The gcp:iap/webBackendServiceIamBinding:WebBackendServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Identity-Aware Proxy backend services, controlling which identities can access IAP-protected resources. This guide focuses on three capabilities: authoritative role bindings with multiple members, time-based access with IAM Conditions, and non-authoritative member additions.
IAM bindings reference existing IAP-protected backend services and require a GCP project with IAP enabled. The examples are intentionally small. Combine them with your own backend service infrastructure and identity management workflows.
Grant a role to multiple members at once
Teams managing IAP-protected backend services often need to grant the same access level to multiple users or service accounts simultaneously, such as when onboarding a team or configuring service-to-service authentication.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.WebBackendServiceIamBinding("binding", {
project: _default.project,
webBackendService: _default.name,
role: "roles/iap.httpsResourceAccessor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.WebBackendServiceIamBinding("binding",
project=default["project"],
web_backend_service=default["name"],
role="roles/iap.httpsResourceAccessor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebBackendServiceIamBinding(ctx, "binding", &iap.WebBackendServiceIamBindingArgs{
Project: pulumi.Any(_default.Project),
WebBackendService: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.WebBackendServiceIamBinding("binding", new()
{
Project = @default.Project,
WebBackendService = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamBinding;
import com.pulumi.gcp.iap.WebBackendServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new WebBackendServiceIamBinding("binding", WebBackendServiceIamBindingArgs.builder()
.project(default_.project())
.webBackendService(default_.name())
.role("roles/iap.httpsResourceAccessor")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:iap:WebBackendServiceIamBinding
properties:
project: ${default.project}
webBackendService: ${default.name}
role: roles/iap.httpsResourceAccessor
members:
- user:jane@example.com
The Binding resource is authoritative for the specified role: it replaces all members for that role on the backend service. The members array accepts various identity formats including user emails, service accounts, groups, and special identifiers like allAuthenticatedUsers. The webBackendService property identifies which backend service receives the binding.
Apply time-based access with IAM Conditions
Temporary access grants are common for contractors, auditors, or time-limited projects. IAM Conditions let you attach expiration dates or other constraints to role bindings.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.WebBackendServiceIamBinding("binding", {
project: _default.project,
webBackendService: _default.name,
role: "roles/iap.httpsResourceAccessor",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.WebBackendServiceIamBinding("binding",
project=default["project"],
web_backend_service=default["name"],
role="roles/iap.httpsResourceAccessor",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebBackendServiceIamBinding(ctx, "binding", &iap.WebBackendServiceIamBindingArgs{
Project: pulumi.Any(_default.Project),
WebBackendService: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &iap.WebBackendServiceIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.WebBackendServiceIamBinding("binding", new()
{
Project = @default.Project,
WebBackendService = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Iap.Inputs.WebBackendServiceIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamBinding;
import com.pulumi.gcp.iap.WebBackendServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.WebBackendServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new WebBackendServiceIamBinding("binding", WebBackendServiceIamBindingArgs.builder()
.project(default_.project())
.webBackendService(default_.name())
.role("roles/iap.httpsResourceAccessor")
.members("user:jane@example.com")
.condition(WebBackendServiceIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:iap:WebBackendServiceIamBinding
properties:
project: ${default.project}
webBackendService: ${default.name}
role: roles/iap.httpsResourceAccessor
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds a CEL expression that GCP evaluates at access time. The expression compares request.time against a timestamp, automatically revoking access after the specified date. The title and description fields help identify the condition’s purpose in audit logs and the console.
Add a single member to an existing role
When you need to grant access to one additional user without affecting other members already assigned to the role, the Member resource provides non-authoritative updates.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.WebBackendServiceIamMember("member", {
project: _default.project,
webBackendService: _default.name,
role: "roles/iap.httpsResourceAccessor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.WebBackendServiceIamMember("member",
project=default["project"],
web_backend_service=default["name"],
role="roles/iap.httpsResourceAccessor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebBackendServiceIamMember(ctx, "member", &iap.WebBackendServiceIamMemberArgs{
Project: pulumi.Any(_default.Project),
WebBackendService: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.WebBackendServiceIamMember("member", new()
{
Project = @default.Project,
WebBackendService = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebBackendServiceIamMember;
import com.pulumi.gcp.iap.WebBackendServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new WebBackendServiceIamMember("member", WebBackendServiceIamMemberArgs.builder()
.project(default_.project())
.webBackendService(default_.name())
.role("roles/iap.httpsResourceAccessor")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:iap:WebBackendServiceIamMember
properties:
project: ${default.project}
webBackendService: ${default.name}
role: roles/iap.httpsResourceAccessor
member: user:jane@example.com
Unlike Binding, the Member resource adds a single identity without replacing existing members for the role. This is useful when multiple teams manage access independently. The member property accepts the same identity formats as the members array in Binding resources.
Beyond these examples
These snippets focus on specific IAM binding features: role binding with multiple members, time-based access with IAM Conditions, and non-authoritative member grants. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as IAP-protected backend services and a GCP project with IAP enabled. They focus on configuring access bindings rather than provisioning the underlying services.
To keep things focused, common IAM patterns are omitted, including:
- Full policy replacement (WebBackendServiceIamPolicy)
- Policy data retrieval (data source usage)
- Custom role formatting and validation
- Federated identity configuration
These omissions are intentional: the goal is to illustrate how each binding type is wired, not provide drop-in access control modules. See the WebBackendServiceIamBinding resource reference for all available configuration options.
Let's manage GCP Identity-Aware Proxy IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Conflicts & Compatibility
gcp.iap.WebBackendServiceIamPolicy cannot be used with gcp.iap.WebBackendServiceIamBinding or gcp.iap.WebBackendServiceIamMember because they will conflict over policy management.WebBackendServiceIamPolicy is authoritative and replaces the entire policy. WebBackendServiceIamBinding is authoritative for a specific role, preserving other roles. WebBackendServiceIamMember is non-authoritative, adding individual members without affecting other members for the same role.IAM Roles & Configuration
[projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/customRole or organizations/my-org/roles/customRole.role, webBackendService, condition, and project properties are immutable and require resource recreation if changed.Member Identities
You can use:
- Users:
user:alice@gmail.com - Service accounts:
serviceAccount:my-app@appspot.gserviceaccount.com - Groups:
group:admins@example.com - Domains:
domain:example.com - Special identifiers:
allUsers,allAuthenticatedUsers - Project roles:
projectOwner:my-project,projectEditor:my-project,projectViewer:my-project - Federated identities:
principal://iam.googleapis.com/locations/global/workforcePools/example-contractors/subject/joe@example.com
IAM Conditions
condition property with title, description, and expression. For example, to expire access at midnight on 2020-01-01: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".