Manage GCP Healthcare HL7 Store IAM Policies

The gcp:healthcare/hl7StoreIamPolicy:Hl7StoreIamPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Healthcare HL7v2 stores. Three related resources serve different use cases: Hl7StoreIamPolicy replaces the entire policy, Hl7StoreIamBinding manages all members for a single role, and Hl7StoreIamMember adds individual members to a role. This guide focuses on three capabilities: authoritative policy replacement, role-level member binding, and incremental member addition.

These resources reference an existing HL7v2 store and grant access to IAM principals. The examples are intentionally small. Combine them with your own HL7v2 store infrastructure and identity management. Note that Hl7StoreIamPolicy cannot be used with Hl7StoreIamBinding or Hl7StoreIamMember, as they will conflict over policy state.

Replace the entire IAM policy with a new definition

When you need complete control over who can access an HL7v2 store, you can replace the entire IAM policy in one operation. This is useful when migrating access controls or establishing a new baseline.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const hl7V2Store = new gcp.healthcare.Hl7StoreIamPolicy("hl7_v2_store", {
    hl7V2StoreId: "your-hl7-v2-store-id",
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
}])
hl7_v2_store = gcp.healthcare.Hl7StoreIamPolicy("hl7_v2_store",
    hl7_v2_store_id="your-hl7-v2-store-id",
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = healthcare.NewHl7StoreIamPolicy(ctx, "hl7_v2_store", &healthcare.Hl7StoreIamPolicyArgs{
			Hl7V2StoreId: pulumi.String("your-hl7-v2-store-id"),
			PolicyData:   pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var hl7V2Store = new Gcp.Healthcare.Hl7StoreIamPolicy("hl7_v2_store", new()
    {
        Hl7V2StoreId = "your-hl7-v2-store-id",
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.healthcare.Hl7StoreIamPolicy;
import com.pulumi.gcp.healthcare.Hl7StoreIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:jane@example.com")
                .build())
            .build());

        var hl7V2Store = new Hl7StoreIamPolicy("hl7V2Store", Hl7StoreIamPolicyArgs.builder()
            .hl7V2StoreId("your-hl7-v2-store-id")
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  hl7V2Store:
    type: gcp:healthcare:Hl7StoreIamPolicy
    name: hl7_v2_store
    properties:
      hl7V2StoreId: your-hl7-v2-store-id
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:jane@example.com

The Hl7StoreIamPolicy resource sets the complete IAM policy for the store, replacing any existing policy. The policyData property accepts output from gcp.organizations.getIAMPolicy, which defines bindings between roles and members. The hl7V2StoreId identifies the target store using the format {project_id}/{location}/{dataset}/{store_name}.

Grant a role to multiple members at once

Teams often need to grant the same role to several users or service accounts simultaneously. Binding manages all members for a single role while preserving other roles in the policy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const hl7V2Store = new gcp.healthcare.Hl7StoreIamBinding("hl7_v2_store", {
    hl7V2StoreId: "your-hl7-v2-store-id",
    role: "roles/editor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

hl7_v2_store = gcp.healthcare.Hl7StoreIamBinding("hl7_v2_store",
    hl7_v2_store_id="your-hl7-v2-store-id",
    role="roles/editor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := healthcare.NewHl7StoreIamBinding(ctx, "hl7_v2_store", &healthcare.Hl7StoreIamBindingArgs{
			Hl7V2StoreId: pulumi.String("your-hl7-v2-store-id"),
			Role:         pulumi.String("roles/editor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var hl7V2Store = new Gcp.Healthcare.Hl7StoreIamBinding("hl7_v2_store", new()
    {
        Hl7V2StoreId = "your-hl7-v2-store-id",
        Role = "roles/editor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.Hl7StoreIamBinding;
import com.pulumi.gcp.healthcare.Hl7StoreIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var hl7V2Store = new Hl7StoreIamBinding("hl7V2Store", Hl7StoreIamBindingArgs.builder()
            .hl7V2StoreId("your-hl7-v2-store-id")
            .role("roles/editor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  hl7V2Store:
    type: gcp:healthcare:Hl7StoreIamBinding
    name: hl7_v2_store
    properties:
      hl7V2StoreId: your-hl7-v2-store-id
      role: roles/editor
      members:
        - user:jane@example.com

The Hl7StoreIamBinding resource is authoritative for a specific role: it sets the complete member list for that role but leaves other roles unchanged. The members property accepts a list of IAM principals in the format user:email, serviceAccount:email, or group:email. This approach works well when you manage role membership as a group.

Add a single member to a role incrementally

When onboarding individual users or service accounts, you can add them to a role without managing the complete member list.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const hl7V2Store = new gcp.healthcare.Hl7StoreIamMember("hl7_v2_store", {
    hl7V2StoreId: "your-hl7-v2-store-id",
    role: "roles/editor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

hl7_v2_store = gcp.healthcare.Hl7StoreIamMember("hl7_v2_store",
    hl7_v2_store_id="your-hl7-v2-store-id",
    role="roles/editor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := healthcare.NewHl7StoreIamMember(ctx, "hl7_v2_store", &healthcare.Hl7StoreIamMemberArgs{
			Hl7V2StoreId: pulumi.String("your-hl7-v2-store-id"),
			Role:         pulumi.String("roles/editor"),
			Member:       pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var hl7V2Store = new Gcp.Healthcare.Hl7StoreIamMember("hl7_v2_store", new()
    {
        Hl7V2StoreId = "your-hl7-v2-store-id",
        Role = "roles/editor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.Hl7StoreIamMember;
import com.pulumi.gcp.healthcare.Hl7StoreIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var hl7V2Store = new Hl7StoreIamMember("hl7V2Store", Hl7StoreIamMemberArgs.builder()
            .hl7V2StoreId("your-hl7-v2-store-id")
            .role("roles/editor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  hl7V2Store:
    type: gcp:healthcare:Hl7StoreIamMember
    name: hl7_v2_store
    properties:
      hl7V2StoreId: your-hl7-v2-store-id
      role: roles/editor
      member: user:jane@example.com

The Hl7StoreIamMember resource is non-authoritative: it adds one member to a role without affecting existing members. The member property accepts a single IAM principal. This approach works well for gradual access grants where you don’t want to track all members in your infrastructure code. You can use multiple Hl7StoreIamMember resources for the same role, or combine them with Hl7StoreIamBinding resources for different roles.

Beyond these examples

These snippets focus on specific IAM management approaches: authoritative policy replacement, role-level binding management, and incremental member addition. They’re intentionally minimal rather than full access control systems.

The examples reference pre-existing infrastructure such as HL7v2 stores and IAM principals (users, service accounts, groups). They focus on configuring access rather than provisioning the underlying healthcare infrastructure.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition blocks)
Custom role definitions
Audit logging configuration
Policy conflict resolution between resource types

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the HL7 Store IAM Policy resource reference for all available configuration options.

Let's manage GCP Healthcare HL7 Store IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between Hl7StoreIamPolicy, Hl7StoreIamBinding, and Hl7StoreIamMember?

Hl7StoreIamPolicy is authoritative and replaces the entire IAM policy. Hl7StoreIamBinding is authoritative for a specific role but preserves other roles. Hl7StoreIamMember is non-authoritative and adds individual members while preserving existing members for that role.

Can I use Hl7StoreIamPolicy with Hl7StoreIamBinding or Hl7StoreIamMember?

No, Hl7StoreIamPolicy cannot be used with Hl7StoreIamBinding or Hl7StoreIamMember because they will conflict over the policy configuration.

Can I use Hl7StoreIamBinding and Hl7StoreIamMember together?

Yes, but only if they don’t grant privileges to the same role. Using both for the same role will cause conflicts.

Which IAM resource should I use for my HL7v2 store?

Use Hl7StoreIamPolicy when you need complete control over the entire policy. Use Hl7StoreIamBinding to manage all members for specific roles. Use Hl7StoreIamMember to add individual members without affecting existing permissions.

Configuration & Setup

What format does hl7V2StoreId accept?

You can use either {project_id}/{location_name}/{dataset_name}/{hl7_v2_store_name} or {location_name}/{dataset_name}/{hl7_v2_store_name}. The shorter form uses your provider’s project setting as a fallback.

Can I change the hl7V2StoreId after creation?

No, hl7V2StoreId is immutable and cannot be changed after the resource is created.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides