Manage GCP KMS Key Ring IAM Policies

The gcp:kms/keyRingIAMPolicy:KeyRingIAMPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Cloud KMS key rings by setting the complete IAM policy. This guide focuses on three capabilities: authoritative policy replacement, non-authoritative member grants, and time-bound access with IAM conditions.

This resource is one of three IAM management options for key rings. KeyRingIAMPolicy replaces the entire policy (authoritative), KeyRingIAMBinding manages all members for a specific role (authoritative for that role), and KeyRingIAMMember adds individual members without affecting others (non-authoritative). The examples are intentionally small. Combine them with your own key ring infrastructure and access requirements.

Replace the entire IAM policy for a key ring

When you need complete control over who can access a key ring, KeyRingIAMPolicy replaces the entire IAM policy with your specified bindings.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyring = new gcp.kms.KeyRing("keyring", {
    name: "keyring-example",
    location: "global",
});
const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
    }],
});
const keyRing = new gcp.kms.KeyRingIAMPolicy("key_ring", {
    keyRingId: keyring.id,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring",
    name="keyring-example",
    location="global")
admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
}])
key_ring = gcp.kms.KeyRingIAMPolicy("key_ring",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keyring, err := kms.NewKeyRing(ctx, "keyring", &kms.KeyRingArgs{
			Name:     pulumi.String("keyring-example"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewKeyRingIAMPolicy(ctx, "key_ring", &kms.KeyRingIAMPolicyArgs{
			KeyRingId:  keyring.ID(),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new()
    {
        Name = "keyring-example",
        Location = "global",
    });

    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var keyRing = new Gcp.Kms.KeyRingIAMPolicy("key_ring", new()
    {
        KeyRingId = keyring.Id,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRing;
import com.pulumi.gcp.kms.KeyRingArgs;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.kms.KeyRingIAMPolicy;
import com.pulumi.gcp.kms.KeyRingIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyring = new KeyRing("keyring", KeyRingArgs.builder()
            .name("keyring-example")
            .location("global")
            .build());

        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:jane@example.com")
                .build())
            .build());

        var keyRing = new KeyRingIAMPolicy("keyRing", KeyRingIAMPolicyArgs.builder()
            .keyRingId(keyring.id())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  keyring:
    type: gcp:kms:KeyRing
    properties:
      name: keyring-example
      location: global
  keyRing:
    type: gcp:kms:KeyRingIAMPolicy
    name: key_ring
    properties:
      keyRingId: ${keyring.id}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:jane@example.com

The policyData property comes from gcp.organizations.getIAMPolicy, which converts bindings into the policy format KMS expects. This resource is authoritative: it removes any existing IAM bindings not included in your policy data. The keyRingId references the key ring you’re securing.

Set time-bound access with IAM conditions

IAM conditions let you grant temporary access that expires automatically, useful for contractors or time-limited projects.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyring = new gcp.kms.KeyRing("keyring", {
    name: "keyring-example",
    location: "global",
});
const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:jane@example.com"],
        condition: {
            title: "expires_after_2019_12_31",
            description: "Expiring at midnight of 2019-12-31",
            expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    }],
});
const keyRing = new gcp.kms.KeyRingIAMPolicy("key_ring", {
    keyRingId: keyring.id,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

keyring = gcp.kms.KeyRing("keyring",
    name="keyring-example",
    location="global")
admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:jane@example.com"],
    "condition": {
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
}])
key_ring = gcp.kms.KeyRingIAMPolicy("key_ring",
    key_ring_id=keyring.id,
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		keyring, err := kms.NewKeyRing(ctx, "keyring", &kms.KeyRingArgs{
			Name:     pulumi.String("keyring-example"),
			Location: pulumi.String("global"),
		})
		if err != nil {
			return err
		}
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:jane@example.com",
					},
					Condition: {
						Title:       "expires_after_2019_12_31",
						Description: pulumi.StringRef("Expiring at midnight of 2019-12-31"),
						Expression:  "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = kms.NewKeyRingIAMPolicy(ctx, "key_ring", &kms.KeyRingIAMPolicyArgs{
			KeyRingId:  keyring.ID(),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyring = new Gcp.Kms.KeyRing("keyring", new()
    {
        Name = "keyring-example",
        Location = "global",
    });

    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "expires_after_2019_12_31",
                    Description = "Expiring at midnight of 2019-12-31",
                    Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
                },
            },
        },
    });

    var keyRing = new Gcp.Kms.KeyRingIAMPolicy("key_ring", new()
    {
        KeyRingId = keyring.Id,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRing;
import com.pulumi.gcp.kms.KeyRingArgs;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.kms.KeyRingIAMPolicy;
import com.pulumi.gcp.kms.KeyRingIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyring = new KeyRing("keyring", KeyRingArgs.builder()
            .name("keyring-example")
            .location("global")
            .build());

        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:jane@example.com")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("expires_after_2019_12_31")
                    .description("Expiring at midnight of 2019-12-31")
                    .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                    .build())
                .build())
            .build());

        var keyRing = new KeyRingIAMPolicy("keyRing", KeyRingIAMPolicyArgs.builder()
            .keyRingId(keyring.id())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  keyring:
    type: gcp:kms:KeyRing
    properties:
      name: keyring-example
      location: global
  keyRing:
    type: gcp:kms:KeyRingIAMPolicy
    name: key_ring
    properties:
      keyRingId: ${keyring.id}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:jane@example.com
            condition:
              title: expires_after_2019_12_31
              description: Expiring at midnight of 2019-12-31
              expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal constraints to role bindings. The expression uses CEL (Common Expression Language) to compare request.time against a timestamp. When the condition evaluates to false, the binding no longer grants access. The title and description help identify the condition’s purpose in audit logs.

Grant a role to a single member non-authoritatively

When multiple teams manage access to the same key ring, KeyRingIAMMember adds individual members without affecting other bindings.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMMember("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMMember(ctx, "key_ring", &kms.KeyRingIAMMemberArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Member:    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMMember("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMMember;
import com.pulumi.gcp.kms.KeyRingIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMMember("keyRing", KeyRingIAMMemberArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMMember
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      member: user:jane@example.com

The member property specifies a single principal (user, service account, or group). Unlike KeyRingIAMPolicy, this resource is non-authoritative: it adds the member to the role without removing existing members. This prevents conflicts when different Pulumi stacks or tools manage the same key ring.

Add time-bound member access non-authoritatively

Combining non-authoritative member grants with conditions lets you add temporary access without disrupting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMMember("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMMember(ctx, "key_ring", &kms.KeyRingIAMMemberArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Member:    pulumi.String("user:jane@example.com"),
			Condition: &kms.KeyRingIAMMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMMember("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Member = "user:jane@example.com",
        Condition = new Gcp.Kms.Inputs.KeyRingIAMMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMMember;
import com.pulumi.gcp.kms.KeyRingIAMMemberArgs;
import com.pulumi.gcp.kms.inputs.KeyRingIAMMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMMember("keyRing", KeyRingIAMMemberArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .member("user:jane@example.com")
            .condition(KeyRingIAMMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMMember
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

This combines the non-authoritative behavior of KeyRingIAMMember with IAM conditions. The member gets the specified role only while the condition evaluates to true. Other members and their conditions remain unchanged.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management, IAM conditions for time-bound access, and policy data generation from bindings. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as KMS key rings, which must be created separately or referenced by ID. They focus on IAM policy configuration rather than provisioning the key rings themselves.

To keep things focused, common IAM patterns are omitted, including:

KeyRingIAMBinding for role-level authoritative grants
Multiple members in a single binding
Service account and group principals (only user: shown)
Complex condition expressions (location, resource tags)

These omissions are intentional: the goal is to illustrate how each IAM management approach is wired, not provide drop-in access control modules. See the KeyRingIAMPolicy resource reference for all available configuration options.

Let's manage GCP KMS Key Ring IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between KeyRingIAMPolicy, KeyRingIAMBinding, and KeyRingIAMMember?

Three resources manage KMS key ring IAM with different behaviors:

KeyRingIAMPolicy: Authoritative, replaces the entire IAM policy
KeyRingIAMBinding: Authoritative for a specific role, preserves other roles
KeyRingIAMMember: Non-authoritative, adds a single member while preserving other members for the role

Can I use KeyRingIAMPolicy with KeyRingIAMBinding or KeyRingIAMMember?

No, KeyRingIAMPolicy cannot be used with KeyRingIAMBinding or KeyRingIAMMember because they will conflict over the policy configuration.

Can I use KeyRingIAMBinding and KeyRingIAMMember together?

Yes, but only if they don’t grant privileges to the same role. If both resources manage the same role, they will conflict.

Configuration & Setup

What format does keyRingId accept?

Two formats are supported: {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. The second format uses the provider’s project setting as a fallback.

What happens if I change the keyRingId?

Changing keyRingId forces resource replacement because it’s an immutable property.

Where does policyData come from?

The policyData must be generated by the gcp.organizations.getIAMPolicy data source, as shown in the examples.

Advanced Features

How do I add time-based or conditional IAM permissions?

All three resources support a condition block with title, description, and expression fields. For example, you can set expiration times using expressions like request.time < timestamp("2020-01-01T00:00:00Z").

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides