Manage GCP KMS Key Ring IAM Permissions

The gcp:kms/keyRingIAMBinding:KeyRingIAMBinding resource, part of the Pulumi GCP provider, grants a specific IAM role to a list of members on a KMS key ring. This resource is authoritative for the specified role: it replaces any existing members for that role while preserving other roles on the key ring. This guide focuses on two capabilities: granting roles to multiple members and implementing time-limited access with IAM Conditions.

KeyRingIAMBinding references existing KMS key rings. The examples are intentionally small. Combine them with your own key ring infrastructure and member lists.

Grant a role to multiple members

Teams managing encryption keys need to grant specific roles to groups of users or service accounts.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMBinding("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMBinding(ctx, "key_ring", &kms.KeyRingIAMBindingArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMBinding;
import com.pulumi.gcp.kms.KeyRingIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMBinding("keyRing", KeyRingIAMBindingArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMBinding
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      members:
        - user:jane@example.com

The keyRingId property identifies the target key ring. The role property specifies which IAM role to grant (e.g., roles/cloudkms.admin). The members array lists all identities that should have this role; this binding replaces any existing members for this role while leaving other roles unchanged.

Grant time-limited access with IAM Conditions

Organizations implementing temporary access can use IAM Conditions to automatically expire permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMBinding("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMBinding(ctx, "key_ring", &kms.KeyRingIAMBindingArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &kms.KeyRingIAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Kms.Inputs.KeyRingIAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMBinding;
import com.pulumi.gcp.kms.KeyRingIAMBindingArgs;
import com.pulumi.gcp.kms.inputs.KeyRingIAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMBinding("keyRing", KeyRingIAMBindingArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .members("user:jane@example.com")
            .condition(KeyRingIAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMBinding
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds time-based restrictions to the role binding. The expression property uses CEL (Common Expression Language) to define when access is valid; here, access expires at midnight on 2020-01-01. The title and description properties document the condition’s purpose for auditing and troubleshooting.

Beyond these examples

These snippets focus on specific KeyRingIAMBinding features: role-based access control and time-based IAM Conditions. They’re intentionally minimal rather than full access management solutions.

The examples reference pre-existing infrastructure such as KMS key rings. They focus on configuring role bindings rather than provisioning key rings or defining custom roles.

To keep things focused, common IAM patterns are omitted, including:

KeyRingIAMPolicy for full policy replacement
KeyRingIAMMember for single-member grants
Complex condition expressions (resource attributes, request context)
Custom role definitions

These omissions are intentional: the goal is to illustrate how KeyRingIAMBinding wires role grants, not provide drop-in access management modules. See the KeyRingIAMBinding resource reference for all available configuration options.

Let's manage GCP KMS Key Ring IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

Can I use KeyRingIAMPolicy with KeyRingIAMBinding or KeyRingIAMMember?

No, gcp.kms.KeyRingIAMPolicy cannot be used with gcp.kms.KeyRingIAMBinding or gcp.kms.KeyRingIAMMember because they’ll conflict over the policy. Choose one approach: use KeyRingIAMPolicy alone (authoritative), or use KeyRingIAMBinding/KeyRingIAMMember together.

Can I use KeyRingIAMBinding and KeyRingIAMMember together?

Yes, but only if they don’t grant the same role. gcp.kms.KeyRingIAMBinding and gcp.kms.KeyRingIAMMember can coexist as long as each manages different roles.

IAM Configuration

What identity formats can I use in the members list?

You can use six identity formats:

allUsers (anyone on the internet)
allAuthenticatedUsers (anyone with a Google account)
user:{email} (specific Google account)
serviceAccount:{email} (service account)
group:{email} (Google group)
domain:{domain} (all users in a G Suite domain)

What format do custom roles need?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. Standard roles like roles/cloudkms.admin don’t require this format.

What format does keyRingId accept?

keyRingId accepts two formats: {project_id}/{location_name}/{key_ring_name} or {location_name}/{key_ring_name}. The shorter format uses your provider’s project setting as a fallback.

IAM Conditions & Advanced Features

How do I add time-based or conditional access to a binding?

Use the condition property with title, description, and expression fields. For example, to expire access at a specific time, set expression to request.time < timestamp("2020-01-01T00:00:00Z").

Resource Properties & Immutability

What properties can't I change after creating a KeyRingIAMBinding?

Three properties are immutable: keyRingId, role, and condition. Changing any of these requires recreating the resource. You can modify members without recreation.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides