Manage GCP Identity-Aware Proxy IAM Bindings

The gcp:iap/webBackendServiceIamBinding:WebBackendServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Identity-Aware Proxy backend services, controlling which identities can access IAP-protected resources. This guide focuses on three capabilities: authoritative role bindings for multiple members, time-based access with IAM Conditions, and incremental member addition.

IAM bindings reference existing IAP-enabled backend services and GCP projects. The examples are intentionally small. Combine them with your own backend service configuration and identity management strategy.

Grant a role to multiple members at once

Teams managing IAP-protected services often need to grant the same access level to multiple users or service accounts simultaneously, such as when onboarding a team or configuring service-to-service authentication.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebBackendServiceIamBinding("binding", {
    project: _default.project,
    webBackendService: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebBackendServiceIamBinding("binding",
    project=default["project"],
    web_backend_service=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebBackendServiceIamBinding(ctx, "binding", &iap.WebBackendServiceIamBindingArgs{
			Project:           pulumi.Any(_default.Project),
			WebBackendService: pulumi.Any(_default.Name),
			Role:              pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebBackendServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        WebBackendService = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamBinding;
import com.pulumi.gcp.iap.WebBackendServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebBackendServiceIamBinding("binding", WebBackendServiceIamBindingArgs.builder()
            .project(default_.project())
            .webBackendService(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebBackendServiceIamBinding
    properties:
      project: ${default.project}
      webBackendService: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com

The Binding resource is authoritative for the specified role: it replaces all members for that role on the backend service. The members array accepts various identity formats including user emails, service accounts, groups, and special identifiers like allAuthenticatedUsers. The role property specifies which IAP permission to grant; roles/iap.httpsResourceAccessor allows HTTPS access to the protected resource.

Add time-based access with IAM Conditions

Temporary access grants are common for contractors, auditors, or time-limited projects. IAM Conditions attach expiration dates or other constraints to role bindings.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebBackendServiceIamBinding("binding", {
    project: _default.project,
    webBackendService: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebBackendServiceIamBinding("binding",
    project=default["project"],
    web_backend_service=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebBackendServiceIamBinding(ctx, "binding", &iap.WebBackendServiceIamBindingArgs{
			Project:           pulumi.Any(_default.Project),
			WebBackendService: pulumi.Any(_default.Name),
			Role:              pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &iap.WebBackendServiceIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebBackendServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        WebBackendService = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Iap.Inputs.WebBackendServiceIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamBinding;
import com.pulumi.gcp.iap.WebBackendServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.WebBackendServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebBackendServiceIamBinding("binding", WebBackendServiceIamBindingArgs.builder()
            .project(default_.project())
            .webBackendService(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .condition(WebBackendServiceIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebBackendServiceIamBinding
    properties:
      project: ${default.project}
      webBackendService: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds a CEL expression that GCP evaluates on each access attempt. The expression compares request.time against a timestamp, automatically revoking access after the specified date. The title and description fields help identify the condition’s purpose in audit logs and the console. This extends the basic binding pattern with temporal constraints.

Add a single member to an existing role

When you need to grant access to one additional user without affecting other members already assigned to the role, the Member resource provides non-authoritative updates.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.WebBackendServiceIamMember("member", {
    project: _default.project,
    webBackendService: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.WebBackendServiceIamMember("member",
    project=default["project"],
    web_backend_service=default["name"],
    role="roles/iap.httpsResourceAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebBackendServiceIamMember(ctx, "member", &iap.WebBackendServiceIamMemberArgs{
			Project:           pulumi.Any(_default.Project),
			WebBackendService: pulumi.Any(_default.Name),
			Role:              pulumi.String("roles/iap.httpsResourceAccessor"),
			Member:            pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.WebBackendServiceIamMember("member", new()
    {
        Project = @default.Project,
        WebBackendService = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamMember;
import com.pulumi.gcp.iap.WebBackendServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WebBackendServiceIamMember("member", WebBackendServiceIamMemberArgs.builder()
            .project(default_.project())
            .webBackendService(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iap:WebBackendServiceIamMember
    properties:
      project: ${default.project}
      webBackendService: ${default.name}
      role: roles/iap.httpsResourceAccessor
      member: user:jane@example.com

Unlike Binding, the Member resource is non-authoritative: it adds one identity to the role without replacing existing members. Use this when multiple teams manage access independently, or when you need to grant access incrementally. The member property accepts a single identity in the same formats as the members array in Binding.

Beyond these examples

These snippets focus on specific IAM binding features: role binding with multiple members, time-based access with IAM Conditions, and incremental member addition. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as IAP-protected backend services and GCP projects with IAP enabled. They focus on configuring access bindings rather than provisioning the underlying services.

To keep things focused, common IAM patterns are omitted, including:

Full policy replacement (WebBackendServiceIamPolicy)
Policy data retrieval and auditing
Custom role definitions and formatting
Federated identity and workload identity pool configuration

These omissions are intentional: the goal is to illustrate how each binding approach is wired, not provide drop-in access control modules. See the WebBackendServiceIamBinding resource reference for all available configuration options.

Let's manage GCP Identity-Aware Proxy IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

What's the difference between Policy, Binding, and Member resources?

WebBackendServiceIamPolicy is authoritative and replaces the entire IAM policy. WebBackendServiceIamBinding is authoritative for a single role, preserving other roles. WebBackendServiceIamMember is non-authoritative, adding individual members without affecting other members for the same role.

Can I use Policy with Binding or Member resources?

No, WebBackendServiceIamPolicy cannot be used with WebBackendServiceIamBinding or WebBackendServiceIamMember because they will conflict over policy state.

Can I use Binding and Member resources together?

Yes, but only if they grant different roles. Using both for the same role causes conflicts.

IAM Configuration & Roles

How do I specify a custom IAM role?

Custom roles must follow the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/customRole.

Can I use multiple Bindings for the same role?

No, only one WebBackendServiceIamBinding can be used per role.

What properties can't I change after creation?

The role, webBackendService, project, and condition properties are immutable and require resource replacement if changed.

Member Identities & Formats

What member identity formats are supported?

You can specify users (user:email@example.com), service accounts (serviceAccount:email@project.iam.gserviceaccount.com), groups (group:admins@example.com), domains (domain:example.com), special identifiers (allUsers, allAuthenticatedUsers), project roles (projectOwner:project-id), and federated identities.

IAM Conditions & Limitations

Does this resource support IAM Conditions?

Yes, but IAM Conditions have known limitations. Review GCP’s IAM Conditions documentation before using the condition property.

How do I add time-based access expiration?

Use the condition property with a time expression, for example: condition: { title: "expires_after_2019_12_31", expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" }.

Can I modify a condition after creation?

No, the condition property is immutable and requires replacing the resource to change.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides