Manage GCP Identity-Aware Proxy IAM Permissions

The gcp:iap/webBackendServiceIamMember:WebBackendServiceIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual identities for IAP-protected backend services without affecting other role members. This guide focuses on three capabilities: single-user role grants, time-limited access with conditions, and multi-user role management with bindings.

IAM for IAP backend services comes in three flavors: Member (non-authoritative, adds one identity), Binding (authoritative for a role, manages all identities), and Policy (authoritative for all roles). Member is the safest choice when multiple teams manage access independently. The examples reference existing backend services and assume IAP is already configured. Combine them with your own backend service references and identity management.

Grant access to a single user

Most deployments start by granting individual users access to backend services without disrupting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.WebBackendServiceIamMember("member", {
    project: _default.project,
    webBackendService: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.WebBackendServiceIamMember("member",
    project=default["project"],
    web_backend_service=default["name"],
    role="roles/iap.httpsResourceAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebBackendServiceIamMember(ctx, "member", &iap.WebBackendServiceIamMemberArgs{
			Project:           pulumi.Any(_default.Project),
			WebBackendService: pulumi.Any(_default.Name),
			Role:              pulumi.String("roles/iap.httpsResourceAccessor"),
			Member:            pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.WebBackendServiceIamMember("member", new()
    {
        Project = @default.Project,
        WebBackendService = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamMember;
import com.pulumi.gcp.iap.WebBackendServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WebBackendServiceIamMember("member", WebBackendServiceIamMemberArgs.builder()
            .project(default_.project())
            .webBackendService(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iap:WebBackendServiceIamMember
    properties:
      project: ${default.project}
      webBackendService: ${default.name}
      role: roles/iap.httpsResourceAccessor
      member: user:jane@example.com

The member property specifies the identity (user, service account, group, or domain). The role property sets the permission level; roles/iap.httpsResourceAccessor allows HTTPS access through IAP. The webBackendService property identifies which backend service to protect. This resource is non-authoritative: it adds the member without removing others who already have the role.

Grant time-limited access with conditions

Teams often need temporary access for contractors or time-bound projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.WebBackendServiceIamMember("member", {
    project: _default.project,
    webBackendService: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.WebBackendServiceIamMember("member",
    project=default["project"],
    web_backend_service=default["name"],
    role="roles/iap.httpsResourceAccessor",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebBackendServiceIamMember(ctx, "member", &iap.WebBackendServiceIamMemberArgs{
			Project:           pulumi.Any(_default.Project),
			WebBackendService: pulumi.Any(_default.Name),
			Role:              pulumi.String("roles/iap.httpsResourceAccessor"),
			Member:            pulumi.String("user:jane@example.com"),
			Condition: &iap.WebBackendServiceIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.WebBackendServiceIamMember("member", new()
    {
        Project = @default.Project,
        WebBackendService = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Member = "user:jane@example.com",
        Condition = new Gcp.Iap.Inputs.WebBackendServiceIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamMember;
import com.pulumi.gcp.iap.WebBackendServiceIamMemberArgs;
import com.pulumi.gcp.iap.inputs.WebBackendServiceIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WebBackendServiceIamMember("member", WebBackendServiceIamMemberArgs.builder()
            .project(default_.project())
            .webBackendService(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .member("user:jane@example.com")
            .condition(WebBackendServiceIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:iap:WebBackendServiceIamMember
    properties:
      project: ${default.project}
      webBackendService: ${default.name}
      role: roles/iap.httpsResourceAccessor
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block attaches constraints to the role grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here, it expires at midnight on 2020-01-01. The title and description properties document the condition’s purpose. IAM evaluates conditions at request time, automatically revoking access when the expression returns false.

Grant a role to multiple users at once

When multiple users need the same access level, Binding resources manage them as a group.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebBackendServiceIamBinding("binding", {
    project: _default.project,
    webBackendService: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebBackendServiceIamBinding("binding",
    project=default["project"],
    web_backend_service=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebBackendServiceIamBinding(ctx, "binding", &iap.WebBackendServiceIamBindingArgs{
			Project:           pulumi.Any(_default.Project),
			WebBackendService: pulumi.Any(_default.Name),
			Role:              pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebBackendServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        WebBackendService = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamBinding;
import com.pulumi.gcp.iap.WebBackendServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebBackendServiceIamBinding("binding", WebBackendServiceIamBindingArgs.builder()
            .project(default_.project())
            .webBackendService(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebBackendServiceIamBinding
    properties:
      project: ${default.project}
      webBackendService: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com

The WebBackendServiceIamBinding resource is authoritative for the specified role: it sets the complete list of members who have that role. The members property takes an array of identities. Unlike Member, Binding replaces all existing members for the role, so use it when you want centralized control over who has access. You can combine Binding and Member resources as long as they manage different roles.

Beyond these examples

These snippets focus on specific IAM grant features: individual and group member grants, and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as IAP-protected backend services and a GCP project with IAP enabled. They focus on granting access rather than provisioning the backend services themselves.

To keep things focused, common IAM patterns are omitted, including:

Full policy replacement (WebBackendServiceIamPolicy)
Complex condition expressions (multiple constraints)
Service account and group identities
Federated identity and workload identity pool principals

These omissions are intentional: the goal is to illustrate how each IAM grant type is wired, not provide drop-in access control modules. See the WebBackendServiceIamMember resource reference for all available configuration options.

Let's manage GCP Identity-Aware Proxy IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between WebBackendServiceIamPolicy, IamBinding, and IamMember?

WebBackendServiceIamPolicy is authoritative and replaces the entire IAM policy. WebBackendServiceIamBinding is authoritative for a single role, managing all members for that role while preserving other roles. WebBackendServiceIamMember is non-authoritative, adding a single member to a role without affecting other members.

Which IAM resources can I use together?

You cannot use WebBackendServiceIamPolicy with WebBackendServiceIamBinding or WebBackendServiceIamMember as they will conflict. You can use WebBackendServiceIamBinding with WebBackendServiceIamMember only if they manage different roles.

IAM Configuration

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

How do I specify a custom IAM role?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.

Can I use IAM Conditions for time-based access?

Yes, add a condition block with title, description, and expression (e.g., request.time < timestamp("2020-01-01T00:00:00Z")). Note that IAM Conditions have known limitations you should review.

Usage & Configuration

How do I grant IAP access to a specific user?

Create a WebBackendServiceIamMember with role set to roles/iap.httpsResourceAccessor and member set to user:jane@example.com.

What properties are immutable after creation?

All input properties are immutable: member, role, webBackendService, project, and condition. Changes require resource replacement.

How do I import an existing IAM member binding?

Use space-delimited identifiers:

pulumi import gcp:iap/webBackendServiceIamMember:WebBackendServiceIamMember editor "projects/{{project}}/iap_web/compute/services/{{web_backend_service}} roles/iap.httpsResourceAccessor user:jane@example.com"

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides