The gcp:compute/machineImageIamPolicy:MachineImageIamPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Compute Engine machine images. Three related resources provide different management approaches: MachineImageIamPolicy (authoritative), MachineImageIamBinding (authoritative per role), and MachineImageIamMember (non-authoritative). This guide focuses on three capabilities: authoritative policy replacement, role-based member management, and time-based conditional access.
These resources reference existing machine images and have strict conflict rules. MachineImageIamPolicy cannot be used with Binding or Member resources. Binding and Member can coexist only if they manage different roles. The examples are intentionally small. Choose the resource type that matches your management approach.
Replace the entire IAM policy with MachineImageIamPolicy
When you need complete control over machine image access, you can set the entire IAM policy at once.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const admin = gcp.organizations.getIAMPolicy({
bindings: [{
role: "roles/compute.admin",
members: ["user:jane@example.com"],
}],
});
const policy = new gcp.compute.MachineImageIamPolicy("policy", {
project: image.project,
machineImage: image.name,
policyData: admin.then(admin => admin.policyData),
});
import pulumi
import pulumi_gcp as gcp
admin = gcp.organizations.get_iam_policy(bindings=[{
"role": "roles/compute.admin",
"members": ["user:jane@example.com"],
}])
policy = gcp.compute.MachineImageIamPolicy("policy",
project=image["project"],
machine_image=image["name"],
policy_data=admin.policy_data)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
Bindings: []organizations.GetIAMPolicyBinding{
{
Role: "roles/compute.admin",
Members: []string{
"user:jane@example.com",
},
},
},
}, nil)
if err != nil {
return err
}
_, err = compute.NewMachineImageIamPolicy(ctx, "policy", &compute.MachineImageIamPolicyArgs{
Project: pulumi.Any(image.Project),
MachineImage: pulumi.Any(image.Name),
PolicyData: pulumi.String(admin.PolicyData),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
{
Bindings = new[]
{
new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
{
Role = "roles/compute.admin",
Members = new[]
{
"user:jane@example.com",
},
},
},
});
var policy = new Gcp.Compute.MachineImageIamPolicy("policy", new()
{
Project = image.Project,
MachineImage = image.Name,
PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.compute.MachineImageIamPolicy;
import com.pulumi.gcp.compute.MachineImageIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
.bindings(GetIAMPolicyBindingArgs.builder()
.role("roles/compute.admin")
.members("user:jane@example.com")
.build())
.build());
var policy = new MachineImageIamPolicy("policy", MachineImageIamPolicyArgs.builder()
.project(image.project())
.machineImage(image.name())
.policyData(admin.policyData())
.build());
}
}
resources:
policy:
type: gcp:compute:MachineImageIamPolicy
properties:
project: ${image.project}
machineImage: ${image.name}
policyData: ${admin.policyData}
variables:
admin:
fn::invoke:
function: gcp:organizations:getIAMPolicy
arguments:
bindings:
- role: roles/compute.admin
members:
- user:jane@example.com
The MachineImageIamPolicy resource is authoritative: it replaces any existing policy on the machine image. The policyData comes from the getIAMPolicy data source, which defines bindings between roles and members. This approach gives you full control but requires managing all permissions in one place.
Add time-based access with IAM Conditions
Access requirements often include expiration dates for temporary permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const admin = gcp.organizations.getIAMPolicy({
bindings: [{
role: "roles/compute.admin",
members: ["user:jane@example.com"],
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
}],
});
const policy = new gcp.compute.MachineImageIamPolicy("policy", {
project: image.project,
machineImage: image.name,
policyData: admin.then(admin => admin.policyData),
});
import pulumi
import pulumi_gcp as gcp
admin = gcp.organizations.get_iam_policy(bindings=[{
"role": "roles/compute.admin",
"members": ["user:jane@example.com"],
"condition": {
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
}])
policy = gcp.compute.MachineImageIamPolicy("policy",
project=image["project"],
machine_image=image["name"],
policy_data=admin.policy_data)
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
Bindings: []organizations.GetIAMPolicyBinding{
{
Role: "roles/compute.admin",
Members: []string{
"user:jane@example.com",
},
Condition: {
Title: "expires_after_2019_12_31",
Description: pulumi.StringRef("Expiring at midnight of 2019-12-31"),
Expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
},
},
}, nil)
if err != nil {
return err
}
_, err = compute.NewMachineImageIamPolicy(ctx, "policy", &compute.MachineImageIamPolicyArgs{
Project: pulumi.Any(image.Project),
MachineImage: pulumi.Any(image.Name),
PolicyData: pulumi.String(admin.PolicyData),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
{
Bindings = new[]
{
new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
{
Role = "roles/compute.admin",
Members = new[]
{
"user:jane@example.com",
},
Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
},
},
});
var policy = new Gcp.Compute.MachineImageIamPolicy("policy", new()
{
Project = image.Project,
MachineImage = image.Name,
PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.compute.MachineImageIamPolicy;
import com.pulumi.gcp.compute.MachineImageIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
.bindings(GetIAMPolicyBindingArgs.builder()
.role("roles/compute.admin")
.members("user:jane@example.com")
.condition(GetIAMPolicyBindingConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build())
.build());
var policy = new MachineImageIamPolicy("policy", MachineImageIamPolicyArgs.builder()
.project(image.project())
.machineImage(image.name())
.policyData(admin.policyData())
.build());
}
}
resources:
policy:
type: gcp:compute:MachineImageIamPolicy
properties:
project: ${image.project}
machineImage: ${image.name}
policyData: ${admin.policyData}
variables:
admin:
fn::invoke:
function: gcp:organizations:getIAMPolicy
arguments:
bindings:
- role: roles/compute.admin
members:
- user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
IAM Conditions let you add temporal constraints to permissions. The condition block requires a title, optional description, and an expression using Common Expression Language (CEL). Here, the expression checks that the request time is before midnight on January 1, 2020. When that timestamp passes, the permission automatically revokes.
Grant a role to multiple members with MachineImageIamBinding
Teams often need to grant the same role to multiple users while preserving other roles.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const binding = new gcp.compute.MachineImageIamBinding("binding", {
project: image.project,
machineImage: image.name,
role: "roles/compute.admin",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
binding = gcp.compute.MachineImageIamBinding("binding",
project=image["project"],
machine_image=image["name"],
role="roles/compute.admin",
members=["user:jane@example.com"])
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := compute.NewMachineImageIamBinding(ctx, "binding", &compute.MachineImageIamBindingArgs{
Project: pulumi.Any(image.Project),
MachineImage: pulumi.Any(image.Name),
Role: pulumi.String("roles/compute.admin"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var binding = new Gcp.Compute.MachineImageIamBinding("binding", new()
{
Project = image.Project,
MachineImage = image.Name,
Role = "roles/compute.admin",
Members = new[]
{
"user:jane@example.com",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.MachineImageIamBinding;
import com.pulumi.gcp.compute.MachineImageIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var binding = new MachineImageIamBinding("binding", MachineImageIamBindingArgs.builder()
.project(image.project())
.machineImage(image.name())
.role("roles/compute.admin")
.members("user:jane@example.com")
.build());
}
}
resources:
binding:
type: gcp:compute:MachineImageIamBinding
properties:
project: ${image.project}
machineImage: ${image.name}
role: roles/compute.admin
members:
- user:jane@example.com
The MachineImageIamBinding resource is authoritative for a single role: it defines the complete member list for that role but leaves other roles unchanged. The members array accepts user accounts, service accounts, groups, and domains. This resource is useful when you manage all members for a role together.
Add a single member to a role with MachineImageIamMember
When you need to grant access to one additional user without affecting existing permissions, use the non-authoritative member resource.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.compute.MachineImageIamMember("member", {
project: image.project,
machineImage: image.name,
role: "roles/compute.admin",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.compute.MachineImageIamMember("member",
project=image["project"],
machine_image=image["name"],
role="roles/compute.admin",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := compute.NewMachineImageIamMember(ctx, "member", &compute.MachineImageIamMemberArgs{
Project: pulumi.Any(image.Project),
MachineImage: pulumi.Any(image.Name),
Role: pulumi.String("roles/compute.admin"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Compute.MachineImageIamMember("member", new()
{
Project = image.Project,
MachineImage = image.Name,
Role = "roles/compute.admin",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.MachineImageIamMember;
import com.pulumi.gcp.compute.MachineImageIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new MachineImageIamMember("member", MachineImageIamMemberArgs.builder()
.project(image.project())
.machineImage(image.name())
.role("roles/compute.admin")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:compute:MachineImageIamMember
properties:
project: ${image.project}
machineImage: ${image.name}
role: roles/compute.admin
member: user:jane@example.com
The MachineImageIamMember resource adds one member to a role without replacing existing members. This is the only non-authoritative option: it preserves other members for the same role. Use this when different teams or modules need to grant access independently.
Beyond these examples
These snippets focus on specific IAM management features: authoritative vs non-authoritative IAM management, IAM Conditions for time-based access, and role and member assignment patterns. They’re intentionally minimal rather than full access control configurations.
The examples reference pre-existing infrastructure such as machine images (by name and project). They focus on configuring IAM policies rather than creating the underlying compute resources.
To keep things focused, common IAM patterns are omitted, including:
- Resource conflicts between Policy, Binding, and Member resources
- IAM Conditions limitations and edge cases
- Custom role definitions and management
- Service account creation and management
These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the MachineImageIamPolicy resource reference for all available configuration options.
Let's manage GCP Machine Image IAM Policies
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
What's the difference between MachineImageIamPolicy, MachineImageIamBinding, and MachineImageIamMember?
MachineImageIamPolicy is authoritative and replaces the entire IAM policy. MachineImageIamBinding is authoritative for a specific role but preserves other roles. MachineImageIamMember is non-authoritative and preserves other members for the same role.Can I use MachineImageIamPolicy with MachineImageIamBinding or MachineImageIamMember?
No,
MachineImageIamPolicy cannot be used with MachineImageIamBinding or MachineImageIamMember because they will conflict over the policy configuration.Can I use MachineImageIamBinding and MachineImageIamMember together?
Yes, but only if they don’t grant privileges to the same role. Using both for the same role will cause conflicts.
Configuration & Features
How do I add time-based or conditional access to a machine image?
Use the
condition property with title, description, and expression fields. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") for time-based expiration.Is this resource production-ready?
This resource is in beta and requires the terraform-provider-google-beta provider. Be aware of potential changes in beta resources.
Are there limitations with IAM Conditions?
Yes, IAM Conditions have known limitations. Review the GCP documentation on IAM Conditions limitations if you encounter issues.
Resource Properties
What properties can't I change after creating the resource?
Both
machineImage and project are immutable and cannot be changed after creation.