The gcp:healthcare/hl7StoreIamMember:Hl7StoreIamMember resource, part of the Pulumi GCP provider, grants IAM permissions to individual members on Healthcare HL7v2 stores without replacing existing access. This guide focuses on two capabilities: adding individual members to roles and managing complete member lists for specific roles.
IAM resources reference existing HL7v2 stores and assume members already exist in your GCP organization. The examples are intentionally small. Combine them with your own Healthcare datasets and identity management.
Grant a single user access to an HL7v2 store
Healthcare applications often need to grant individual users or service accounts access to HL7v2 stores without affecting other permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const hl7V2Store = new gcp.healthcare.Hl7StoreIamMember("hl7_v2_store", {
hl7V2StoreId: "your-hl7-v2-store-id",
role: "roles/editor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
hl7_v2_store = gcp.healthcare.Hl7StoreIamMember("hl7_v2_store",
hl7_v2_store_id="your-hl7-v2-store-id",
role="roles/editor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := healthcare.NewHl7StoreIamMember(ctx, "hl7_v2_store", &healthcare.Hl7StoreIamMemberArgs{
Hl7V2StoreId: pulumi.String("your-hl7-v2-store-id"),
Role: pulumi.String("roles/editor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var hl7V2Store = new Gcp.Healthcare.Hl7StoreIamMember("hl7_v2_store", new()
{
Hl7V2StoreId = "your-hl7-v2-store-id",
Role = "roles/editor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.Hl7StoreIamMember;
import com.pulumi.gcp.healthcare.Hl7StoreIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var hl7V2Store = new Hl7StoreIamMember("hl7V2Store", Hl7StoreIamMemberArgs.builder()
.hl7V2StoreId("your-hl7-v2-store-id")
.role("roles/editor")
.member("user:jane@example.com")
.build());
}
}
resources:
hl7V2Store:
type: gcp:healthcare:Hl7StoreIamMember
name: hl7_v2_store
properties:
hl7V2StoreId: your-hl7-v2-store-id
role: roles/editor
member: user:jane@example.com
The Hl7StoreIamMember resource adds one member to one role non-authoritatively, meaning it preserves any other members already assigned to that role. The member property accepts various identity formats: user:email@example.com for individual users, serviceAccount:name@project.iam.gserviceaccount.com for service accounts, group:admins@example.com for groups, or domain:example.com for entire G Suite domains. The hl7V2StoreId references the store using either the full path with project ID or a shorter form that uses your provider’s default project.
Manage all members for a specific role
When you need to control the complete list of who has a particular role, use Hl7StoreIamBinding to define all members at once.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const hl7V2Store = new gcp.healthcare.Hl7StoreIamBinding("hl7_v2_store", {
hl7V2StoreId: "your-hl7-v2-store-id",
role: "roles/editor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
hl7_v2_store = gcp.healthcare.Hl7StoreIamBinding("hl7_v2_store",
hl7_v2_store_id="your-hl7-v2-store-id",
role="roles/editor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/healthcare"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := healthcare.NewHl7StoreIamBinding(ctx, "hl7_v2_store", &healthcare.Hl7StoreIamBindingArgs{
Hl7V2StoreId: pulumi.String("your-hl7-v2-store-id"),
Role: pulumi.String("roles/editor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var hl7V2Store = new Gcp.Healthcare.Hl7StoreIamBinding("hl7_v2_store", new()
{
Hl7V2StoreId = "your-hl7-v2-store-id",
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.healthcare.Hl7StoreIamBinding;
import com.pulumi.gcp.healthcare.Hl7StoreIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var hl7V2Store = new Hl7StoreIamBinding("hl7V2Store", Hl7StoreIamBindingArgs.builder()
.hl7V2StoreId("your-hl7-v2-store-id")
.role("roles/editor")
.members("user:jane@example.com")
.build());
}
}
resources:
hl7V2Store:
type: gcp:healthcare:Hl7StoreIamBinding
name: hl7_v2_store
properties:
hl7V2StoreId: your-hl7-v2-store-id
role: roles/editor
members:
- user:jane@example.com
The Hl7StoreIamBinding resource is authoritative for the specified role, replacing any existing members for that role while leaving other roles untouched. The members property takes an array of identities, allowing you to manage multiple users, service accounts, or groups in a single resource. This differs from Hl7StoreIamMember, which adds one member without affecting others.
Beyond these examples
These snippets focus on specific IAM management features: single-member grants (IamMember) and role-level member management (IamBinding). They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as HL7v2 stores within Healthcare datasets. They focus on granting access rather than provisioning the stores themselves.
To keep things focused, common IAM patterns are omitted, including:
- Complete policy replacement (IamPolicy resource)
- Conditional access grants (condition property)
- Custom role definitions
- Service account creation and management
These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Healthcare Hl7StoreIamMember resource reference for all available configuration options.
Let's manage GCP Healthcare HL7 Store IAM Access
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
Choose based on your needs:
gcp.healthcare.Hl7StoreIamPolicy- Authoritative control of the entire IAM policy (replaces any existing policy)gcp.healthcare.Hl7StoreIamBinding- Authoritative control of a specific role (preserves other roles)gcp.healthcare.Hl7StoreIamMember- Non-authoritative, adds a single member to a role (preserves other members)
gcp.healthcare.Hl7StoreIamPolicy cannot be used with gcp.healthcare.Hl7StoreIamBinding or gcp.healthcare.Hl7StoreIamMember as they’ll conflict. However, gcp.healthcare.Hl7StoreIamBinding and gcp.healthcare.Hl7StoreIamMember can be used together only if they don’t grant privilege to the same role.Configuration & Identity Formats
The member property accepts these formats:
allUsers- Anyone on the internetallAuthenticatedUsers- Anyone with a Google accountuser:{emailid}- Specific Google account (e.g., alice@gmail.com)serviceAccount:{emailid}- Service account (e.g., my-app@appspot.gserviceaccount.com)group:{emailid}- Google group (e.g., admins@example.com)domain:{domain}- G Suite domain (e.g., example.com)
[projects|organizations]/{parent-name}/roles/{role-name}. When importing resources with custom roles, use the full name like projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.hl7V2StoreId, member, role, and condition properties are all immutable and cannot be modified after the resource is created.