Manage GCP Identity-Aware Proxy IAM Policies

The gcp:iap/webForwardingRuleServiceIamPolicy:WebForwardingRuleServiceIamPolicy resource, part of the Pulumi GCP provider, manages IAM policies for Identity-Aware Proxy (IAP) protected forwarding rule services, controlling who can access HTTPS resources behind IAP. This guide focuses on four capabilities: authoritative policy replacement (IamPolicy), role-based member management (IamBinding), individual member grants (IamMember), and time-based access conditions.

Three related resources manage IAP access: IamPolicy replaces the entire policy, IamBinding manages all members for a specific role, and IamMember adds individual members. IamPolicy cannot be used with IamBinding or IamMember (they conflict), but IamBinding and IamMember can coexist if they manage different roles. The examples are intentionally small. Combine them with your own forwarding rule services and organizational access patterns.

Grant a role to multiple members with IamBinding

When managing access for groups or service accounts, IamBinding grants a single role to multiple identities while preserving other roles in the policy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebForwardingRuleServiceIamBinding("binding", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebForwardingRuleServiceIamBinding("binding",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebForwardingRuleServiceIamBinding(ctx, "binding", &iap.WebForwardingRuleServiceIamBindingArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			Role:                      pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebForwardingRuleServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBinding;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebForwardingRuleServiceIamBinding("binding", WebForwardingRuleServiceIamBindingArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebForwardingRuleServiceIamBinding
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com

The members property lists all identities that receive the specified role. IamBinding is authoritative for this role: it replaces any existing members for roles/iap.httpsResourceAccessor but leaves other roles untouched. The forwardingRuleServiceName identifies which IAP-protected service receives the policy.

Add time-based access with IAM Conditions

Temporary access grants expire automatically when conditions evaluate to false, eliminating manual cleanup for contractors or time-limited projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iap.WebForwardingRuleServiceIamBinding("binding", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iap.WebForwardingRuleServiceIamBinding("binding",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebForwardingRuleServiceIamBinding(ctx, "binding", &iap.WebForwardingRuleServiceIamBindingArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			Role:                      pulumi.String("roles/iap.httpsResourceAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &iap.WebForwardingRuleServiceIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iap.WebForwardingRuleServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Iap.Inputs.WebForwardingRuleServiceIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBinding;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamBindingArgs;
import com.pulumi.gcp.iap.inputs.WebForwardingRuleServiceIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WebForwardingRuleServiceIamBinding("binding", WebForwardingRuleServiceIamBindingArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .members("user:jane@example.com")
            .condition(WebForwardingRuleServiceIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:iap:WebForwardingRuleServiceIamBinding
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal constraints to the role grant. The expression uses CEL (Common Expression Language) to evaluate request.time against a timestamp. When the condition becomes false, IAP denies access automatically. The title and description document the condition’s purpose for audit logs.

Add a single member with IamMember

When multiple teams manage access independently, IamMember allows adding individual members without coordinating the full member list for a role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iap.WebForwardingRuleServiceIamMember("member", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    role: "roles/iap.httpsResourceAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iap.WebForwardingRuleServiceIamMember("member",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    role="roles/iap.httpsResourceAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iap.NewWebForwardingRuleServiceIamMember(ctx, "member", &iap.WebForwardingRuleServiceIamMemberArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			Role:                      pulumi.String("roles/iap.httpsResourceAccessor"),
			Member:                    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iap.WebForwardingRuleServiceIamMember("member", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        Role = "roles/iap.httpsResourceAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMember;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WebForwardingRuleServiceIamMember("member", WebForwardingRuleServiceIamMemberArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .role("roles/iap.httpsResourceAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iap:WebForwardingRuleServiceIamMember
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      role: roles/iap.httpsResourceAccessor
      member: user:jane@example.com

The member property specifies a single identity to receive the role. Unlike IamBinding, IamMember is non-authoritative: it adds this member without affecting other members who already have the role. This allows distributed access management where different teams grant access independently.

Replace the entire policy with IamPolicy

Centralized policy management requires full control over all roles and members. IamPolicy replaces the entire IAM policy, removing any grants not explicitly defined.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/iap.httpsResourceAccessor",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.iap.WebForwardingRuleServiceIamPolicy("policy", {
    project: _default.project,
    forwardingRuleServiceName: _default.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/iap.httpsResourceAccessor",
    "members": ["user:jane@example.com"],
}])
policy = gcp.iap.WebForwardingRuleServiceIamPolicy("policy",
    project=default["project"],
    forwarding_rule_service_name=default["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iap"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/iap.httpsResourceAccessor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = iap.NewWebForwardingRuleServiceIamPolicy(ctx, "policy", &iap.WebForwardingRuleServiceIamPolicyArgs{
			Project:                   pulumi.Any(_default.Project),
			ForwardingRuleServiceName: pulumi.Any(_default.Name),
			PolicyData:                pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/iap.httpsResourceAccessor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Iap.WebForwardingRuleServiceIamPolicy("policy", new()
    {
        Project = @default.Project,
        ForwardingRuleServiceName = @default.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamPolicy;
import com.pulumi.gcp.iap.WebForwardingRuleServiceIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/iap.httpsResourceAccessor")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new WebForwardingRuleServiceIamPolicy("policy", WebForwardingRuleServiceIamPolicyArgs.builder()
            .project(default_.project())
            .forwardingRuleServiceName(default_.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:iap:WebForwardingRuleServiceIamPolicy
    properties:
      project: ${default.project}
      forwardingRuleServiceName: ${default.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/iap.httpsResourceAccessor
            members:
              - user:jane@example.com

The policyData property contains the complete IAM policy, typically generated by the getIAMPolicy data source. IamPolicy is fully authoritative: it removes any roles or members not included in policyData. This ensures the policy matches your source of truth exactly but requires careful coordination to avoid accidentally removing access.

Beyond these examples

These snippets focus on specific IAM management features: role-based access control (Binding and Member), time-based conditions, and authoritative policy replacement. They’re intentionally minimal rather than full access control systems.

The examples reference pre-existing infrastructure such as IAP-protected forwarding rule services and GCP projects with IAP enabled. They focus on configuring access policies rather than provisioning the underlying IAP infrastructure.

To keep things focused, common IAM patterns are omitted, including:

  • Combining Policy with Binding or Member (causes conflicts)
  • Custom IAM roles (requires full role path)
  • Service account impersonation
  • Audit logging configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the WebForwardingRuleServiceIamPolicy resource reference for all available configuration options.

Let's manage GCP Identity-Aware Proxy IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between WebForwardingRuleServiceIamPolicy, IamBinding, and IamMember?
WebForwardingRuleServiceIamPolicy is authoritative and replaces the entire IAM policy. WebForwardingRuleServiceIamBinding is authoritative for a specific role, preserving other roles. WebForwardingRuleServiceIamMember is non-authoritative, preserving other members for the same role.
Can I use WebForwardingRuleServiceIamPolicy with IamBinding or IamMember?
No, WebForwardingRuleServiceIamPolicy cannot be used with WebForwardingRuleServiceIamBinding or WebForwardingRuleServiceIamMember because they will conflict over the policy configuration.
Can I use WebForwardingRuleServiceIamBinding with IamMember?
Yes, but only if they don’t grant privileges to the same role. If both resources manage the same role, they will conflict.
IAM Conditions
How do I add time-based access restrictions?
Use the condition property with title, description, and expression fields. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.
Are there limitations when using IAM Conditions?
Yes, IAM Conditions have known limitations. Review the GCP IAM Conditions documentation if you encounter issues.
Configuration & Properties
Which properties can't be changed after creation?
Both forwardingRuleServiceName and project are immutable and cannot be changed after the resource is created.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides