Manage GCP Identity-Aware Proxy IAM Policies

The gcp:iap/webRegionForwardingRuleServiceIamPolicy:WebRegionForwardingRuleServiceIamPolicy resource, part of the Pulumi GCP provider, manages IAM policies for Identity-Aware Proxy (IAP) protected regional forwarding rules, controlling who can access backend services. This guide focuses on four capabilities: authoritative policy replacement (IamPolicy), role-level member management (IamBinding), individual member grants (IamMember), and time-based access with IAM Conditions.

These resources reference existing regional forwarding rules configured with IAP. IamPolicy cannot be used with IamBinding or IamMember for the same resource; IamBinding and IamMember can coexist if they manage different roles. The examples are intentionally small. Combine them with your own forwarding rules and access policies.

Grant a role to multiple members with IamBinding

Teams managing access to IAP-protected regional load balancers often need to grant the same role to multiple users or service accounts at once.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebRegionForwardingRuleServiceIamBinding("binding", {
    project: _default.project,
    region: _default.region,
    forwardingRuleRegionServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebRegionForwardingRuleServiceIamBinding("binding",
    project=default["project"],
    region=default["region"],
    forwarding_rule_region_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebRegionForwardingRuleServiceIamBinding(ctx, "binding", &iap.WebRegionForwardingRuleServiceIamBindingArgs{
			Project:                         pulumi.Any(_default.Project),
			Region:                          pulumi.Any(_default.Region),
			ForwardingRuleRegionServiceName: pulumi.Any(_default.Name),
			Role:                            pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebRegionForwardingRuleServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        ForwardingRuleRegionServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamBinding;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebRegionForwardingRuleServiceIamBinding("binding", WebRegionForwardingRuleServiceIamBindingArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .forwardingRuleRegionServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebRegionForwardingRuleServiceIamBinding
    properties:
      project: ${default.project}
      region: ${default.region}
      forwardingRuleRegionServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com

The IamBinding resource is authoritative for a specific role. The members property lists all identities that should have the role; any existing members not in this list are removed. The forwardingRuleRegionServiceName identifies which forwarding rule to manage. This approach works well when one team owns all access grants for a role.

Add time-based access with IAM Conditions

Access policies sometimes need expiration dates or time windows. IAM Conditions attach temporal or attribute-based constraints to role grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebRegionForwardingRuleServiceIamBinding("binding", {
    project: _default.project,
    region: _default.region,
    forwardingRuleRegionServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebRegionForwardingRuleServiceIamBinding("binding",
    project=default["project"],
    region=default["region"],
    forwarding_rule_region_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebRegionForwardingRuleServiceIamBinding(ctx, "binding", &iap.WebRegionForwardingRuleServiceIamBindingArgs{
			Project:                         pulumi.Any(_default.Project),
			Region:                          pulumi.Any(_default.Region),
			ForwardingRuleRegionServiceName: pulumi.Any(_default.Name),
			Role:                            pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &iap.WebRegionForwardingRuleServiceIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebRegionForwardingRuleServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        ForwardingRuleRegionServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Iap.Inputs.WebRegionForwardingRuleServiceIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamBinding;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.WebRegionForwardingRuleServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebRegionForwardingRuleServiceIamBinding("binding", WebRegionForwardingRuleServiceIamBindingArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .forwardingRuleRegionServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .condition(WebRegionForwardingRuleServiceIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebRegionForwardingRuleServiceIamBinding
    properties:
      project: ${default.project}
      region: ${default.region}
      forwardingRuleRegionServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds constraints to the role grant. The expression property uses Common Expression Language (CEL) to define when access is valid; here, it expires at midnight on 2020-01-01. The title and description provide human-readable context. IAM Conditions have some limitations documented in the GCP IAM Conditions overview.

Add individual members with IamMember

When multiple teams manage access independently, IamMember lets each team add their own users without coordinating on a shared member list.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.WebRegionForwardingRuleServiceIamMember("member", {
    project: _default.project,
    region: _default.region,
    forwardingRuleRegionServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.WebRegionForwardingRuleServiceIamMember("member",
    project=default["project"],
    region=default["region"],
    forwarding_rule_region_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebRegionForwardingRuleServiceIamMember(ctx, "member", &iap.WebRegionForwardingRuleServiceIamMemberArgs{
			Project:                         pulumi.Any(_default.Project),
			Region:                          pulumi.Any(_default.Region),
			ForwardingRuleRegionServiceName: pulumi.Any(_default.Name),
			Role:                            pulumi.String("roles/iap.httpsResourceAccessor"),
			Member:                          pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.WebRegionForwardingRuleServiceIamMember("member", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        ForwardingRuleRegionServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamMember;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WebRegionForwardingRuleServiceIamMember("member", WebRegionForwardingRuleServiceIamMemberArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .forwardingRuleRegionServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iap:WebRegionForwardingRuleServiceIamMember
    properties:
      project: ${default.project}
      region: ${default.region}
      forwardingRuleRegionServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      member: user:jane@example.com

The IamMember resource is non-authoritative. It adds a single member to a role without affecting other members. The member property specifies one identity (user, serviceAccount, group, or domain). Multiple IamMember resources can grant the same role to different members; they coexist without conflict.

Replace the entire IAM policy with IamPolicy

Some deployments require full control over the IAM policy, replacing any existing grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/iap.httpsResourceAccessor",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.iap.WebRegionForwardingRuleServiceIamPolicy("policy", {
    project: _default.project,
    region: _default.region,
    forwardingRuleRegionServiceName: _default.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/iap.httpsResourceAccessor",
    "members": ["user:jane@example.com"],
}])
policy = gcp.iap.WebRegionForwardingRuleServiceIamPolicy("policy",
    project=default["project"],
    region=default["region"],
    forwarding_rule_region_service_name=default["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/iap.httpsResourceAccessor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = iap.NewWebRegionForwardingRuleServiceIamPolicy(ctx, "policy", &iap.WebRegionForwardingRuleServiceIamPolicyArgs{
			Project:                         pulumi.Any(_default.Project),
			Region:                          pulumi.Any(_default.Region),
			ForwardingRuleRegionServiceName: pulumi.Any(_default.Name),
			PolicyData:                      pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/iap.httpsResourceAccessor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Iap.WebRegionForwardingRuleServiceIamPolicy("policy", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        ForwardingRuleRegionServiceName = @default.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamPolicy;
import com.pulumi.gcp.iap.WebRegionForwardingRuleServiceIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/iap.httpsResourceAccessor")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new WebRegionForwardingRuleServiceIamPolicy("policy", WebRegionForwardingRuleServiceIamPolicyArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .forwardingRuleRegionServiceName(default_.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:iap:WebRegionForwardingRuleServiceIamPolicy
    properties:
      project: ${default.project}
      region: ${default.region}
      forwardingRuleRegionServiceName: ${default.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/iap.httpsResourceAccessor
            members:
              - user:jane@example.com

The IamPolicy resource is authoritative for the entire policy. The policyData property comes from a gcp.organizations.getIAMPolicy data source, which defines all role bindings. Any existing bindings not in policyData are removed. This resource cannot be used alongside IamBinding or IamMember for the same forwarding rule.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management, IAM Conditions for temporal access, and role and member configuration. They’re intentionally minimal rather than full access control systems.

The examples reference pre-existing infrastructure such as regional forwarding rules protected by IAP, and GCP project and region configuration. They focus on IAM policy configuration rather than provisioning the forwarding rules themselves.

To keep things focused, common IAM patterns are omitted, including:

Custom IAM roles (examples use predefined roles/iap.httpsResourceAccessor)
Multiple role grants in a single resource
Complex condition expressions (attribute-based, resource-based)
IAM policy import and migration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the WebRegionForwardingRuleServiceIamPolicy resource reference for all available configuration options.

Let's manage GCP Identity-Aware Proxy IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resource should I use for managing access?

You have three options:

IamPolicy - Authoritative, replaces the entire IAM policy
IamBinding - Authoritative for a specific role, preserves other roles
IamMember - Non-authoritative, adds a single member without affecting others

Can I use these IAM resources together?

WebRegionForwardingRuleServiceIamPolicy cannot be used with WebRegionForwardingRuleServiceIamBinding or WebRegionForwardingRuleServiceIamMember as they will conflict. However, WebRegionForwardingRuleServiceIamBinding and WebRegionForwardingRuleServiceIamMember can be used together only if they don’t grant privileges to the same role.

Configuration & Setup

What properties can't I change after creation?

The forwardingRuleRegionServiceName, project, and region properties are immutable and cannot be changed after the resource is created.

Where does policyData come from for IamPolicy?

Use the gcp.organizations.getIAMPolicy data source to generate policyData, then pass it to the WebRegionForwardingRuleServiceIamPolicy resource.

IAM Conditions

How do I add time-based or conditional access restrictions?

Add a condition block with title, description, and expression fields. For example, use request.time < timestamp("2020-01-01T00:00:00Z") for time-based expiration. Note that IAM Conditions have known limitations documented at https://cloud.google.com/iam/docs/conditions-overview#limitations.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides