The gcp:iap/appEngineServiceIamBinding:AppEngineServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Identity-Aware Proxy protected App Engine services. This guide focuses on three capabilities: granting roles to multiple members, adding individual members to roles, and time-based access with IAM Conditions.
IAM bindings reference existing App Engine services and assume IAP is enabled on your project. The examples are intentionally small. Combine them with your own App Engine infrastructure and identity management strategy.
Grant a role to multiple members at once
When managing IAP access, you often need to grant the same role to multiple users or service accounts simultaneously.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.AppEngineServiceIamBinding("binding", {
project: version.project,
appId: version.project,
service: version.service,
role: "roles/iap.httpsResourceAccessor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.AppEngineServiceIamBinding("binding",
project=version["project"],
app_id=version["project"],
service=version["service"],
role="roles/iap.httpsResourceAccessor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewAppEngineServiceIamBinding(ctx, "binding", &iap.AppEngineServiceIamBindingArgs{
Project: pulumi.Any(version.Project),
AppId: pulumi.Any(version.Project),
Service: pulumi.Any(version.Service),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.AppEngineServiceIamBinding("binding", new()
{
Project = version.Project,
AppId = version.Project,
Service = version.Service,
Role = "roles/iap.httpsResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.AppEngineServiceIamBinding;
import com.pulumi.gcp.iap.AppEngineServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new AppEngineServiceIamBinding("binding", AppEngineServiceIamBindingArgs.builder()
.project(version.project())
.appId(version.project())
.service(version.service())
.role("roles/iap.httpsResourceAccessor")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:iap:AppEngineServiceIamBinding
properties:
project: ${version.project}
appId: ${version.project}
service: ${version.service}
role: roles/iap.httpsResourceAccessor
members:
- user:jane@example.com
The Binding resource treats the members list as authoritative for the specified role. When you update the members array, it replaces the entire list for that role. The role property specifies which IAP permission to grant; the members array lists all identities that should receive it. Each member uses a prefix format like “user:”, “serviceAccount:”, or “group:” to identify the type.
Add time-based access with IAM Conditions
Access requirements sometimes include expiration dates or time windows that IAM Conditions can enforce.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.AppEngineServiceIamBinding("binding", {
project: version.project,
appId: version.project,
service: version.service,
role: "roles/iap.httpsResourceAccessor",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.AppEngineServiceIamBinding("binding",
project=version["project"],
app_id=version["project"],
service=version["service"],
role="roles/iap.httpsResourceAccessor",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewAppEngineServiceIamBinding(ctx, "binding", &iap.AppEngineServiceIamBindingArgs{
Project: pulumi.Any(version.Project),
AppId: pulumi.Any(version.Project),
Service: pulumi.Any(version.Service),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &iap.AppEngineServiceIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.AppEngineServiceIamBinding("binding", new()
{
Project = version.Project,
AppId = version.Project,
Service = version.Service,
Role = "roles/iap.httpsResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Iap.Inputs.AppEngineServiceIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.AppEngineServiceIamBinding;
import com.pulumi.gcp.iap.AppEngineServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.AppEngineServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new AppEngineServiceIamBinding("binding", AppEngineServiceIamBindingArgs.builder()
.project(version.project())
.appId(version.project())
.service(version.service())
.role("roles/iap.httpsResourceAccessor")
.members("user:jane@example.com")
.condition(AppEngineServiceIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:iap:AppEngineServiceIamBinding
properties:
project: ${version.project}
appId: ${version.project}
service: ${version.service}
role: roles/iap.httpsResourceAccessor
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds temporal constraints to the role binding. The expression property uses CEL (Common Expression Language) to define when access is valid. Here, the timestamp comparison grants access until midnight on December 31, 2019. The title and description fields document the condition’s purpose.
Add a single member to an existing role
When you need to grant access to one additional user without affecting other members, use the Member resource.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.AppEngineServiceIamMember("member", {
project: version.project,
appId: version.project,
service: version.service,
role: "roles/iap.httpsResourceAccessor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.AppEngineServiceIamMember("member",
project=version["project"],
app_id=version["project"],
service=version["service"],
role="roles/iap.httpsResourceAccessor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewAppEngineServiceIamMember(ctx, "member", &iap.AppEngineServiceIamMemberArgs{
Project: pulumi.Any(version.Project),
AppId: pulumi.Any(version.Project),
Service: pulumi.Any(version.Service),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.AppEngineServiceIamMember("member", new()
{
Project = version.Project,
AppId = version.Project,
Service = version.Service,
Role = "roles/iap.httpsResourceAccessor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.AppEngineServiceIamMember;
import com.pulumi.gcp.iap.AppEngineServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new AppEngineServiceIamMember("member", AppEngineServiceIamMemberArgs.builder()
.project(version.project())
.appId(version.project())
.service(version.service())
.role("roles/iap.httpsResourceAccessor")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:iap:AppEngineServiceIamMember
properties:
project: ${version.project}
appId: ${version.project}
service: ${version.service}
role: roles/iap.httpsResourceAccessor
member: user:jane@example.com
Unlike Binding, the Member resource is non-authoritative. It adds one identity to a role without replacing the existing member list. The member property specifies a single identity using the same prefix format as the members array in Binding. This approach works well when different teams manage different users for the same role.
Beyond these examples
These snippets focus on specific IAM binding features: role binding with member lists, single-member grants, and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as App Engine services and a GCP project with IAP enabled. They focus on configuring IAM bindings rather than provisioning the underlying App Engine resources.
To keep things focused, common IAM patterns are omitted, including:
- Full policy replacement (AppEngineServiceIamPolicy)
- Custom role definitions and formatting
- Federated identity and workload identity pool configuration
- Conflict resolution between Policy, Binding, and Member resources
These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the AppEngineServiceIamBinding resource reference for all available configuration options.
Let's manage GCP App Engine IAP Service Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
Which IAM resource should I use for App Engine Service?
Choose based on your needs:
AppEngineServiceIamPolicy for full policy control (replaces entire policy), AppEngineServiceIamBinding for role-level management (preserves other roles), or AppEngineServiceIamMember for adding individual members (preserves other members for the role).Which IAM resources can I use together?
AppEngineServiceIamPolicy cannot be used with AppEngineServiceIamBinding or AppEngineServiceIamMember as they will conflict. However, AppEngineServiceIamBinding and AppEngineServiceIamMember can be used together only if they grant different roles.Why am I getting IAM policy conflicts?
Mixing
AppEngineServiceIamPolicy with AppEngineServiceIamBinding or AppEngineServiceIamMember causes conflicts. Use either the Policy resource (authoritative) or the Binding/Member resources (granular), not both.IAM Configuration & Roles
How do I specify custom roles?
Custom roles must use the format
[projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.Can I use only one Binding per role?
Yes, only one
AppEngineServiceIamBinding can be used per role. To add multiple members to a role, include them all in the members array of a single Binding resource.Member Identities & Conditions
What member identity formats are supported?
Supported formats include:
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, and federated identities like principal://iam.googleapis.com/....How do I add time-based access restrictions?
Use the
condition property with title, description, and expression fields. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.What are the limitations of IAM Conditions?
IAM Conditions have known limitations documented by Google Cloud. Review the limitations before using conditions in production.
Resource Properties & Immutability
What properties can't I change after creation?
The
appId, service, project, role, and condition properties are immutable. Changing any of these requires recreating the resource.