding individual users, teams add them one at a time without affecting existing role members.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const dicomStore = new gcp.healthcare.DicomStoreIamMember("dicom_store", {
dicomStoreId: "your-dicom-store-id",
role: "roles/editor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
dicom_store = gcp.healthcare.DicomStoreIamMember("dicom_store",
dicom_store_id="your-dicom-store-id",
role="roles/editor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := healthcare.NewDicomStoreIamMember(ctx, "dicom_store", &healthcare.DicomStoreIamMemberArgs{
DicomStoreId: pulumi.String("your-dicom-store-id"),
Role: pulumi.String("roles/editor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var dicomStore = new Gcp.Healthcare.DicomStoreIamMember("dicom_store", new()
{
DicomStoreId = "your-dicom-store-id",
Role = "roles/editor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.DicomStoreIamMember;
import com.pulumi.gcp.healthcare.DicomStoreIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var dicomStore = new DicomStoreIamMember("dicomStore", DicomStoreIamMemberArgs.builder()
.dicomStoreId("your-dicom-store-id")
.role("roles/editor")
.member("user:jane@example.com")
.build());
}
}
resources:
dicomStore:
type: gcp:healthcare:DicomStoreIamMember
name: dicom_store
properties:
dicomStoreId: your-dicom-store-id
role: roles/editor
member: user:jane@example.com
The DicomStoreIamMember resource (shown in Example 3) adds a single member non-authoritatively, preserving other members who already have the same role. Use member (singular) instead of members (array) to specify one identity. This approach works alongside DicomStoreIamBinding resources as long as they don’t grant the same role.
Beyond these examples
These snippets focus on specific IAM binding features: role-based access control and multi-member and single-member grants. They’re intentionally minimal rather than full access management solutions.
The examples reference pre-existing infrastructure such as DICOM stores within Healthcare datasets and Google Cloud IAM identities. They focus on configuring access rather than provisioning the underlying storage or identity infrastructure.
To keep things focused, common IAM patterns are omitted, including:
- Conditional IAM bindings (condition property)
- Policy-level management (DicomStoreIamPolicy)
- Custom role definitions
- Cross-project or organization-level roles
These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the DICOM Store IAM Binding resource reference for all available configuration options.
Let's manage GCP Healthcare DICOM Store IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Compatibility
DicomStoreIamPolicy replaces the entire IAM policy (authoritative), DicomStoreIamBinding manages all members for a specific role (authoritative per role), or DicomStoreIamMember adds individual members to a role (non-authoritative).DicomStoreIamPolicy cannot be used with DicomStoreIamBinding or DicomStoreIamMember as they will conflict over the policy.Configuration & Constraints
dicomStoreId, role, and condition properties cannot be changed after creation.[projects|organizations]/{parent-name}/roles/{role-name}. Only one DicomStoreIamBinding can be used per role.allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, or domain:{domain}.