Manage GCP KMS Crypto Key IAM Policies

The gcp:kms/cryptoKeyIAMPolicy:CryptoKeyIAMPolicy resource, part of the Pulumi GCP provider, manages IAM permissions for Cloud KMS crypto keys, controlling who can encrypt, decrypt, or manage keys. This guide focuses on three capabilities: authoritative policy replacement, time-based access conditions, and the difference between role binding and member assignment.

Three related resources manage crypto key permissions: CryptoKeyIAMPolicy (replaces entire policy), CryptoKeyIAMBinding (manages all members for one role), and CryptoKeyIAMMember (adds one member to a role). The examples are intentionally small. Combine them with your own key rings, crypto keys, and organizational identity structure.

Replace the entire IAM policy for a crypto key

When you need complete control over who can access a crypto key, you can set the entire IAM policy at once.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyring = new gcp.kms.KeyRing("keyring", {
    name: "keyring-example",
    location: "global",
});
const key = new gcp.kms.CryptoKey("key", {
    name: "crypto-key-example",
    keyRing: keyring.id,
    rotationPeriod: "7776000s",
});
const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/cloudkms.cryptoKeyEncrypter",
        members: ["user:jane@example.com"],
    }],
});
const cryptoKey = new gcp.kms.CryptoKeyIAMPolicy("crypto_key", {
    cryptoKeyId: key.id,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring",
    name="keyring-example",
    location="global")
key = gcp.kms.CryptoKey("key",
    name="crypto-key-example",
    key_ring=keyring.id,
    rotation_period="7776000s")
admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/cloudkms.cryptoKeyEncrypter",
    "members": ["user:jane@example.com"],
}])
crypto_key = gcp.kms.CryptoKeyIAMPolicy("crypto_key",
    crypto_key_id=key.id,
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keyring, err := kms.NewKeyRing(ctx, "keyring", &kms.KeyRingArgs{
			Name:     pulumi.String("keyring-example"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		key, err := kms.NewCryptoKey(ctx, "key", &kms.CryptoKeyArgs{
			Name:           pulumi.String("crypto-key-example"),
			KeyRing:        keyring.ID(),
			RotationPeriod: pulumi.String("7776000s"),
		})
		if err != nil {
			return err
		}
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/cloudkms.cryptoKeyEncrypter",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewCryptoKeyIAMPolicy(ctx, "crypto_key", &kms.CryptoKeyIAMPolicyArgs{
			CryptoKeyId: key.ID(),
			PolicyData:  pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new()
    {
        Name = "keyring-example",
        Location = "global",
    });

    var key = new Gcp.Kms.CryptoKey("key", new()
    {
        Name = "crypto-key-example",
        KeyRing = keyring.Id,
        RotationPeriod = "7776000s",
    });

    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/cloudkms.cryptoKeyEncrypter",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var cryptoKey = new Gcp.Kms.CryptoKeyIAMPolicy("crypto_key", new()
    {
        CryptoKeyId = key.Id,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRing;
import com.pulumi.gcp.kms.KeyRingArgs;
import com.pulumi.gcp.kms.CryptoKey;
import com.pulumi.gcp.kms.CryptoKeyArgs;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.kms.CryptoKeyIAMPolicy;
import com.pulumi.gcp.kms.CryptoKeyIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyring = new KeyRing("keyring", KeyRingArgs.builder()
            .name("keyring-example")
            .location("global")
            .build());

        var key = new CryptoKey("key", CryptoKeyArgs.builder()
            .name("crypto-key-example")
            .keyRing(keyring.id())
            .rotationPeriod("7776000s")
            .build());

        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/cloudkms.cryptoKeyEncrypter")
                .members("user:jane@example.com")
                .build())
            .build());

        var cryptoKey = new CryptoKeyIAMPolicy("cryptoKey", CryptoKeyIAMPolicyArgs.builder()
            .cryptoKeyId(key.id())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  keyring:
    type: gcp:kms:KeyRing
    properties:
      name: keyring-example
      location: global
  key:
    type: gcp:kms:CryptoKey
    properties:
      name: crypto-key-example
      keyRing: ${keyring.id}
      rotationPeriod: 7776000s
  cryptoKey:
    type: gcp:kms:CryptoKeyIAMPolicy
    name: crypto_key
    properties:
      cryptoKeyId: ${key.id}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/cloudkms.cryptoKeyEncrypter
            members:
              - user:jane@example.com

The policyData property comes from the getIAMPolicy data source, which structures bindings as role-member pairs. The cryptoKeyId references your crypto key. This resource replaces any existing IAM policy on the key, making it authoritative for all roles and members.

Add time-based access conditions to policies

IAM conditions let you grant temporary access that expires automatically, useful for contractors or time-limited projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/cloudkms.cryptoKeyEncrypter",
        members: ["user:jane@example.com"],
        condition: {
            title: "expires_after_2019_12_31",
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    }],
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/cloudkms.cryptoKeyEncrypter",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
}])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/cloudkms.cryptoKeyEncrypter",
					Members: []string{
						"user:jane@example.com",
					},
					Condition: {
						Title:       "expires_after_2019_12_31",
						Description: pulumi.StringRef("Expiring at midnight of 2019-12-31"),
						Expression:  "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/cloudkms.cryptoKeyEncrypter",
                Members = new[]
                {
                    "user:jane@example.com",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "expires_after_2019_12_31",
                    Description = "Expiring at midnight of 2019-12-31",
                    Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/cloudkms.cryptoKeyEncrypter")
                .members("user:jane@example.com")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("expires_after_2019_12_31")
                    .description("Expiring at midnight of 2019-12-31")
                    .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                    .build())
                .build())
            .build());

    }
}

variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/cloudkms.cryptoKeyEncrypter
            members:
              - user:jane@example.com
            condition:
              title: expires_after_2019_12_31
              description: Expiring at midnight of 2019-12-31
              expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal constraints to role bindings. The expression uses CEL (Common Expression Language) to compare request.time against a timestamp. The title and description document the condition’s purpose. When the condition evaluates to false, the binding no longer grants access.

Grant a role to multiple members at once

When multiple users or service accounts need the same permission level, CryptoKeyIAMBinding manages them as a group for a specific role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const cryptoKey = new gcp.kms.CryptoKeyIAMBinding("crypto_key", {
    cryptoKeyId: key.id,
    role: "roles/cloudkms.cryptoKeyEncrypter",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMBinding("crypto_key",
    crypto_key_id=key["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewCryptoKeyIAMBinding(ctx, "crypto_key", &kms.CryptoKeyIAMBindingArgs{
			CryptoKeyId: pulumi.Any(key.Id),
			Role:        pulumi.String("roles/cloudkms.cryptoKeyEncrypter"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var cryptoKey = new Gcp.Kms.CryptoKeyIAMBinding("crypto_key", new()
    {
        CryptoKeyId = key.Id,
        Role = "roles/cloudkms.cryptoKeyEncrypter",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.CryptoKeyIAMBinding;
import com.pulumi.gcp.kms.CryptoKeyIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var cryptoKey = new CryptoKeyIAMBinding("cryptoKey", CryptoKeyIAMBindingArgs.builder()
            .cryptoKeyId(key.id())
            .role("roles/cloudkms.cryptoKeyEncrypter")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  cryptoKey:
    type: gcp:kms:CryptoKeyIAMBinding
    name: crypto_key
    properties:
      cryptoKeyId: ${key.id}
      role: roles/cloudkms.cryptoKeyEncrypter
      members:
        - user:jane@example.com

The members array lists all identities that should have this role. CryptoKeyIAMBinding is authoritative for the specified role: it replaces all members for that role but preserves other roles on the crypto key. This differs from CryptoKeyIAMPolicy, which replaces the entire policy.

Add a single member to a role incrementally

CryptoKeyIAMMember adds one member to a role without affecting other members, making it safe to use alongside other IAM resources.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const cryptoKey = new gcp.kms.CryptoKeyIAMMember("crypto_key", {
    cryptoKeyId: key.id,
    role: "roles/cloudkms.cryptoKeyEncrypter",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

crypto_key = gcp.kms.CryptoKeyIAMMember("crypto_key",
    crypto_key_id=key["id"],
    role="roles/cloudkms.cryptoKeyEncrypter",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewCryptoKeyIAMMember(ctx, "crypto_key", &kms.CryptoKeyIAMMemberArgs{
			CryptoKeyId: pulumi.Any(key.Id),
			Role:        pulumi.String("roles/cloudkms.cryptoKeyEncrypter"),
			Member:      pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var cryptoKey = new Gcp.Kms.CryptoKeyIAMMember("crypto_key", new()
    {
        CryptoKeyId = key.Id,
        Role = "roles/cloudkms.cryptoKeyEncrypter",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.CryptoKeyIAMMember;
import com.pulumi.gcp.kms.CryptoKeyIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var cryptoKey = new CryptoKeyIAMMember("cryptoKey", CryptoKeyIAMMemberArgs.builder()
            .cryptoKeyId(key.id())
            .role("roles/cloudkms.cryptoKeyEncrypter")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  cryptoKey:
    type: gcp:kms:CryptoKeyIAMMember
    name: crypto_key
    properties:
      cryptoKeyId: ${key.id}
      role: roles/cloudkms.cryptoKeyEncrypter
      member: user:jane@example.com

The member property specifies a single identity. CryptoKeyIAMMember is non-authoritative: it adds this member to the role without removing others. You can use multiple CryptoKeyIAMMember resources for the same role, or combine them with CryptoKeyIAMBinding resources for different roles.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management, time-based access conditions, and role and member assignment patterns. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as KMS KeyRing and CryptoKey resources. They focus on permission assignment rather than key provisioning.

To keep things focused, common IAM patterns are omitted, including:

Combining CryptoKeyIAMBinding with CryptoKeyIAMMember for different roles
Service account impersonation (serviceAccount:email format)
Group-based permissions (group:email format)
Domain-wide access (domain:example.com format)

These omissions are intentional: the goal is to illustrate how each IAM resource type behaves, not provide drop-in access control modules. See the CryptoKeyIAMPolicy resource reference for all available configuration options.

Let's manage GCP KMS Crypto Key IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between CryptoKeyIAMPolicy, CryptoKeyIAMBinding, and CryptoKeyIAMMember?

Three resources manage KMS crypto key IAM with different behaviors:

CryptoKeyIAMPolicy - Authoritative. Replaces the entire IAM policy.
CryptoKeyIAMBinding - Authoritative for a specific role. Preserves other roles.
CryptoKeyIAMMember - Non-authoritative. Adds a single member to a role, preserving other members.

Can I use these IAM resources together on the same crypto key?

CryptoKeyIAMPolicy cannot be used with CryptoKeyIAMBinding or CryptoKeyIAMMember, as they will conflict. However, CryptoKeyIAMBinding and CryptoKeyIAMMember can be used together only if they don’t grant the same role.

Configuration & Setup

How do I configure IAM policy for a crypto key?

Use gcp.organizations.getIAMPolicy to generate policy data with your desired bindings, then pass the result to CryptoKeyIAMPolicy’s policyData property.

What format should I use for cryptoKeyId?

You can use either {project_id}/{location}/{key_ring_name}/{crypto_key_name} or {location}/{key_ring_name}/{crypto_key_name}. The shorter form uses your provider’s project setting as a fallback.

Advanced Features

How do I add time-based or conditional access to IAM bindings?

Add a condition block with title, description, and expression fields. For example, use request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides