Manage GCP Identity-Aware Proxy IAM Bindings

The gcp:iap/webForwardingRuleServiceIamBinding:WebForwardingRuleServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Identity-Aware Proxy forwarding rule services, controlling which identities can access IAP-protected load balancers. This guide focuses on three capabilities: granting roles to multiple members, adding single members non-authoritatively, and time-based access with IAM Conditions.

IAM bindings reference existing IAP-protected forwarding rule services and require a configured GCP project. The examples are intentionally small. Combine them with your own forwarding rules and identity management strategy.

Grant a role to multiple members with Binding

Teams managing IAP-protected load balancers often need to grant the same role to multiple users or service accounts at once.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebForwardingRuleServiceIamBinding("binding", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebForwardingRuleServiceIamBinding("binding",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebForwardingRuleServiceIamBinding(ctx, "binding", &iap.WebForwardingRuleServiceIamBindingArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			Role:                      pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebForwardingRuleServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBinding;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebForwardingRuleServiceIamBinding("binding", WebForwardingRuleServiceIamBindingArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebForwardingRuleServiceIamBinding
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com

The Binding resource is authoritative for a single role: it replaces all members for that role. The members array accepts user accounts, service accounts, groups, and special identifiers like allAuthenticatedUsers. The forwardingRuleServiceName identifies which IAP-protected service receives the binding.

Add time-based access with IAM Conditions

Access grants sometimes need expiration dates for temporary contractors or time-limited projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebForwardingRuleServiceIamBinding("binding", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebForwardingRuleServiceIamBinding("binding",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebForwardingRuleServiceIamBinding(ctx, "binding", &iap.WebForwardingRuleServiceIamBindingArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			Role:                      pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &iap.WebForwardingRuleServiceIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebForwardingRuleServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Iap.Inputs.WebForwardingRuleServiceIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBinding;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.WebForwardingRuleServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebForwardingRuleServiceIamBinding("binding", WebForwardingRuleServiceIamBindingArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .condition(WebForwardingRuleServiceIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebForwardingRuleServiceIamBinding
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions attach temporal or attribute-based constraints to role bindings. The condition block requires a title, expression, and optional description. The expression uses Common Expression Language (CEL) to define when the binding applies. Here, the binding expires at midnight on 2020-01-01.

Add a single member to a role with Member

When you need to grant access to one additional user without affecting existing members, the Member resource adds a single identity non-authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.WebForwardingRuleServiceIamMember("member", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.WebForwardingRuleServiceIamMember("member",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebForwardingRuleServiceIamMember(ctx, "member", &iap.WebForwardingRuleServiceIamMemberArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			Role:                      pulumi.String("roles/iap.httpsResourceAccessor"),
			Member:                    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.WebForwardingRuleServiceIamMember("member", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMember;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WebForwardingRuleServiceIamMember("member", WebForwardingRuleServiceIamMemberArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iap:WebForwardingRuleServiceIamMember
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      member: user:jane@example.com

Unlike Binding, Member is non-authoritative: it adds one identity to a role without removing others. This lets multiple Member resources and Binding resources coexist, as long as they don’t grant the same role. The member property accepts the same identity formats as the members array in Binding.

Beyond these examples

These snippets focus on specific IAM binding features: role bindings for multiple members, single-member grants, and time-based access with IAM Conditions. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as IAP-protected forwarding rule services and a GCP project with IAP enabled. They focus on configuring IAM bindings rather than provisioning the underlying load balancers.

To keep things focused, common IAM patterns are omitted, including:

  • Full policy replacement (WebForwardingRuleServiceIamPolicy)
  • Policy data sources for reading existing policies
  • Custom role definitions
  • Federated identity and workload identity pool configuration

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the WebForwardingRuleServiceIamBinding resource reference for all available configuration options.

Let's manage GCP Identity-Aware Proxy IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between IamPolicy, IamBinding, and IamMember resources?
IamPolicy is authoritative and replaces the entire IAM policy. IamBinding is authoritative for a specific role, preserving other roles. IamMember is non-authoritative, adding a single member while preserving other members for the role.
Can I use IamPolicy with IamBinding or IamMember?
No, IamPolicy cannot be used with IamBinding or IamMember because they will conflict over policy state.
Can I use IamBinding and IamMember together?
Yes, but only if they grant different roles. Using both for the same role causes conflicts.
Configuration & Identity Management
What member identity formats are supported?
Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, project roles (projectOwner:projectid), and federated identities (principal://...).
What format do custom roles need?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.
Can I use only one IamBinding per role?
Yes, only one IamBinding resource can be used per role.
IAM Conditions & Advanced Features
How do I add time-based access restrictions?
Use the condition property with title, description, and expression fields. For example, set expression to request.time < timestamp(\"2020-01-01T00:00:00Z\") for expiring access.
What are the limitations of IAM Conditions?
IAM Conditions have known limitations documented by GCP. Review the limitations documentation if you encounter issues with conditions.
Immutability & Lifecycle
What properties can't I change after creation?
The forwardingRuleServiceName, role, project, and condition properties are immutable and cannot be changed after resource creation.
How do I import existing IAM bindings?
Use the format projects/{{project}}/iap_web/forwarding_rule/services/{{name}} roles/iap.httpsResourceAccessor for bindings, or add the member identity for member imports.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides