The gcp:kms/ekmConnectionIamBinding:EkmConnectionIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Cloud KMS External Key Manager (EKM) connections, controlling which identities can access externally managed encryption keys. This guide focuses on three capabilities: authoritative role binding for multiple members, time-based conditional access, and non-authoritative single member addition.
EKM connection IAM resources reference existing EKM connections and require a configured GCP project and location. The examples are intentionally small. Combine them with your own EKM connection infrastructure and identity management strategy.
Grant a role to multiple members with EkmConnectionIamBinding
When managing external key connections, you often need to grant the same role to multiple users or service accounts as a single unit.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.kms.EkmConnectionIamBinding("binding", {
project: example_ekmconnection.project,
location: example_ekmconnection.location,
name: example_ekmconnection.name,
role: "roles/viewer",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.kms.EkmConnectionIamBinding("binding",
project=example_ekmconnection["project"],
location=example_ekmconnection["location"],
name=example_ekmconnection["name"],
role="roles/viewer",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := kms.NewEkmConnectionIamBinding(ctx, "binding", &kms.EkmConnectionIamBindingArgs{
Project: pulumi.Any(example_ekmconnection.Project),
Location: pulumi.Any(example_ekmconnection.Location),
Name: pulumi.Any(example_ekmconnection.Name),
Role: pulumi.String("roles/viewer"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Kms.EkmConnectionIamBinding("binding", new()
{
Project = example_ekmconnection.Project,
Location = example_ekmconnection.Location,
Name = example_ekmconnection.Name,
Role = "roles/viewer",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamBinding;
import com.pulumi.gcp.kms.EkmConnectionIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new EkmConnectionIamBinding("binding", EkmConnectionIamBindingArgs.builder()
.project(example_ekmconnection.project())
.location(example_ekmconnection.location())
.name(example_ekmconnection.name())
.role("roles/viewer")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:kms:EkmConnectionIamBinding
properties:
project: ${["example-ekmconnection"].project}
location: ${["example-ekmconnection"].location}
name: ${["example-ekmconnection"].name}
role: roles/viewer
members:
- user:jane@example.com
The role property specifies which permission set to grant (e.g., “roles/viewer”). The members array lists all identities that receive this role. EkmConnectionIamBinding is authoritative for the specified role: it replaces any existing members for that role, but preserves other roles on the same EKM connection. The project, location, and name properties identify which EKM connection to bind permissions to.
Add time-based access with IAM Conditions
Temporary access grants need expiration logic to automatically revoke permissions after a deadline.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.kms.EkmConnectionIamBinding("binding", {
project: example_ekmconnection.project,
location: example_ekmconnection.location,
name: example_ekmconnection.name,
role: "roles/viewer",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.kms.EkmConnectionIamBinding("binding",
project=example_ekmconnection["project"],
location=example_ekmconnection["location"],
name=example_ekmconnection["name"],
role="roles/viewer",
members=["user:jane@example.com"],
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := kms.NewEkmConnectionIamBinding(ctx, "binding", &kms.EkmConnectionIamBindingArgs{
Project: pulumi.Any(example_ekmconnection.Project),
Location: pulumi.Any(example_ekmconnection.Location),
Name: pulumi.Any(example_ekmconnection.Name),
Role: pulumi.String("roles/viewer"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
Condition: &kms.EkmConnectionIamBindingConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Kms.EkmConnectionIamBinding("binding", new()
{
Project = example_ekmconnection.Project,
Location = example_ekmconnection.Location,
Name = example_ekmconnection.Name,
Role = "roles/viewer",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Kms.Inputs.EkmConnectionIamBindingConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamBinding;
import com.pulumi.gcp.kms.EkmConnectionIamBindingArgs;
import com.pulumi.gcp.kms.inputs.EkmConnectionIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new EkmConnectionIamBinding("binding", EkmConnectionIamBindingArgs.builder()
.project(example_ekmconnection.project())
.location(example_ekmconnection.location())
.name(example_ekmconnection.name())
.role("roles/viewer")
.members("user:jane@example.com")
.condition(EkmConnectionIamBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
binding:
type: gcp:kms:EkmConnectionIamBinding
properties:
project: ${["example-ekmconnection"].project}
location: ${["example-ekmconnection"].location}
name: ${["example-ekmconnection"].name}
role: roles/viewer
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block attaches constraints to the role binding. The expression property uses CEL (Common Expression Language) to define when the binding is active; here, it expires at midnight on 2020-01-01. The title and description provide human-readable context. IAM evaluates conditions on every request, automatically denying access once the expression returns false.
Add a single member with EkmConnectionIamMember
When you need to grant access to one additional user without replacing existing permissions, use EkmConnectionIamMember for non-authoritative updates.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.kms.EkmConnectionIamMember("member", {
project: example_ekmconnection.project,
location: example_ekmconnection.location,
name: example_ekmconnection.name,
role: "roles/viewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.kms.EkmConnectionIamMember("member",
project=example_ekmconnection["project"],
location=example_ekmconnection["location"],
name=example_ekmconnection["name"],
role="roles/viewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := kms.NewEkmConnectionIamMember(ctx, "member", &kms.EkmConnectionIamMemberArgs{
Project: pulumi.Any(example_ekmconnection.Project),
Location: pulumi.Any(example_ekmconnection.Location),
Name: pulumi.Any(example_ekmconnection.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Kms.EkmConnectionIamMember("member", new()
{
Project = example_ekmconnection.Project,
Location = example_ekmconnection.Location,
Name = example_ekmconnection.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamMember;
import com.pulumi.gcp.kms.EkmConnectionIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new EkmConnectionIamMember("member", EkmConnectionIamMemberArgs.builder()
.project(example_ekmconnection.project())
.location(example_ekmconnection.location())
.name(example_ekmconnection.name())
.role("roles/viewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:kms:EkmConnectionIamMember
properties:
project: ${["example-ekmconnection"].project}
location: ${["example-ekmconnection"].location}
name: ${["example-ekmconnection"].name}
role: roles/viewer
member: user:jane@example.com
The member property specifies a single identity to add to the role. Unlike EkmConnectionIamBinding, this resource is non-authoritative: it adds one member without affecting other members already granted the same role. Use this when multiple teams manage access independently, or when you need to add users incrementally without coordinating with other bindings.
Beyond these examples
These snippets focus on specific IAM binding features: role binding with multiple members, time-based conditional access, and non-authoritative member addition. They’re intentionally minimal rather than complete access control configurations.
The examples reference pre-existing infrastructure such as EKM connections (referenced as example_ekmconnection) and GCP project and location configuration. They focus on configuring IAM bindings rather than provisioning the underlying EKM connections.
To keep things focused, common IAM patterns are omitted, including:
- Full policy replacement (EkmConnectionIamPolicy)
- Complex IAM Condition expressions beyond time-based
- Custom role definitions and formatting
- Federated identity and workload identity pool configuration
These omissions are intentional: the goal is to illustrate how each IAM binding approach is wired, not provide drop-in access control modules. See the EkmConnectionIamBinding resource reference for all available configuration options.
Let's manage GCP Cloud KMS EKM Connection IAM Bindings
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.kms.EkmConnectionIamPolicy is fully authoritative and replaces the entire IAM policy. gcp.kms.EkmConnectionIamBinding is authoritative for a specific role, preserving other roles. gcp.kms.EkmConnectionIamMember is non-authoritative, adding a single member while preserving other members for that role.gcp.kms.EkmConnectionIamPolicy cannot be used with gcp.kms.EkmConnectionIamBinding or gcp.kms.EkmConnectionIamMember as they will conflict. However, gcp.kms.EkmConnectionIamBinding and gcp.kms.EkmConnectionIamMember can be used together only if they manage different roles.gcp.kms.EkmConnectionIamPolicy to manage the complete policy, gcp.kms.EkmConnectionIamBinding to manage all members for a specific role, or gcp.kms.EkmConnectionIamMember to add individual members without affecting others.IAM Configuration
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, and federated identities like principal://iam.googleapis.com/....[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.gcp.kms.EkmConnectionIamBinding can be used per role since it’s authoritative for that role.IAM Conditions
condition property with title, description, and expression fields. For example, to expire access: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".