The gcp:iap/tunnelIamBinding:TunnelIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Identity-Aware Proxy tunnels, controlling which identities can access resources through IAP. This guide focuses on three capabilities: authoritative role bindings for multiple members, non-authoritative member additions, and time-based access with IAM Conditions.
IAM tunnel resources manage permissions for an existing IAP tunnel and reference GCP projects, user accounts, and service accounts. The examples are intentionally small. Combine them with your own IAP tunnel configuration and identity management.
Grant a role to multiple members at once
Teams managing tunnel access often need to grant the same role to multiple users or service accounts simultaneously.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.TunnelIamBinding("binding", {
project: projectService.project,
role: "roles/iap.tunnelResourceAccessor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.TunnelIamBinding("binding",
project=project_service["project"],
role="roles/iap.tunnelResourceAccessor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewTunnelIamBinding(ctx, "binding", &iap.TunnelIamBindingArgs{
Project: pulumi.Any(projectService.Project),
Role: pulumi.String("roles/iap.tunnelResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.TunnelIamBinding("binding", new()
{
Project = projectService.Project,
Role = "roles/iap.tunnelResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelIamBinding;
import com.pulumi.gcp.iap.TunnelIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new TunnelIamBinding("binding", TunnelIamBindingArgs.builder()
.project(projectService.project())
.role("roles/iap.tunnelResourceAccessor")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:iap:TunnelIamBinding
properties:
project: ${projectService.project}
role: roles/iap.tunnelResourceAccessor
members:
- user:jane@example.com
The TunnelIamBinding resource is authoritative for the specified role. The members array lists all identities that should have this role; any members not in this list will lose the role. The role property specifies which IAP permission to grant, typically roles/iap.tunnelResourceAccessor for tunnel access.
Add a single member to an existing role
When onboarding individual users, you need to grant access without affecting others who already have the role.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.TunnelIamMember("member", {
project: projectService.project,
role: "roles/iap.tunnelResourceAccessor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.TunnelIamMember("member",
project=project_service["project"],
role="roles/iap.tunnelResourceAccessor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewTunnelIamMember(ctx, "member", &iap.TunnelIamMemberArgs{
Project: pulumi.Any(projectService.Project),
Role: pulumi.String("roles/iap.tunnelResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.TunnelIamMember("member", new()
{
Project = projectService.Project,
Role = "roles/iap.tunnelResourceAccessor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelIamMember;
import com.pulumi.gcp.iap.TunnelIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new TunnelIamMember("member", TunnelIamMemberArgs.builder()
.project(projectService.project())
.role("roles/iap.tunnelResourceAccessor")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:iap:TunnelIamMember
properties:
project: ${projectService.project}
role: roles/iap.tunnelResourceAccessor
member: user:jane@example.com
The TunnelIamMember resource is non-authoritative. It adds one identity to a role without removing existing members. Use this when multiple teams manage access independently, or when you need to grant access incrementally. The member property takes a single identity string, while TunnelIamBinding uses a members array.
Apply time-based access with IAM Conditions
Temporary access scenarios require permissions that expire automatically without manual cleanup.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.TunnelIamBinding("binding", {
project: projectService.project,
role: "roles/iap.tunnelResourceAccessor",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.TunnelIamBinding("binding",
project=project_service["project"],
role="roles/iap.tunnelResourceAccessor",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewTunnelIamBinding(ctx, "binding", &iap.TunnelIamBindingArgs{
Project: pulumi.Any(projectService.Project),
Role: pulumi.String("roles/iap.tunnelResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &iap.TunnelIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.TunnelIamBinding("binding", new()
{
Project = projectService.Project,
Role = "roles/iap.tunnelResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Iap.Inputs.TunnelIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.TunnelIamBinding;
import com.pulumi.gcp.iap.TunnelIamBindingArgs;
import com.pulumi.gcp.iap.inputs.TunnelIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new TunnelIamBinding("binding", TunnelIamBindingArgs.builder()
.project(projectService.project())
.role("roles/iap.tunnelResourceAccessor")
.members("user:jane@example.com")
.condition(TunnelIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:iap:TunnelIamBinding
properties:
project: ${projectService.project}
role: roles/iap.tunnelResourceAccessor
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
IAM Conditions add temporal or contextual constraints to role bindings. The condition block requires a title for identification, an expression using Common Expression Language (CEL), and an optional description. The expression request.time < timestamp("2020-01-01T00:00:00Z") grants access until midnight on the specified date. Note that IAM Conditions have known limitations; review the GCP documentation if you encounter issues.
Beyond these examples
These snippets focus on specific IAM binding features: role-based access control (binding vs member resources) and IAM Conditions for time-based access. They’re intentionally minimal rather than full access management solutions.
The examples assume pre-existing infrastructure such as a GCP project with IAP tunnel configured, and user accounts, service accounts, or groups to grant access to. They focus on managing permissions rather than provisioning the tunnel itself.
To keep things focused, common IAM patterns are omitted, including:
- TunnelIamPolicy for full policy replacement
- Complex condition expressions (location, resource attributes)
- Federated identity and workload identity pool principals
- Custom role definitions and management
These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the IAP TunnelIamBinding resource reference for all available configuration options.
Let's configure GCP IAP Tunnel IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.iap.TunnelIamPolicy is fully authoritative and replaces the entire IAM policy. gcp.iap.TunnelIamBinding is authoritative for a specific role but preserves other roles. gcp.iap.TunnelIamMember is non-authoritative and preserves other members for the same role.gcp.iap.TunnelIamPolicy cannot be used with gcp.iap.TunnelIamBinding or gcp.iap.TunnelIamMember as they will conflict. However, gcp.iap.TunnelIamBinding can be used with gcp.iap.TunnelIamMember only if they manage different roles.gcp.iap.TunnelIamPolicy when you need full control over the entire policy. Use gcp.iap.TunnelIamBinding to manage all members for a specific role. Use gcp.iap.TunnelIamMember to add individual members without affecting existing ones.IAM Configuration & Permissions
user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, federated identities (e.g., principal://iam.googleapis.com/...), and special identifiers allUsers and allAuthenticatedUsers.[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/customRole or organizations/my-org/roles/customRole.role, project, and condition properties are immutable and cannot be modified after the resource is created.Advanced Features & Limitations
condition property with title, description, and expression fields. For example, to expire access at a specific time: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".