Manage GCP Identity-Aware Proxy Tunnel IAM Policies

The gcp:iap/tunnelInstanceIAMPolicy:TunnelInstanceIAMPolicy resource, part of the Pulumi GCP provider, manages IAM policies for Identity-Aware Proxy tunnel access to Compute Engine instances. This guide focuses on four capabilities: authoritative policy replacement, role bindings for multiple members, non-authoritative member additions, and time-based access with IAM Conditions.

These resources reference existing Compute Engine instances with IAP tunnel enabled. The examples are intentionally small. Combine them with your own instance infrastructure and IAM strategy.

Set the complete IAM policy for an instance

When you need to define the entire IAM policy for tunnel access, replacing any existing permissions with a known configuration, use TunnelInstanceIAMPolicy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/iap.tunnelResourceAccessor",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.iap.TunnelInstanceIAMPolicy("policy", {
    project: tunnelvm.project,
    zone: tunnelvm.zone,
    instance: tunnelvm.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/iap.tunnelResourceAccessor",
    "members": ["user:jane@example.com"],
}])
policy = gcp.iap.TunnelInstanceIAMPolicy("policy",
    project=tunnelvm["project"],
    zone=tunnelvm["zone"],
    instance=tunnelvm["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/iap.tunnelResourceAccessor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = iap.NewTunnelInstanceIAMPolicy(ctx, "policy", &iap.TunnelInstanceIAMPolicyArgs{
			Project:    pulumi.Any(tunnelvm.Project),
			Zone:       pulumi.Any(tunnelvm.Zone),
			Instance:   pulumi.Any(tunnelvm.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/iap.tunnelResourceAccessor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Iap.TunnelInstanceIAMPolicy("policy", new()
    {
        Project = tunnelvm.Project,
        Zone = tunnelvm.Zone,
        Instance = tunnelvm.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.iap.TunnelInstanceIAMPolicy;
import com.pulumi.gcp.iap.TunnelInstanceIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/iap.tunnelResourceAccessor")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new TunnelInstanceIAMPolicy("policy", TunnelInstanceIAMPolicyArgs.builder()
            .project(tunnelvm.project())
            .zone(tunnelvm.zone())
            .instance(tunnelvm.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:iap:TunnelInstanceIAMPolicy
    properties:
      project: ${tunnelvm.project}
      zone: ${tunnelvm.zone}
      instance: ${tunnelvm.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/iap.tunnelResourceAccessor
            members:
              - user:jane@example.com

The TunnelInstanceIAMPolicy resource is authoritative: it replaces all existing IAM bindings for the instance. The policyData comes from getIAMPolicy, which constructs the policy document from bindings. The project, zone, and instance properties identify which Compute Engine instance receives the policy. This approach ensures a known permission state but conflicts with TunnelInstanceIAMBinding and TunnelInstanceIAMMember resources managing the same instance.

Apply time-based access with IAM Conditions

Organizations implementing temporary access can grant permissions that automatically expire without manual revocation.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/iap.tunnelResourceAccessor",
        members: ["user:jane@example.com"],
        condition: {
            title: "expires_after_2019_12_31",
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    }],
});
const policy = new gcp.iap.TunnelInstanceIAMPolicy("policy", {
    project: tunnelvm.project,
    zone: tunnelvm.zone,
    instance: tunnelvm.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/iap.tunnelResourceAccessor",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
}])
policy = gcp.iap.TunnelInstanceIAMPolicy("policy",
    project=tunnelvm["project"],
    zone=tunnelvm["zone"],
    instance=tunnelvm["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/iap.tunnelResourceAccessor",
					Members: []string{
						"user:jane@example.com",
					},
					Condition: {
						Title:       "expires_after_2019_12_31",
						Description: pulumi.StringRef("Expiring at midnight of 2019-12-31"),
						Expression:  "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = iap.NewTunnelInstanceIAMPolicy(ctx, "policy", &iap.TunnelInstanceIAMPolicyArgs{
			Project:    pulumi.Any(tunnelvm.Project),
			Zone:       pulumi.Any(tunnelvm.Zone),
			Instance:   pulumi.Any(tunnelvm.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/iap.tunnelResourceAccessor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "expires_after_2019_12_31",
                    Description = "Expiring at midnight of 2019-12-31",
                    Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
                },
            },
        },
    });

    var policy = new Gcp.Iap.TunnelInstanceIAMPolicy("policy", new()
    {
        Project = tunnelvm.Project,
        Zone = tunnelvm.Zone,
        Instance = tunnelvm.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.iap.TunnelInstanceIAMPolicy;
import com.pulumi.gcp.iap.TunnelInstanceIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/iap.tunnelResourceAccessor")
                .members("user:jane@example.com")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("expires_after_2019_12_31")
                    .description("Expiring at midnight of 2019-12-31")
                    .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                    .build())
                .build())
            .build());

        var policy = new TunnelInstanceIAMPolicy("policy", TunnelInstanceIAMPolicyArgs.builder()
            .project(tunnelvm.project())
            .zone(tunnelvm.zone())
            .instance(tunnelvm.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:iap:TunnelInstanceIAMPolicy
    properties:
      project: ${tunnelvm.project}
      zone: ${tunnelvm.zone}
      instance: ${tunnelvm.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/iap.tunnelResourceAccessor
            members:
              - user:jane@example.com
            condition:
              title: expires_after_2019_12_31
              description: Expiring at midnight of 2019-12-31
              expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions add a condition block to policy bindings. The expression uses CEL (Common Expression Language) to define when the binding applies; here, request.time checks against a timestamp. The title and description document the condition’s purpose. IAM Conditions have known limitations documented by Google Cloud; review those before relying on complex expressions.

Grant a role to multiple members

When multiple users or service accounts need the same level of access, binding them to a single role avoids creating individual member resources.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.TunnelInstanceIAMBinding("binding", {
    project: tunnelvm.project,
    zone: tunnelvm.zone,
    instance: tunnelvm.name,
    role: "roles/iap.tunnelResourceAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.TunnelInstanceIAMBinding("binding",
    project=tunnelvm["project"],
    zone=tunnelvm["zone"],
    instance=tunnelvm["name"],
    role="roles/iap.tunnelResourceAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewTunnelInstanceIAMBinding(ctx, "binding", &iap.TunnelInstanceIAMBindingArgs{
			Project:  pulumi.Any(tunnelvm.Project),
			Zone:     pulumi.Any(tunnelvm.Zone),
			Instance: pulumi.Any(tunnelvm.Name),
			Role:     pulumi.String("roles/iap.tunnelResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.TunnelInstanceIAMBinding("binding", new()
    {
        Project = tunnelvm.Project,
        Zone = tunnelvm.Zone,
        Instance = tunnelvm.Name,
        Role = "roles/iap.tunnelResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelInstanceIAMBinding;
import com.pulumi.gcp.iap.TunnelInstanceIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new TunnelInstanceIAMBinding("binding", TunnelInstanceIAMBindingArgs.builder()
            .project(tunnelvm.project())
            .zone(tunnelvm.zone())
            .instance(tunnelvm.name())
            .role("roles/iap.tunnelResourceAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:TunnelInstanceIAMBinding
    properties:
      project: ${tunnelvm.project}
      zone: ${tunnelvm.zone}
      instance: ${tunnelvm.name}
      role: roles/iap.tunnelResourceAccessor
      members:
        - user:jane@example.com

The TunnelInstanceIAMBinding resource is authoritative for a specific role: it replaces all members for that role while preserving other roles on the instance. The members property accepts a list of identities (users, service accounts, groups). This resource can coexist with TunnelInstanceIAMMember resources as long as they manage different roles.

Add a single member to a role

Adding individual users or service accounts to existing roles preserves other members and allows incremental permission grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.TunnelInstanceIAMMember("member", {
    project: tunnelvm.project,
    zone: tunnelvm.zone,
    instance: tunnelvm.name,
    role: "roles/iap.tunnelResourceAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.TunnelInstanceIAMMember("member",
    project=tunnelvm["project"],
    zone=tunnelvm["zone"],
    instance=tunnelvm["name"],
    role="roles/iap.tunnelResourceAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewTunnelInstanceIAMMember(ctx, "member", &iap.TunnelInstanceIAMMemberArgs{
			Project:  pulumi.Any(tunnelvm.Project),
			Zone:     pulumi.Any(tunnelvm.Zone),
			Instance: pulumi.Any(tunnelvm.Name),
			Role:     pulumi.String("roles/iap.tunnelResourceAccessor"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.TunnelInstanceIAMMember("member", new()
    {
        Project = tunnelvm.Project,
        Zone = tunnelvm.Zone,
        Instance = tunnelvm.Name,
        Role = "roles/iap.tunnelResourceAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelInstanceIAMMember;
import com.pulumi.gcp.iap.TunnelInstanceIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new TunnelInstanceIAMMember("member", TunnelInstanceIAMMemberArgs.builder()
            .project(tunnelvm.project())
            .zone(tunnelvm.zone())
            .instance(tunnelvm.name())
            .role("roles/iap.tunnelResourceAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iap:TunnelInstanceIAMMember
    properties:
      project: ${tunnelvm.project}
      zone: ${tunnelvm.zone}
      instance: ${tunnelvm.name}
      role: roles/iap.tunnelResourceAccessor
      member: user:jane@example.com

The TunnelInstanceIAMMember resource is non-authoritative: it adds one member to a role without affecting other members for that role. The member property specifies a single identity. Use this when you need to grant access incrementally or when multiple teams manage permissions for the same instance.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management and IAM Conditions for time-based access. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Compute Engine instances with IAP tunnel enabled, and GCP project, zone, and instance identifiers. They focus on configuring IAM policies rather than provisioning the underlying compute resources.

To keep things focused, common IAM patterns are omitted, including:

  • IAM Conditions with attribute-based logic (beyond time)
  • Custom role definitions and management
  • Audit logging configuration for IAM changes
  • Service account impersonation patterns

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the IAP TunnelInstance IAM Policy resource reference for all available configuration options.

Let's manage GCP Identity-Aware Proxy Tunnel IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
Which IAM resource should I use for managing tunnel instance access?
Choose based on your needs: gcp.iap.TunnelInstanceIAMPolicy for complete policy control (replaces entire policy), gcp.iap.TunnelInstanceIAMBinding for managing all members of a specific role (preserves other roles), or gcp.iap.TunnelInstanceIAMMember for adding individual members without affecting others (non-authoritative).
Can I use TunnelInstanceIAMPolicy with TunnelInstanceIAMBinding or TunnelInstanceIAMMember?
No, gcp.iap.TunnelInstanceIAMPolicy cannot be used with gcp.iap.TunnelInstanceIAMBinding or gcp.iap.TunnelInstanceIAMMember as they will conflict over policy state. However, you can use TunnelInstanceIAMBinding and TunnelInstanceIAMMember together if they manage different roles.
Configuration & Properties
What properties are required for TunnelInstanceIAMPolicy?
You must provide instance (the instance name), policyData (from gcp.organizations.getIAMPolicy), project (project ID), and zone (instance zone).
What properties can't I change after creating the IAM policy?
The instance, project, and zone properties are immutable and cannot be changed after creation.
Where does the policyData come from?
The policyData is generated by the gcp.organizations.getIAMPolicy data source, which you configure with bindings for roles and members.
IAM Conditions
Can I use IAM Conditions with tunnel instance policies?
Yes, all three IAM resources support IAM Conditions. Add a condition block with title, description, and expression fields. Note that IAM Conditions have known limitations you should review in the GCP documentation.
Import & Migration
How do I import existing tunnel instance IAM policies?
Use one of five supported formats: projects/{{project}}/iap_tunnel/zones/{{zone}}/instances/{{name}}, projects/{{project}}/zones/{{zone}}/instances/{{name}}, {{project}}/{{zone}}/{{name}}, {{zone}}/{{name}}, or just {{name}}. For IAM member imports, add the role and member identity; for bindings, add the role.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides