Manage GCP Cloud KMS EKM Connection IAM Policies

The gcp:kms/ekmConnectionIamPolicy:EkmConnectionIamPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Cloud KMS External Key Manager connections. EKM connections link Cloud KMS to external key management systems for cryptographic operations. This guide focuses on three capabilities: role-based access with binding and member resources, complete policy replacement, and time-based conditional access.

The three IAM resource types (EkmConnectionIamPolicy, EkmConnectionIamBinding, EkmConnectionIamMember) reference existing EKM connections. EkmConnectionIamPolicy cannot be used with EkmConnectionIamBinding or EkmConnectionIamMember on the same connection, as they conflict over policy ownership. The examples are intentionally small. Combine them with your own EKM connection infrastructure and access requirements.

Grant a role to multiple members with IamBinding

Teams managing EKM connection access often grant the same role to multiple users or service accounts while preserving other role assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.kms.EkmConnectionIamBinding("binding", {
    project: example_ekmconnection.project,
    location: example_ekmconnection.location,
    name: example_ekmconnection.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.kms.EkmConnectionIamBinding("binding",
    project=example_ekmconnection["project"],
    location=example_ekmconnection["location"],
    name=example_ekmconnection["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewEkmConnectionIamBinding(ctx, "binding", &kms.EkmConnectionIamBindingArgs{
			Project:  pulumi.Any(example_ekmconnection.Project),
			Location: pulumi.Any(example_ekmconnection.Location),
			Name:     pulumi.Any(example_ekmconnection.Name),
			Role:     pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Kms.EkmConnectionIamBinding("binding", new()
    {
        Project = example_ekmconnection.Project,
        Location = example_ekmconnection.Location,
        Name = example_ekmconnection.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamBinding;
import com.pulumi.gcp.kms.EkmConnectionIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new EkmConnectionIamBinding("binding", EkmConnectionIamBindingArgs.builder()
            .project(example_ekmconnection.project())
            .location(example_ekmconnection.location())
            .name(example_ekmconnection.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:kms:EkmConnectionIamBinding
    properties:
      project: ${["example-ekmconnection"].project}
      location: ${["example-ekmconnection"].location}
      name: ${["example-ekmconnection"].name}
      role: roles/viewer
      members:
        - user:jane@example.com

The EkmConnectionIamBinding resource is authoritative for a single role. It grants the specified role to all members in the members list. Other roles on the connection remain unchanged. The project, location, and name properties identify which EKM connection to modify.

Add time-based access with IAM Conditions

Temporary access grants need expiration logic to revoke permissions automatically after a specific date.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.kms.EkmConnectionIamBinding("binding", {
    project: example_ekmconnection.project,
    location: example_ekmconnection.location,
    name: example_ekmconnection.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.kms.EkmConnectionIamBinding("binding",
    project=example_ekmconnection["project"],
    location=example_ekmconnection["location"],
    name=example_ekmconnection["name"],
    role="roles/viewer",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewEkmConnectionIamBinding(ctx, "binding", &kms.EkmConnectionIamBindingArgs{
			Project:  pulumi.Any(example_ekmconnection.Project),
			Location: pulumi.Any(example_ekmconnection.Location),
			Name:     pulumi.Any(example_ekmconnection.Name),
			Role:     pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &kms.EkmConnectionIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Kms.EkmConnectionIamBinding("binding", new()
    {
        Project = example_ekmconnection.Project,
        Location = example_ekmconnection.Location,
        Name = example_ekmconnection.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Kms.Inputs.EkmConnectionIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamBinding;
import com.pulumi.gcp.kms.EkmConnectionIamBindingArgs;
import com.pulumi.gcp.kms.inputs.EkmConnectionIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new EkmConnectionIamBinding("binding", EkmConnectionIamBindingArgs.builder()
            .project(example_ekmconnection.project())
            .location(example_ekmconnection.location())
            .name(example_ekmconnection.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .condition(EkmConnectionIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:kms:EkmConnectionIamBinding
    properties:
      project: ${["example-ekmconnection"].project}
      location: ${["example-ekmconnection"].location}
      name: ${["example-ekmconnection"].name}
      role: roles/viewer
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions add logic to role bindings. The condition block defines a title, optional description, and expression. The expression uses CEL (Common Expression Language) syntax to evaluate request context. Here, request.time checks against a timestamp to expire access at midnight on 2020-01-01.

Add a single member to a role with IamMember

When adding individual users to existing roles, non-authoritative member resources preserve other members already assigned.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.kms.EkmConnectionIamMember("member", {
    project: example_ekmconnection.project,
    location: example_ekmconnection.location,
    name: example_ekmconnection.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.kms.EkmConnectionIamMember("member",
    project=example_ekmconnection["project"],
    location=example_ekmconnection["location"],
    name=example_ekmconnection["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewEkmConnectionIamMember(ctx, "member", &kms.EkmConnectionIamMemberArgs{
			Project:  pulumi.Any(example_ekmconnection.Project),
			Location: pulumi.Any(example_ekmconnection.Location),
			Name:     pulumi.Any(example_ekmconnection.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Kms.EkmConnectionIamMember("member", new()
    {
        Project = example_ekmconnection.Project,
        Location = example_ekmconnection.Location,
        Name = example_ekmconnection.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.EkmConnectionIamMember;
import com.pulumi.gcp.kms.EkmConnectionIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new EkmConnectionIamMember("member", EkmConnectionIamMemberArgs.builder()
            .project(example_ekmconnection.project())
            .location(example_ekmconnection.location())
            .name(example_ekmconnection.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:kms:EkmConnectionIamMember
    properties:
      project: ${["example-ekmconnection"].project}
      location: ${["example-ekmconnection"].location}
      name: ${["example-ekmconnection"].name}
      role: roles/viewer
      member: user:jane@example.com

The EkmConnectionIamMember resource is non-authoritative. It adds one member to a role without affecting other members. Use member (singular) instead of members (plural). This resource type is safe to use alongside other IamMember resources for the same connection, as long as they don’t grant the same role to the same member.

Replace the entire IAM policy with IamPolicy

Organizations with centralized access control need to enforce a complete IAM configuration that replaces any existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.kms.EkmConnectionIamPolicy("policy", {
    project: example_ekmconnection.project,
    location: example_ekmconnection.location,
    name: example_ekmconnection.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.kms.EkmConnectionIamPolicy("policy",
    project=example_ekmconnection["project"],
    location=example_ekmconnection["location"],
    name=example_ekmconnection["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewEkmConnectionIamPolicy(ctx, "policy", &kms.EkmConnectionIamPolicyArgs{
			Project:    pulumi.Any(example_ekmconnection.Project),
			Location:   pulumi.Any(example_ekmconnection.Location),
			Name:       pulumi.Any(example_ekmconnection.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Kms.EkmConnectionIamPolicy("policy", new()
    {
        Project = example_ekmconnection.Project,
        Location = example_ekmconnection.Location,
        Name = example_ekmconnection.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.kms.EkmConnectionIamPolicy;
import com.pulumi.gcp.kms.EkmConnectionIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new EkmConnectionIamPolicy("policy", EkmConnectionIamPolicyArgs.builder()
            .project(example_ekmconnection.project())
            .location(example_ekmconnection.location())
            .name(example_ekmconnection.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:kms:EkmConnectionIamPolicy
    properties:
      project: ${["example-ekmconnection"].project}
      location: ${["example-ekmconnection"].location}
      name: ${["example-ekmconnection"].name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The EkmConnectionIamPolicy resource is fully authoritative. It replaces the entire IAM policy with the policyData from a gcp.organizations.getIAMPolicy data source. Any existing bindings not in the policy are removed. This resource cannot coexist with EkmConnectionIamBinding or EkmConnectionIamMember resources on the same connection.

Beyond these examples

These snippets focus on specific IAM resource features: role-based access control (binding and member resources), complete policy replacement (policy resource), and time-based conditional access. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as EKM connections (external key manager connections) and GCP project and location configuration. They focus on configuring IAM access rather than provisioning the underlying EKM connections.

To keep things focused, common IAM patterns are omitted, including:

  • Service account and group member types (examples show only user: prefix)
  • Multiple conditions per binding
  • Policy resource conflict prevention (cannot mix with binding/member)
  • Custom role definitions and references

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the EkmConnectionIamPolicy resource reference for all available configuration options.

Let's manage GCP Cloud KMS EKM Connection IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between EkmConnectionIamPolicy, EkmConnectionIamBinding, and EkmConnectionIamMember?
EkmConnectionIamPolicy is authoritative and replaces the entire IAM policy. EkmConnectionIamBinding is authoritative for a specific role, preserving other roles. EkmConnectionIamMember is non-authoritative, adding a single member while preserving existing members for that role.
Which IAM resources can I use together?
You cannot use EkmConnectionIamPolicy with EkmConnectionIamBinding or EkmConnectionIamMember, as they will conflict. However, you can use EkmConnectionIamBinding and EkmConnectionIamMember together if they grant different roles.
Why am I seeing conflicts between my IAM resources?
Using EkmConnectionIamPolicy alongside EkmConnectionIamBinding or EkmConnectionIamMember causes them to fight over the policy. Similarly, using EkmConnectionIamBinding and EkmConnectionIamMember for the same role creates conflicts.
IAM Conditions
How do I add time-based or conditional access restrictions?
Add a condition block with title, description, and expression fields to any IAM resource. For example, use expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" to expire access at a specific time.
Are there limitations when using IAM Conditions?
Yes, IAM Conditions have known limitations. Review the GCP documentation if you encounter issues.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides