The gcp:kms/ekmConnectionIamMember:EkmConnectionIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual members on Cloud KMS External Key Manager connections. This resource performs non-authoritative updates, meaning it adds a single member to a role without affecting other members already assigned to that role. This guide focuses on two capabilities: non-authoritative member grants and time-based access with IAM Conditions.
EKM connection IAM resources reference existing EKM connections and require project and location identifiers. The examples are intentionally small. Combine them with your own EKM connection infrastructure and identity management.
Grant a single user access to an EKM connection
When managing external key managers, you often need to grant individual users or service accounts access to specific connections without replacing existing IAM bindings.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.kms.EkmConnectionIamMember("member", {
project: example_ekmconnection.project,
location: example_ekmconnection.location,
name: example_ekmconnection.name,
role: "roles/viewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.kms.EkmConnectionIamMember("member",
project=example_ekmconnection["project"],
location=example_ekmconnection["location"],
name=example_ekmconnection["name"],
role="roles/viewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := kms.NewEkmConnectionIamMember(ctx, "member", &kms.EkmConnectionIamMemberArgs{
Project: pulumi.Any(example_ekmconnection.Project),
Location: pulumi.Any(example_ekmconnection.Location),
Name: pulumi.Any(example_ekmconnection.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Kms.EkmConnectionIamMember("member", new()
{
Project = example_ekmconnection.Project,
Location = example_ekmconnection.Location,
Name = example_ekmconnection.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamMember;
import com.pulumi.gcp.kms.EkmConnectionIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new EkmConnectionIamMember("member", EkmConnectionIamMemberArgs.builder()
.project(example_ekmconnection.project())
.location(example_ekmconnection.location())
.name(example_ekmconnection.name())
.role("roles/viewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:kms:EkmConnectionIamMember
properties:
project: ${["example-ekmconnection"].project}
location: ${["example-ekmconnection"].location}
name: ${["example-ekmconnection"].name}
role: roles/viewer
member: user:jane@example.com
The member property specifies the identity receiving access, using formats like “user:email@example.com” or “serviceAccount:name@project.iam.gserviceaccount.com”. The role property defines the permission level. Because this resource is non-authoritative, it preserves other members already assigned to the same role on the EKM connection.
Grant time-limited access with IAM Conditions
Temporary access grants can expire automatically when IAM Conditions evaluate to false, eliminating manual cleanup for contractors or time-bound projects.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.kms.EkmConnectionIamMember("member", {
project: example_ekmconnection.project,
location: example_ekmconnection.location,
name: example_ekmconnection.name,
role: "roles/viewer",
member: "user:jane@example.com",
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
member = gcp.kms.EkmConnectionIamMember("member",
project=example_ekmconnection["project"],
location=example_ekmconnection["location"],
name=example_ekmconnection["name"],
role="roles/viewer",
member="user:jane@example.com",
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := kms.NewEkmConnectionIamMember(ctx, "member", &kms.EkmConnectionIamMemberArgs{
Project: pulumi.Any(example_ekmconnection.Project),
Location: pulumi.Any(example_ekmconnection.Location),
Name: pulumi.Any(example_ekmconnection.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
Condition: &kms.EkmConnectionIamMemberConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Kms.EkmConnectionIamMember("member", new()
{
Project = example_ekmconnection.Project,
Location = example_ekmconnection.Location,
Name = example_ekmconnection.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
Condition = new Gcp.Kms.Inputs.EkmConnectionIamMemberConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamMember;
import com.pulumi.gcp.kms.EkmConnectionIamMemberArgs;
import com.pulumi.gcp.kms.inputs.EkmConnectionIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new EkmConnectionIamMember("member", EkmConnectionIamMemberArgs.builder()
.project(example_ekmconnection.project())
.location(example_ekmconnection.location())
.name(example_ekmconnection.name())
.role("roles/viewer")
.member("user:jane@example.com")
.condition(EkmConnectionIamMemberConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
member:
type: gcp:kms:EkmConnectionIamMember
properties:
project: ${["example-ekmconnection"].project}
location: ${["example-ekmconnection"].location}
name: ${["example-ekmconnection"].name}
role: roles/viewer
member: user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds temporal constraints to the member grant. The expression property uses CEL (Common Expression Language) to define when access is valid. Here, the condition checks whether the current request time is before midnight on January 1, 2020. Once that timestamp passes, the member loses access automatically. The title and description properties document the condition’s purpose for auditing.
Beyond these examples
These snippets focus on specific EKM connection IAM features: non-authoritative member grants and time-based IAM Conditions. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as EKM connections (example_ekmconnection) and GCP project and location configuration. They focus on granting access to individual members rather than managing complete IAM policies.
To keep things focused, common IAM patterns are omitted, including:
- Authoritative policy management (EkmConnectionIamPolicy)
- Role-level binding management (EkmConnectionIamBinding)
- Custom role definitions
- Federated identity principals
These omissions are intentional: the goal is to illustrate how member-level IAM grants are wired, not provide drop-in access control modules. See the EkmConnectionIamMember resource reference for all available configuration options.
Let's manage GCP Cloud KMS EKM Connection IAM Access
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
EkmConnectionIamPolicy cannot be used with EkmConnectionIamBinding or EkmConnectionIamMember as they will conflict over policy state. However, EkmConnectionIamBinding and EkmConnectionIamMember can be used together if they manage different roles.EkmConnectionIamPolicy to set the entire policy authoritatively. Use EkmConnectionIamBinding to manage all members for a specific role while preserving other roles. Use EkmConnectionIamMember to add individual members non-authoritatively, preserving existing members for the same role.Identity & Role Configuration
member parameter supports allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/locations/global/workforcePools/....[projects|organizations]/{parent-name}/roles/{role-name} (e.g., projects/my-project/roles/my-custom-role).IAM Conditions & Advanced Features
condition property with title, description, and expression fields. For example, use expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" for time-based expiration. Note that IAM Conditions have known limitations.