The gcp:iap/tunnelDestGroupIamPolicy:TunnelDestGroupIamPolicy resource, part of the Pulumi GCP provider, manages IAM permissions for Identity-Aware Proxy tunnel destination groups, controlling who can access resources through IAP tunnels. This guide focuses on three capabilities: role-based access with Binding, incremental member addition, and time-based access with IAM Conditions.
These IAM resources reference existing tunnel destination groups and require the group name, project, and region. The examples are intentionally small. Combine them with your own IAP tunnel infrastructure and access policies.
Grant a role to multiple members with Binding
Teams managing IAP tunnel access often need to grant the same role to multiple users at once while preserving other roles already assigned to the destination group.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.TunnelDestGroupIamBinding("binding", {
project: destGroup.project,
region: destGroup.region,
destGroup: destGroup.groupName,
role: "roles/iap.tunnelResourceAccessor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.TunnelDestGroupIamBinding("binding",
project=dest_group["project"],
region=dest_group["region"],
dest_group=dest_group["groupName"],
role="roles/iap.tunnelResourceAccessor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewTunnelDestGroupIamBinding(ctx, "binding", &iap.TunnelDestGroupIamBindingArgs{
Project: pulumi.Any(destGroup.Project),
Region: pulumi.Any(destGroup.Region),
DestGroup: pulumi.Any(destGroup.GroupName),
Role: pulumi.String("roles/iap.tunnelResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.TunnelDestGroupIamBinding("binding", new()
{
Project = destGroup.Project,
Region = destGroup.Region,
DestGroup = destGroup.GroupName,
Role = "roles/iap.tunnelResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelDestGroupIamBinding;
import com.pulumi.gcp.iap.TunnelDestGroupIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new TunnelDestGroupIamBinding("binding", TunnelDestGroupIamBindingArgs.builder()
.project(destGroup.project())
.region(destGroup.region())
.destGroup(destGroup.groupName())
.role("roles/iap.tunnelResourceAccessor")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:iap:TunnelDestGroupIamBinding
properties:
project: ${destGroup.project}
region: ${destGroup.region}
destGroup: ${destGroup.groupName}
role: roles/iap.tunnelResourceAccessor
members:
- user:jane@example.com
The TunnelDestGroupIamBinding resource is authoritative for a specific role, meaning it replaces all members for that role but leaves other roles untouched. The members property accepts a list of identities (users, service accounts, groups). The destGroup, project, and region properties identify which tunnel destination group receives the permissions.
Add a single member to a role with Member
When you need to grant access to one additional user without affecting existing members, the non-authoritative Member resource adds the new member while preserving all other role assignments.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.TunnelDestGroupIamMember("member", {
project: destGroup.project,
region: destGroup.region,
destGroup: destGroup.groupName,
role: "roles/iap.tunnelResourceAccessor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.TunnelDestGroupIamMember("member",
project=dest_group["project"],
region=dest_group["region"],
dest_group=dest_group["groupName"],
role="roles/iap.tunnelResourceAccessor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewTunnelDestGroupIamMember(ctx, "member", &iap.TunnelDestGroupIamMemberArgs{
Project: pulumi.Any(destGroup.Project),
Region: pulumi.Any(destGroup.Region),
DestGroup: pulumi.Any(destGroup.GroupName),
Role: pulumi.String("roles/iap.tunnelResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.TunnelDestGroupIamMember("member", new()
{
Project = destGroup.Project,
Region = destGroup.Region,
DestGroup = destGroup.GroupName,
Role = "roles/iap.tunnelResourceAccessor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelDestGroupIamMember;
import com.pulumi.gcp.iap.TunnelDestGroupIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new TunnelDestGroupIamMember("member", TunnelDestGroupIamMemberArgs.builder()
.project(destGroup.project())
.region(destGroup.region())
.destGroup(destGroup.groupName())
.role("roles/iap.tunnelResourceAccessor")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:iap:TunnelDestGroupIamMember
properties:
project: ${destGroup.project}
region: ${destGroup.region}
destGroup: ${destGroup.groupName}
role: roles/iap.tunnelResourceAccessor
member: user:jane@example.com
The TunnelDestGroupIamMember resource adds a single member to a role without replacing existing members. Use member (singular) instead of members (plural) to specify one identity. This resource can coexist with other Member resources for the same role, and with Binding resources for different roles.
Apply time-based access with IAM Conditions
Temporary access grants require IAM Conditions to automatically expire permissions at a specific time, reducing manual cleanup.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.TunnelDestGroupIamBinding("binding", {
project: destGroup.project,
region: destGroup.region,
destGroup: destGroup.groupName,
role: "roles/iap.tunnelResourceAccessor",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.TunnelDestGroupIamBinding("binding",
project=dest_group["project"],
region=dest_group["region"],
dest_group=dest_group["groupName"],
role="roles/iap.tunnelResourceAccessor",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewTunnelDestGroupIamBinding(ctx, "binding", &iap.TunnelDestGroupIamBindingArgs{
Project: pulumi.Any(destGroup.Project),
Region: pulumi.Any(destGroup.Region),
DestGroup: pulumi.Any(destGroup.GroupName),
Role: pulumi.String("roles/iap.tunnelResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &iap.TunnelDestGroupIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.TunnelDestGroupIamBinding("binding", new()
{
Project = destGroup.Project,
Region = destGroup.Region,
DestGroup = destGroup.GroupName,
Role = "roles/iap.tunnelResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Iap.Inputs.TunnelDestGroupIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelDestGroupIamBinding;
import com.pulumi.gcp.iap.TunnelDestGroupIamBindingArgs;
import com.pulumi.gcp.iap.inputs.TunnelDestGroupIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new TunnelDestGroupIamBinding("binding", TunnelDestGroupIamBindingArgs.builder()
.project(destGroup.project())
.region(destGroup.region())
.destGroup(destGroup.groupName())
.role("roles/iap.tunnelResourceAccessor")
.members("user:jane@example.com")
.condition(TunnelDestGroupIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:iap:TunnelDestGroupIamBinding
properties:
project: ${destGroup.project}
region: ${destGroup.region}
destGroup: ${destGroup.groupName}
role: roles/iap.tunnelResourceAccessor
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
IAM Conditions add temporal or attribute-based constraints to role assignments. The condition block requires a title, optional description, and an expression using Common Expression Language (CEL). The expression request.time < timestamp("2020-01-01T00:00:00Z") grants access until midnight on December 31, 2019. Conditions work with both Binding and Member resources.
Beyond these examples
These snippets focus on specific IAM management features: role-based access control (Binding vs Member) and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control policies.
The examples reference pre-existing infrastructure such as IAP tunnel destination groups and GCP project and region configuration. They focus on configuring IAM permissions rather than provisioning the tunnel infrastructure itself.
To keep things focused, common IAM patterns are omitted, including:
- Full policy replacement with TunnelDestGroupIamPolicy
- Complex condition expressions (beyond time-based)
- Service account and group member types
- Multiple condition combinations
These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the IAP TunnelDestGroup IAM Policy resource reference for all available configuration options.
Let's manage GCP Identity-Aware Proxy Tunnel Destination Group IAM Policies
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.iap.TunnelDestGroupIamPolicy is authoritative and replaces the entire IAM policy. gcp.iap.TunnelDestGroupIamBinding is authoritative for a specific role, preserving other roles. gcp.iap.TunnelDestGroupIamMember is non-authoritative, adding individual members without affecting others.gcp.iap.TunnelDestGroupIamPolicy with gcp.iap.TunnelDestGroupIamBinding or gcp.iap.TunnelDestGroupIamMember, as they will conflict. You can use gcp.iap.TunnelDestGroupIamBinding and gcp.iap.TunnelDestGroupIamMember together only if they manage different roles.IAM Conditions
condition block with title, description, and expression fields. However, IAM Conditions have known limitations; review the GCP documentation if you encounter issues.Configuration & Properties
destGroup, project, and region properties are immutable and cannot be changed after resource creation.gcp.organizations.getIAMPolicy data source to generate policyData, then pass it to the policyData property.