Manage GCP KMS Key Ring IAM Permissions

The gcp:kms/keyRingIAMBinding:KeyRingIAMBinding resource, part of the Pulumi GCP provider, grants IAM roles to members on a KMS key ring. This resource is authoritative for a given role: it replaces all members for that role while preserving other roles on the key ring. This guide focuses on three capabilities: granting roles to multiple members, adding individual members non-authoritatively, and time-limited access with IAM Conditions.

Key ring IAM resources reference existing key rings by ID. The examples are intentionally small. Combine them with your own key ring infrastructure and organizational access patterns.

Grant a role to multiple members

Most KMS access control starts by granting a specific role to a list of users or service accounts.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMBinding("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMBinding(ctx, "key_ring", &kms.KeyRingIAMBindingArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMBinding;
import com.pulumi.gcp.kms.KeyRingIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMBinding("keyRing", KeyRingIAMBindingArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMBinding
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      members:
        - user:jane@example.com

The keyRingId property identifies the key ring using the format {project_id}/{location_name}/{key_ring_name}. The role property specifies which IAM role to grant. The members array lists all identities that should receive this role. KeyRingIAMBinding is authoritative for the specified role: it replaces any existing members for that role but leaves other roles untouched.

Grant time-limited access with IAM Conditions

Temporary access grants expire automatically when IAM Conditions evaluate to false, eliminating manual cleanup.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMBinding("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMBinding("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMBinding(ctx, "key_ring", &kms.KeyRingIAMBindingArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &kms.KeyRingIAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMBinding("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Kms.Inputs.KeyRingIAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMBinding;
import com.pulumi.gcp.kms.KeyRingIAMBindingArgs;
import com.pulumi.gcp.kms.inputs.KeyRingIAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMBinding("keyRing", KeyRingIAMBindingArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .members("user:jane@example.com")
            .condition(KeyRingIAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMBinding
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds time-based or attribute-based restrictions to the role grant. The expression property uses Common Expression Language (CEL) to define when the grant is active. Here, request.time < timestamp("2020-01-01T00:00:00Z") expires the grant at midnight on January 1, 2020. The title and description properties document the condition’s purpose.

Add a single member to a role

When multiple teams manage access to the same key ring, KeyRingIAMMember adds individual members without affecting others.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const keyRing = new gcp.kms.KeyRingIAMMember("key_ring", {
    keyRingId: "your-key-ring-id",
    role: "roles/cloudkms.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

key_ring = gcp.kms.KeyRingIAMMember("key_ring",
    key_ring_id="your-key-ring-id",
    role="roles/cloudkms.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/kms"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := kms.NewKeyRingIAMMember(ctx, "key_ring", &kms.KeyRingIAMMemberArgs{
			KeyRingId: pulumi.String("your-key-ring-id"),
			Role:      pulumi.String("roles/cloudkms.admin"),
			Member:    pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var keyRing = new Gcp.Kms.KeyRingIAMMember("key_ring", new()
    {
        KeyRingId = "your-key-ring-id",
        Role = "roles/cloudkms.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.kms.KeyRingIAMMember;
import com.pulumi.gcp.kms.KeyRingIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var keyRing = new KeyRingIAMMember("keyRing", KeyRingIAMMemberArgs.builder()
            .keyRingId("your-key-ring-id")
            .role("roles/cloudkms.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  keyRing:
    type: gcp:kms:KeyRingIAMMember
    name: key_ring
    properties:
      keyRingId: your-key-ring-id
      role: roles/cloudkms.admin
      member: user:jane@example.com

The member property specifies a single identity to grant the role. Unlike KeyRingIAMBinding, KeyRingIAMMember is non-authoritative: it adds one member without replacing existing members for the same role. Use KeyRingIAMMember when different Pulumi stacks or teams need to grant the same role independently.

Beyond these examples

These snippets focus on specific key ring IAM features: role binding with member lists, single-member grants, and time-based IAM Conditions. They’re intentionally minimal rather than full access control policies.

The examples reference pre-existing infrastructure such as KMS key rings. They focus on granting access rather than provisioning the key rings themselves.

To keep things focused, common IAM patterns are omitted, including:

KeyRingIAMPolicy for full policy replacement
Custom role definitions
Condition expressions beyond time-based expiration
Service account impersonation grants

These omissions are intentional: the goal is to illustrate how each IAM grant type is wired, not provide drop-in access control modules. See the KeyRingIAMBinding resource reference for all available configuration options.

Let's manage GCP KMS Key Ring IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between KeyRingIAMPolicy, KeyRingIAMBinding, and KeyRingIAMMember?

KeyRingIAMPolicy is authoritative and replaces the entire IAM policy. KeyRingIAMBinding is authoritative for a specific role but preserves other roles. KeyRingIAMMember is non-authoritative and preserves other members for the same role.

Can I use KeyRingIAMPolicy together with KeyRingIAMBinding or KeyRingIAMMember?

No, KeyRingIAMPolicy cannot be used with KeyRingIAMBinding or KeyRingIAMMember because they will conflict over the policy. Choose one approach: use KeyRingIAMPolicy alone for full control, or use KeyRingIAMBinding/KeyRingIAMMember for role-level or member-level management.

Can I use KeyRingIAMBinding and KeyRingIAMMember together?

Yes, but only if they manage different roles. Using both for the same role will cause conflicts.

Can I create multiple KeyRingIAMBinding resources for the same role?

No, only one KeyRingIAMBinding can be used per role. For managing multiple members individually, use KeyRingIAMMember instead.

Configuration & Identity Management

What member identity formats are supported?

The members property supports: allUsers (anyone on the internet), allAuthenticatedUsers (anyone with a Google account), user:{emailid} (specific Google account), serviceAccount:{emailid} (service account), group:{emailid} (Google group), and domain:{domain} (G Suite domain).

What format should I use for custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.

IAM Conditions & Advanced Features

How do I add time-based access restrictions?

Use the condition property with title, description, and expression. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.

Immutability & Constraints

What properties can't I change after creating a KeyRingIAMBinding?

The keyRingId, role, and condition properties are immutable and cannot be changed after creation.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides