The gcp:iap/webForwardingRuleServiceIamMember:WebForwardingRuleServiceIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual members for Identity-Aware Proxy forwarding rule services without affecting other role assignments. This guide focuses on two capabilities: non-authoritative member grants and time-based access conditions.
This resource attaches to existing IAP-protected forwarding rule services. The examples are intentionally small. Combine them with your own forwarding rules and IAM role strategy.
Grant access to a single user
Most IAP access control starts by granting individual users permission to access resources behind Identity-Aware Proxy.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.WebForwardingRuleServiceIamMember("member", {
project: _default.project,
forwardingRuleServiceName: _default.name,
role: "roles/iap.httpsResourceAccessor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.WebForwardingRuleServiceIamMember("member",
project=default["project"],
forwarding_rule_service_name=default["name"],
role="roles/iap.httpsResourceAccessor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebForwardingRuleServiceIamMember(ctx, "member", &iap.WebForwardingRuleServiceIamMemberArgs{
Project: pulumi.Any(_default.Project),
ForwardingRuleServiceName: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.WebForwardingRuleServiceIamMember("member", new()
{
Project = @default.Project,
ForwardingRuleServiceName = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMember;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new WebForwardingRuleServiceIamMember("member", WebForwardingRuleServiceIamMemberArgs.builder()
.project(default_.project())
.forwardingRuleServiceName(default_.name())
.role("roles/iap.httpsResourceAccessor")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:iap:WebForwardingRuleServiceIamMember
properties:
project: ${default.project}
forwardingRuleServiceName: ${default.name}
role: roles/iap.httpsResourceAccessor
member: user:jane@example.com
The member property specifies who receives access using formats like “user:jane@example.com” for Google accounts or “serviceAccount:app@project.iam.gserviceaccount.com” for service accounts. The role property sets the permission level; “roles/iap.httpsResourceAccessor” allows HTTPS access through IAP. The forwardingRuleServiceName identifies which forwarding rule service to protect. This resource is non-authoritative, meaning it adds this member without removing others who already have the role.
Add time-limited access with IAM Conditions
Teams often need temporary access for contractors or time-bound projects without manual cleanup.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.WebForwardingRuleServiceIamMember("member", {
project: _default.project,
forwardingRuleServiceName: _default.name,
role: "roles/iap.httpsResourceAccessor",
member: "user:jane@example.com",
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.WebForwardingRuleServiceIamMember("member",
project=default["project"],
forwarding_rule_service_name=default["name"],
role="roles/iap.httpsResourceAccessor",
member="user:jane@example.com",
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebForwardingRuleServiceIamMember(ctx, "member", &iap.WebForwardingRuleServiceIamMemberArgs{
Project: pulumi.Any(_default.Project),
ForwardingRuleServiceName: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
Condition: &iap.WebForwardingRuleServiceIamMemberConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.WebForwardingRuleServiceIamMember("member", new()
{
Project = @default.Project,
ForwardingRuleServiceName = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Member = "user:jane@example.com",
Condition = new Gcp.Iap.Inputs.WebForwardingRuleServiceIamMemberConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMember;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMemberArgs;
import com.pulumi.gcp.iap.inputs.WebForwardingRuleServiceIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new WebForwardingRuleServiceIamMember("member", WebForwardingRuleServiceIamMemberArgs.builder()
.project(default_.project())
.forwardingRuleServiceName(default_.name())
.role("roles/iap.httpsResourceAccessor")
.member("user:jane@example.com")
.condition(WebForwardingRuleServiceIamMemberConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
member:
type: gcp:iap:WebForwardingRuleServiceIamMember
properties:
project: ${default.project}
forwardingRuleServiceName: ${default.name}
role: roles/iap.httpsResourceAccessor
member: user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds time-based restrictions to the role grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here, “request.time < timestamp(…)” expires access at midnight on 2020-01-01. The title and description properties document the condition’s purpose. IAM evaluates conditions on every request, automatically denying access once the timestamp passes.
Beyond these examples
These snippets focus on specific IAM member features: single-member grants and time-based access conditions. They’re intentionally minimal rather than complete access control policies.
The examples reference pre-existing infrastructure such as IAP-protected forwarding rule services and GCP projects with IAP enabled. They focus on granting access to individual members rather than managing entire policies or role bindings.
To keep things focused, common IAM patterns are omitted, including:
- Authoritative policy management (IamPolicy resource)
- Role-level member lists (IamBinding resource)
- Complex condition expressions (location, resource attributes)
- Service account and group principals
These omissions are intentional: the goal is to illustrate how member-level IAM grants are wired, not provide drop-in access control modules. See the WebForwardingRuleServiceIamMember resource reference for all available configuration options.
Let's manage GCP Identity-Aware Proxy IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.iap.WebForwardingRuleServiceIamPolicy is authoritative and replaces the entire IAM policy. gcp.iap.WebForwardingRuleServiceIamBinding is authoritative for a specific role, managing all members for that role while preserving other roles. gcp.iap.WebForwardingRuleServiceIamMember is non-authoritative, adding a single member to a role while preserving other members.gcp.iap.WebForwardingRuleServiceIamPolicy cannot be used with gcp.iap.WebForwardingRuleServiceIamBinding or gcp.iap.WebForwardingRuleServiceIamMember, as they will conflict over the policy. However, gcp.iap.WebForwardingRuleServiceIamBinding and gcp.iap.WebForwardingRuleServiceIamMember can be used together only if they don’t grant privileges to the same role.IAM Configuration
allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, or federated identities like principal://iam.googleapis.com/locations/global/workforcePools/example-contractors/subject/joe@example.com.[projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.forwardingRuleServiceName, member, role, project, and condition properties are all immutable and cannot be changed after the resource is created.IAM Conditions
condition property with title, description, and expression fields. For example, to expire access at a specific time: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".roles/iap.httpsResourceAccessor as the role for granting HTTPS resource access through Identity-Aware Proxy.