The gcp:iap/webCloudRunServiceIamBinding:WebCloudRunServiceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Cloud Run services protected by Identity-Aware Proxy. It controls which users and service accounts can access the service. This guide focuses on three capabilities: authoritative role bindings for multiple members, time-based conditional access, and non-authoritative member additions.
These resources reference existing Cloud Run services with IAP already enabled. The examples are intentionally small. Combine them with your own Cloud Run deployments and IAP configuration.
Grant a role to multiple members at once
Teams managing Cloud Run services behind IAP often need to grant the same access level to multiple users or service accounts simultaneously.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.WebCloudRunServiceIamBinding("binding", {
project: _default.project,
location: _default.location,
cloudRunServiceName: _default.name,
role: "roles/iap.httpsResourceAccessor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.WebCloudRunServiceIamBinding("binding",
project=default["project"],
location=default["location"],
cloud_run_service_name=default["name"],
role="roles/iap.httpsResourceAccessor",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebCloudRunServiceIamBinding(ctx, "binding", &iap.WebCloudRunServiceIamBindingArgs{
Project: pulumi.Any(_default.Project),
Location: pulumi.Any(_default.Location),
CloudRunServiceName: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.WebCloudRunServiceIamBinding("binding", new()
{
Project = @default.Project,
Location = @default.Location,
CloudRunServiceName = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebCloudRunServiceIamBinding;
import com.pulumi.gcp.iap.WebCloudRunServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new WebCloudRunServiceIamBinding("binding", WebCloudRunServiceIamBindingArgs.builder()
.project(default_.project())
.location(default_.location())
.cloudRunServiceName(default_.name())
.role("roles/iap.httpsResourceAccessor")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:iap:WebCloudRunServiceIamBinding
properties:
project: ${default.project}
location: ${default.location}
cloudRunServiceName: ${default.name}
role: roles/iap.httpsResourceAccessor
members:
- user:jane@example.com
The WebCloudRunServiceIamBinding resource is authoritative for the specified role: it replaces all members for that role. The members array accepts user emails, service accounts, groups, and special identifiers like allAuthenticatedUsers. The cloudRunServiceName identifies which Cloud Run service to protect.
Add time-based access with IAM Conditions
Access requirements sometimes include expiration dates, such as contractor access that should automatically revoke after a project ends.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.iap.WebCloudRunServiceIamBinding("binding", {
project: _default.project,
location: _default.location,
cloudRunServiceName: _default.name,
role: "roles/iap.httpsResourceAccessor",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.iap.WebCloudRunServiceIamBinding("binding",
project=default["project"],
location=default["location"],
cloud_run_service_name=default["name"],
role="roles/iap.httpsResourceAccessor",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebCloudRunServiceIamBinding(ctx, "binding", &iap.WebCloudRunServiceIamBindingArgs{
Project: pulumi.Any(_default.Project),
Location: pulumi.Any(_default.Location),
CloudRunServiceName: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &iap.WebCloudRunServiceIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Iap.WebCloudRunServiceIamBinding("binding", new()
{
Project = @default.Project,
Location = @default.Location,
CloudRunServiceName = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Iap.Inputs.WebCloudRunServiceIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebCloudRunServiceIamBinding;
import com.pulumi.gcp.iap.WebCloudRunServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.WebCloudRunServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new WebCloudRunServiceIamBinding("binding", WebCloudRunServiceIamBindingArgs.builder()
.project(default_.project())
.location(default_.location())
.cloudRunServiceName(default_.name())
.role("roles/iap.httpsResourceAccessor")
.members("user:jane@example.com")
.condition(WebCloudRunServiceIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:iap:WebCloudRunServiceIamBinding
properties:
project: ${default.project}
location: ${default.location}
cloudRunServiceName: ${default.name}
role: roles/iap.httpsResourceAccessor
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds temporal constraints to role bindings. The expression uses CEL (Common Expression Language) to compare request.time against a timestamp. When the condition evaluates to false, access is denied even if the role binding exists. The title and description document the condition’s purpose.
Add individual members without affecting others
When you need to grant access to one person without modifying existing permissions, the non-authoritative member resource preserves other role assignments.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.iap.WebCloudRunServiceIamMember("member", {
project: _default.project,
location: _default.location,
cloudRunServiceName: _default.name,
role: "roles/iap.httpsResourceAccessor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.iap.WebCloudRunServiceIamMember("member",
project=default["project"],
location=default["location"],
cloud_run_service_name=default["name"],
role="roles/iap.httpsResourceAccessor",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := iap.NewWebCloudRunServiceIamMember(ctx, "member", &iap.WebCloudRunServiceIamMemberArgs{
Project: pulumi.Any(_default.Project),
Location: pulumi.Any(_default.Location),
CloudRunServiceName: pulumi.Any(_default.Name),
Role: pulumi.String("roles/iap.httpsResourceAccessor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Iap.WebCloudRunServiceIamMember("member", new()
{
Project = @default.Project,
Location = @default.Location,
CloudRunServiceName = @default.Name,
Role = "roles/iap.httpsResourceAccessor",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebCloudRunServiceIamMember;
import com.pulumi.gcp.iap.WebCloudRunServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new WebCloudRunServiceIamMember("member", WebCloudRunServiceIamMemberArgs.builder()
.project(default_.project())
.location(default_.location())
.cloudRunServiceName(default_.name())
.role("roles/iap.httpsResourceAccessor")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:iap:WebCloudRunServiceIamMember
properties:
project: ${default.project}
location: ${default.location}
cloudRunServiceName: ${default.name}
role: roles/iap.httpsResourceAccessor
member: user:jane@example.com
The WebCloudRunServiceIamMember resource adds a single member to a role without replacing existing members. Use this when multiple teams manage access independently, or when you want to avoid conflicts with other IAM resources. The member property accepts the same identity formats as the members array in bindings.
Beyond these examples
These snippets focus on specific IAM binding features: role bindings for multiple members, time-based conditional access, and non-authoritative member additions. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as Cloud Run services with IAP enabled, and GCP project and location configuration. They focus on configuring IAM bindings rather than provisioning the underlying services.
To keep things focused, common IAM patterns are omitted, including:
- Full IAM policy replacement (WebCloudRunServiceIamPolicy)
- Complex IAM Condition expressions (resource attributes, request context)
- Custom role definitions and management
- Service account creation and configuration
These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the WebCloudRunServiceIamBinding resource reference for all available configuration options.
Let's configure GCP Identity-Aware Proxy IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
What's the difference between Policy, Binding, and Member resources?
gcp.iap.WebCloudRunServiceIamPolicy is authoritative and replaces the entire IAM policy. gcp.iap.WebCloudRunServiceIamBinding is authoritative for a specific role, updating members for that role while preserving other roles. gcp.iap.WebCloudRunServiceIamMember is non-authoritative, adding a single member to a role without affecting other members.Can I use Policy with Binding or Member resources?
No,
gcp.iap.WebCloudRunServiceIamPolicy cannot be used with gcp.iap.WebCloudRunServiceIamBinding or gcp.iap.WebCloudRunServiceIamMember because they will conflict over the policy configuration.Can I use Binding and Member resources together?
Yes, but only if they grant different roles.
gcp.iap.WebCloudRunServiceIamBinding and gcp.iap.WebCloudRunServiceIamMember will conflict if they both manage the same role.IAM Configuration & Members
What member identity formats are supported?
Supported formats include
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities using principal:// syntax.How do I specify custom IAM roles?
Custom roles must use the format
[projects|organizations]/{parent-name}/roles/{role-name}. Only one gcp.iap.WebCloudRunServiceIamBinding can be used per role.IAM Conditions
How do I add time-based conditions to IAM bindings?
Configure the
condition property with title, description, and expression fields. For example, use request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.What are the limitations of IAM Conditions?
IAM Conditions have known limitations documented at https://cloud.google.com/iam/docs/conditions-overview#limitations. Review these limitations before implementing conditional access.
Immutability & Lifecycle
What properties can't I change after creation?
The
cloudRunServiceName, location, role, project, and condition properties are immutable and require resource replacement if changed.