Manage GCP Cloud KMS EKM Connection IAM Access

The gcp:kms/ekmConnectionIamMember:EkmConnectionIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual members on Cloud KMS External Key Manager connections without affecting other role assignments. This guide focuses on two capabilities: non-authoritative member grants and time-based access with IAM conditions.

This resource is one of three IAM management options for EKM connections. EkmConnectionIamMember adds individual members to roles non-authoritatively, preserving existing members. EkmConnectionIamBinding manages all members for a role authoritatively. EkmConnectionIamPolicy replaces the entire IAM policy. The examples reference existing EKM connections. Combine them with your own connection resources and identity management.

Grant a single user access to an EKM connection

When managing external key connections, you often need to grant access to individual users or service accounts without disrupting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.kms.EkmConnectionIamMember("member", {
    project: example_ekmconnection.project,
    location: example_ekmconnection.location,
    name: example_ekmconnection.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.kms.EkmConnectionIamMember("member",
    project=example_ekmconnection["project"],
    location=example_ekmconnection["location"],
    name=example_ekmconnection["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewEkmConnectionIamMember(ctx, "member", &kms.EkmConnectionIamMemberArgs{
			Project:  pulumi.Any(example_ekmconnection.Project),
			Location: pulumi.Any(example_ekmconnection.Location),
			Name:     pulumi.Any(example_ekmconnection.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Kms.EkmConnectionIamMember("member", new()
    {
        Project = example_ekmconnection.Project,
        Location = example_ekmconnection.Location,
        Name = example_ekmconnection.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamMember;
import com.pulumi.gcp.kms.EkmConnectionIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new EkmConnectionIamMember("member", EkmConnectionIamMemberArgs.builder()
            .project(example_ekmconnection.project())
            .location(example_ekmconnection.location())
            .name(example_ekmconnection.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:kms:EkmConnectionIamMember
    properties:
      project: ${["example-ekmconnection"].project}
      location: ${["example-ekmconnection"].location}
      name: ${["example-ekmconnection"].name}
      role: roles/viewer
      member: user:jane@example.com

The member property identifies who receives access, using formats like “user:email@example.com” or “serviceAccount:name@project.iam.gserviceaccount.com”. The role property specifies the permission level. Because this resource is non-authoritative, it adds the member to the role without removing other members who already have that role.

Add time-limited access with IAM conditions

Temporary access grants can expire automatically using IAM conditions, eliminating manual cleanup for contractors or time-bound projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.kms.EkmConnectionIamMember("member", {
    project: example_ekmconnection.project,
    location: example_ekmconnection.location,
    name: example_ekmconnection.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.kms.EkmConnectionIamMember("member",
    project=example_ekmconnection["project"],
    location=example_ekmconnection["location"],
    name=example_ekmconnection["name"],
    role="roles/viewer",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewEkmConnectionIamMember(ctx, "member", &kms.EkmConnectionIamMemberArgs{
			Project:  pulumi.Any(example_ekmconnection.Project),
			Location: pulumi.Any(example_ekmconnection.Location),
			Name:     pulumi.Any(example_ekmconnection.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
			Condition: &kms.EkmConnectionIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Kms.EkmConnectionIamMember("member", new()
    {
        Project = example_ekmconnection.Project,
        Location = example_ekmconnection.Location,
        Name = example_ekmconnection.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
        Condition = new Gcp.Kms.Inputs.EkmConnectionIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamMember;
import com.pulumi.gcp.kms.EkmConnectionIamMemberArgs;
import com.pulumi.gcp.kms.inputs.EkmConnectionIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new EkmConnectionIamMember("member", EkmConnectionIamMemberArgs.builder()
            .project(example_ekmconnection.project())
            .location(example_ekmconnection.location())
            .name(example_ekmconnection.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .condition(EkmConnectionIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:kms:EkmConnectionIamMember
    properties:
      project: ${["example-ekmconnection"].project}
      location: ${["example-ekmconnection"].location}
      name: ${["example-ekmconnection"].name}
      role: roles/viewer
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block defines when the grant is active. The expression property uses CEL (Common Expression Language) to evaluate access rules at request time. Here, “request.time < timestamp(…)” ensures the grant expires at midnight on December 31, 2019. The title and description properties document the condition’s purpose for auditing.

Beyond these examples

These snippets focus on specific member-level features: non-authoritative member grants and time-based IAM conditions. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as EKM connections (referenced as example_ekmconnection) and a GCP project with KMS API enabled. They focus on granting access to connections rather than creating the connections themselves.

To keep things focused, common IAM patterns are omitted, including:

Authoritative policy management (EkmConnectionIamPolicy)
Role-level binding management (EkmConnectionIamBinding)
Custom role definitions
Federated identity principals

These omissions are intentional: the goal is to illustrate how member grants are wired, not provide drop-in access control modules. See the EkmConnectionIamMember resource reference for all available configuration options.

Let's manage GCP Cloud KMS EKM Connection IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between EkmConnectionIamPolicy, EkmConnectionIamBinding, and EkmConnectionIamMember?

EkmConnectionIamPolicy is authoritative and replaces the entire IAM policy. EkmConnectionIamBinding is authoritative for a specific role, preserving other roles. EkmConnectionIamMember is non-authoritative, adding a single member while preserving other members for that role.

Can I use EkmConnectionIamPolicy with EkmConnectionIamBinding or EkmConnectionIamMember?

No, EkmConnectionIamPolicy cannot be used with EkmConnectionIamBinding or EkmConnectionIamMember as they will conflict over policy management.

Can I use EkmConnectionIamBinding and EkmConnectionIamMember together?

Yes, but only if they grant different roles. Using both for the same role causes conflicts.

IAM Configuration

What member identity formats are supported?

Supported formats include:

user:{email} for Google accounts
serviceAccount:{email} for service accounts
group:{email} for Google groups
domain:{domain} for G Suite domains
projectOwner/Editor/Viewer:projectid for project roles
allUsers and allAuthenticatedUsers for public access
Federated identities (e.g., principal://iam.googleapis.com/...)

How do I specify custom IAM roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.

Can I add time-based or conditional access restrictions?

Yes, use the condition property with title, description, and expression fields. However, IAM Conditions have known limitations that should be reviewed before use.

Resource Properties & Limitations

What properties can't I change after creation?

All key properties are immutable: member, role, location, name, project, and condition.

Are there limitations with IAM Conditions?

Yes, IAM Conditions are supported but have known limitations. Review the GCP IAM Conditions documentation for details before implementing conditional access.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides