Manage GCP KMS Crypto Key IAM Permissions

The gcp:kms/cryptoKeyIAMBinding:CryptoKeyIAMBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for KMS crypto keys, controlling which identities can perform encryption, decryption, or key management operations. This guide focuses on three capabilities: granting roles to multiple members, adding time-based conditions, and incrementally adding individual members.

IAM bindings reference existing CryptoKey resources and grant access to users, service accounts, or groups. The examples are intentionally small. Combine them with your own key management infrastructure and identity providers.

Grant a role to multiple members

When managing encryption keys, teams often need to grant the same role to several users or service accounts at once, such as allowing multiple applications to encrypt data with the same key.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const cryptoKey = new gcp.kms.CryptoKeyIAMBinding("crypto_key", {
    cryptoKeyId: key.id,
    role: "roles/cloudkms.cryptoKeyEncrypter",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("crypto_key",
    crypto_key_id=key["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewCryptoKeyIAMBinding(ctx, "crypto_key", &kms.CryptoKeyIAMBindingArgs{
			CryptoKeyId: pulumi.Any(key.Id),
			Role:        pulumi.String("roles/cloudkms.cryptoKeyEncrypter"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var cryptoKey = new Gcp.Kms.CryptoKeyIAMBinding("crypto_key", new()
    {
        CryptoKeyId = key.Id,
        Role = "roles/cloudkms.cryptoKeyEncrypter",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.CryptoKeyIAMBinding;
import com.pulumi.gcp.kms.CryptoKeyIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var cryptoKey = new CryptoKeyIAMBinding("cryptoKey", CryptoKeyIAMBindingArgs.builder()
            .cryptoKeyId(key.id())
            .role("roles/cloudkms.cryptoKeyEncrypter")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  cryptoKey:
    type: gcp:kms:CryptoKeyIAMBinding
    name: crypto_key
    properties:
      cryptoKeyId: ${key.id}
      role: roles/cloudkms.cryptoKeyEncrypter
      members:
        - user:jane@example.com

The CryptoKeyIAMBinding resource is authoritative for the specified role: it replaces all members for that role on the crypto key. The members array accepts user emails, service account emails, groups, or special identifiers like allAuthenticatedUsers. The cryptoKeyId references an existing key in the format {location}/{keyring}/{key}.

Add time-based conditions to role grants

Temporary access patterns require IAM bindings that expire automatically, such as granting contractors encryption access that ends when their engagement completes.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const cryptoKey = new gcp.kms.CryptoKeyIAMBinding("crypto_key", {
    cryptoKeyId: key.id,
    role: "roles/cloudkms.cryptoKeyEncrypter",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("crypto_key",
    crypto_key_id=key["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewCryptoKeyIAMBinding(ctx, "crypto_key", &kms.CryptoKeyIAMBindingArgs{
			CryptoKeyId: pulumi.Any(key.Id),
			Role:        pulumi.String("roles/cloudkms.cryptoKeyEncrypter"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &kms.CryptoKeyIAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var cryptoKey = new Gcp.Kms.CryptoKeyIAMBinding("crypto_key", new()
    {
        CryptoKeyId = key.Id,
        Role = "roles/cloudkms.cryptoKeyEncrypter",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Kms.Inputs.CryptoKeyIAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.CryptoKeyIAMBinding;
import com.pulumi.gcp.kms.CryptoKeyIAMBindingArgs;
import com.pulumi.gcp.kms.inputs.CryptoKeyIAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var cryptoKey = new CryptoKeyIAMBinding("cryptoKey", CryptoKeyIAMBindingArgs.builder()
            .cryptoKeyId(key.id())
            .role("roles/cloudkms.cryptoKeyEncrypter")
            .members("user:jane@example.com")
            .condition(CryptoKeyIAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  cryptoKey:
    type: gcp:kms:CryptoKeyIAMBinding
    name: crypto_key
    properties:
      cryptoKeyId: ${key.id}
      role: roles/cloudkms.cryptoKeyEncrypter
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal constraints to the binding. The expression uses CEL (Common Expression Language) to compare request.time against a timestamp. When the condition evaluates to false, the binding no longer grants access. The title and description fields document the condition’s purpose.

Add a single member to a role

When onboarding individual users or service accounts, you often need to grant access without affecting other members who already have the same role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const cryptoKey = new gcp.kms.CryptoKeyIAMMember("crypto_key", {
    cryptoKeyId: key.id,
    role: "roles/cloudkms.cryptoKeyEncrypter",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("crypto_key",
    crypto_key_id=key["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewCryptoKeyIAMMember(ctx, "crypto_key", &kms.CryptoKeyIAMMemberArgs{
			CryptoKeyId: pulumi.Any(key.Id),
			Role:        pulumi.String("roles/cloudkms.cryptoKeyEncrypter"),
			Member:      pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var cryptoKey = new Gcp.Kms.CryptoKeyIAMMember("crypto_key", new()
    {
        CryptoKeyId = key.Id,
        Role = "roles/cloudkms.cryptoKeyEncrypter",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.CryptoKeyIAMMember;
import com.pulumi.gcp.kms.CryptoKeyIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var cryptoKey = new CryptoKeyIAMMember("cryptoKey", CryptoKeyIAMMemberArgs.builder()
            .cryptoKeyId(key.id())
            .role("roles/cloudkms.cryptoKeyEncrypter")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  cryptoKey:
    type: gcp:kms:CryptoKeyIAMMember
    name: crypto_key
    properties:
      cryptoKeyId: ${key.id}
      role: roles/cloudkms.cryptoKeyEncrypter
      member: user:jane@example.com

The CryptoKeyIAMMember resource is non-authoritative: it adds one member to a role without replacing existing members. Use member (singular) instead of members (plural). This resource can coexist with CryptoKeyIAMBinding resources as long as they manage different roles.

Beyond these examples

These snippets focus on specific IAM binding features: role binding with multiple members, time-based IAM conditions, and incremental member addition. They’re intentionally minimal rather than full key management solutions.

The examples reference pre-existing infrastructure such as KMS CryptoKey resources (referenced by cryptoKeyId), and KeyRing and location configuration. They focus on access control configuration rather than key provisioning.

To keep things focused, common IAM patterns are omitted, including:

Full policy replacement (CryptoKeyIAMPolicy)
Custom role definitions
Condition expressions beyond time-based expiration
Service account creation and management

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the CryptoKeyIAMBinding resource reference for all available configuration options.

Let's manage GCP KMS Crypto Key IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between CryptoKeyIAMPolicy, CryptoKeyIAMBinding, and CryptoKeyIAMMember?

CryptoKeyIAMPolicy is authoritative and replaces the entire IAM policy. CryptoKeyIAMBinding is authoritative for a specific role but preserves other roles. CryptoKeyIAMMember is non-authoritative and adds individual members while preserving existing members for that role.

Can I use CryptoKeyIAMPolicy with CryptoKeyIAMBinding or CryptoKeyIAMMember?

No, CryptoKeyIAMPolicy cannot be used with CryptoKeyIAMBinding or CryptoKeyIAMMember as they will conflict over the policy.

Can I use CryptoKeyIAMBinding with CryptoKeyIAMMember?

Yes, but only if they don’t grant privileges to the same role. Using both for the same role causes conflicts.

Configuration & Identity Management

What identity formats can I use in the members list?

You can use allUsers, allAuthenticatedUsers, user:{emailid}, serviceAccount:{emailid}, group:{emailid}, or domain:{domain}.

What format should I use for cryptoKeyId?

Use either the full path {project_id}/{location_name}/{key_ring_name}/{crypto_key_name} or the short form {location_name}/{key_ring_name}/{crypto_key_name} (which uses your provider’s project setting).

How do I specify a custom role?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.

IAM Conditions & Advanced Features

How do I add time-based or conditional access?

Configure the condition property with title, description, and expression. For example, use request.time < timestamp("2020-01-01T00:00:00Z") for time-based expiration.

Immutability & Limitations

What properties can't I change after creating the binding?

The cryptoKeyId, role, and condition properties are immutable and require resource replacement if changed.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides