Manage GCP KMS Key Ring IAM Policies

The gcp:kms/keyRingIAMPolicy:KeyRingIAMPolicy resource, part of the Pulumi GCP provider, controls IAM access to Cloud KMS key rings. Three related resources offer different levels of control: KeyRingIAMPolicy replaces the entire policy, KeyRingIAMBinding manages all members for a specific role, and KeyRingIAMMember adds individual members non-authoritatively. This guide focuses on four capabilities: authoritative policy replacement, role-level member management, non-authoritative member addition, and time-bound access with IAM Conditions.

These resources manage access to existing key rings rather than creating them. KeyRingIAMPolicy cannot be used with KeyRingIAMBinding or KeyRingIAMMember on the same key ring, as they conflict over policy ownership. The examples are intentionally small. Combine them with your own key ring infrastructure and member lists.

Replace the entire IAM policy for a key ring

When you need complete control over who can access a key ring, KeyRingIAMPolicy replaces the entire IAM policy with your configuration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyring = new gcp.kms.KeyRing("keyring", {
    name: "keyring-example",
    location: "global",
});
const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const keyRing = new gcp.kms.KeyRingIAMPolicy("key_ring", {
    keyRingId: keyring.id,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring",
    name="keyring-example",
    location="global")
admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
}])
key_ring = gcp.kms.KeyRingIAMPolicy("key_ring",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keyring, err := kms.NewKeyRing(ctx, "keyring", &kms.KeyRingArgs{
			Name:     pulumi.String("keyring-example"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewKeyRingIAMPolicy(ctx, "key_ring", &kms.KeyRingIAMPolicyArgs{
			KeyRingId:  keyring.ID(),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new()
    {
        Name = "keyring-example",
        Location = "global",
    });

    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var keyRing = new Gcp.Kms.KeyRingIAMPolicy("key_ring", new()
    {
        KeyRingId = keyring.Id,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRing;
import com.pulumi.gcp.kms.KeyRingArgs;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.kms.KeyRingIAMPolicy;
import com.pulumi.gcp.kms.KeyRingIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyring = new KeyRing("keyring", KeyRingArgs.builder()
            .name("keyring-example")
            .location("global")
            .build());

        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:jane@example.com")
                .build())
            .build());

        var keyRing = new KeyRingIAMPolicy("keyRing", KeyRingIAMPolicyArgs.builder()
            .keyRingId(keyring.id())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  keyring:
    type: gcp:kms:KeyRing
    properties:
      name: keyring-example
      location: global
  keyRing:
    type: gcp:kms:KeyRingIAMPolicy
    name: key_ring
    properties:
      keyRingId: ${keyring.id}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:jane@example.com

The policyData property comes from the getIAMPolicy data source, which defines bindings between roles and members. KeyRingIAMPolicy is authoritative: it removes any existing bindings not specified in your policy. The keyRingId references the key ring you’re securing.

Replace policy with time-bound access conditions

IAM Conditions let you grant temporary access that expires automatically, useful for contractors or time-limited projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyring = new gcp.kms.KeyRing("keyring", {
    name: "keyring-example",
    location: "global",
});
const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
        condition: {
            title: "expires_after_2019_12_31",
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    }],
});
const keyRing = new gcp.kms.KeyRingIAMPolicy("key_ring", {
    keyRingId: keyring.id,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring",
    name="keyring-example",
    location="global")
admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
}])
key_ring = gcp.kms.KeyRingIAMPolicy("key_ring",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keyring, err := kms.NewKeyRing(ctx, "keyring", &kms.KeyRingArgs{
			Name:     pulumi.String("keyring-example"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:jane@example.com",
					},
					Condition: {
						Title:       "expires_after_2019_12_31",
						Description: pulumi.StringRef("Expiring at midnight of 2019-12-31"),
						Expression:  "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewKeyRingIAMPolicy(ctx, "key_ring", &kms.KeyRingIAMPolicyArgs{
			KeyRingId:  keyring.ID(),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new()
    {
        Name = "keyring-example",
        Location = "global",
    });

    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "expires_after_2019_12_31",
                    Description = "Expiring at midnight of 2019-12-31",
                    Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
                },
            },
        },
    });

    var keyRing = new Gcp.Kms.KeyRingIAMPolicy("key_ring", new()
    {
        KeyRingId = keyring.Id,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRing;
import com.pulumi.gcp.kms.KeyRingArgs;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.kms.KeyRingIAMPolicy;
import com.pulumi.gcp.kms.KeyRingIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyring = new KeyRing("keyring", KeyRingArgs.builder()
            .name("keyring-example")
            .location("global")
            .build());

        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:jane@example.com")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("expires_after_2019_12_31")
                    .description("Expiring at midnight of 2019-12-31")
                    .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                    .build())
                .build())
            .build());

        var keyRing = new KeyRingIAMPolicy("keyRing", KeyRingIAMPolicyArgs.builder()
            .keyRingId(keyring.id())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  keyring:
    type: gcp:kms:KeyRing
    properties:
      name: keyring-example
      location: global
  keyRing:
    type: gcp:kms:KeyRingIAMPolicy
    name: key_ring
    properties:
      keyRingId: ${keyring.id}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:jane@example.com
            condition:
              title: expires_after_2019_12_31
              description: Expiring at midnight of 2019-12-31
              expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal constraints to role bindings. The expression uses CEL (Common Expression Language) to compare request.time against a timestamp. When the condition evaluates to false, access is denied even if the role binding exists.

Grant a role to multiple members authoritatively

KeyRingIAMBinding controls all members for a specific role, replacing the member list while preserving other roles.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMBinding("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMBinding(ctx, "key_ring", &kms.KeyRingIAMBindingArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMBinding;
import com.pulumi.gcp.kms.KeyRingIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMBinding("keyRing", KeyRingIAMBindingArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMBinding
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      members:
        - user:jane@example.com

The members array lists all identities that should have the specified role. KeyRingIAMBinding is authoritative for this role: any members not in your list are removed. Other roles on the key ring remain unchanged.

Add a single member to a role non-authoritatively

When multiple teams manage access to the same key ring, KeyRingIAMMember adds one member without affecting others.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMMember("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMMember(ctx, "key_ring", &kms.KeyRingIAMMemberArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Member:    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMMember("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMMember;
import com.pulumi.gcp.kms.KeyRingIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMMember("keyRing", KeyRingIAMMemberArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMMember
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      member: user:jane@example.com

The member property specifies a single identity to grant access. KeyRingIAMMember is non-authoritative: it adds this member to the role without removing existing members. Multiple KeyRingIAMMember resources can safely grant the same role to different members.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative access control, IAM Conditions for time-bound access, and role-level and member-level grant management. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as KMS key rings, which must be created separately or referenced by ID. They focus on configuring access rather than provisioning the key rings themselves.

To keep things focused, common IAM patterns are omitted, including:

Service account and group member types (serviceAccount:, group:)
Domain-wide delegation (domain: prefix)
Multiple conditions per binding
Audit logging configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the KeyRingIAMPolicy resource reference for all available configuration options.

Let's manage GCP KMS Key Ring IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between KeyRingIAMPolicy, KeyRingIAMBinding, and KeyRingIAMMember?

KeyRingIAMPolicy is authoritative and replaces the entire IAM policy. KeyRingIAMBinding is authoritative for a specific role but preserves other roles. KeyRingIAMMember is non-authoritative and adds a single member without affecting other members for that role.

Can I use KeyRingIAMPolicy with KeyRingIAMBinding or KeyRingIAMMember?

No, KeyRingIAMPolicy cannot be used with KeyRingIAMBinding or KeyRingIAMMember because they will conflict over the policy.

Can I use KeyRingIAMBinding and KeyRingIAMMember together?

Yes, but only if they grant different roles. Using both for the same role causes conflicts.

Configuration & Setup

How do I generate the policy data for KeyRingIAMPolicy?

Use the gcp.organizations.getIAMPolicy data source to generate policyData, as shown in the examples.

What format should I use for keyRingId?

You can use {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. The second form uses your provider’s project setting as a fallback.

Can I change the key ring ID after creation?

No, keyRingId is immutable and cannot be changed after the resource is created.

Advanced Features

How do I add time-based or conditional access to a key ring?

All three IAM resources support a condition block with title, description, and expression fields. For example, you can set an expiration using request.time < timestamp("2020-01-01T00:00:00Z").

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides