Manage GCP Organization IAM Policies

The gcp:organizations/iAMPolicy:IAMPolicy resource, part of the Pulumi GCP provider, manages IAM permissions at the organization level through four distinct resource types. IAMPolicy sets the entire policy authoritatively, IAMBinding controls all members for a specific role, IAMMember adds individual members non-authoritatively, and IamAuditConfig enables audit logging. This guide focuses on four capabilities: role binding with IAMBinding, individual member grants with IAMMember, conditional access with time-based expiration, and audit logging configuration.

These resources require an existing GCP organization identified by its numeric organization ID. The examples are intentionally small. Combine them with your own organization structure and access requirements. Note that IAMPolicy cannot be used alongside the other three resource types, as they will conflict over policy state.

Grant a role to multiple members with IAMBinding

When you need to manage all members for a specific role, IAMBinding provides authoritative control over who has that role while preserving other roles in the organization.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const organization = new gcp.organizations.IAMBinding("organization", {
    orgId: "1234567890",
    role: "roles/editor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

organization = gcp.organizations.IAMBinding("organization",
    org_id="1234567890",
    role="roles/editor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.NewIAMBinding(ctx, "organization", &organizations.IAMBindingArgs{
			OrgId: pulumi.String("1234567890"),
			Role:  pulumi.String("roles/editor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var organization = new Gcp.Organizations.IAMBinding("organization", new()
    {
        OrgId = "1234567890",
        Role = "roles/editor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.IAMBinding;
import com.pulumi.gcp.organizations.IAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var organization = new IAMBinding("organization", IAMBindingArgs.builder()
            .orgId("1234567890")
            .role("roles/editor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  organization:
    type: gcp:organizations:IAMBinding
    properties:
      orgId: '1234567890'
      role: roles/editor
      members:
        - user:jane@example.com

IAMBinding replaces the entire member list for the specified role. The orgId identifies your organization, role specifies the permission level (like “roles/editor”), and members lists all principals who should have that role. This resource is authoritative for its role: any members not listed will lose access.

Add time-based access with IAM Conditions

Organizations often need temporary access grants that expire automatically, such as contractor access or time-limited elevated permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const organization = new gcp.organizations.IAMBinding("organization", {
    orgId: "1234567890",
    role: "roles/editor",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

organization = gcp.organizations.IAMBinding("organization",
    org_id="1234567890",
    role="roles/editor",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.NewIAMBinding(ctx, "organization", &organizations.IAMBindingArgs{
			OrgId: pulumi.String("1234567890"),
			Role:  pulumi.String("roles/editor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &organizations.IAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var organization = new Gcp.Organizations.IAMBinding("organization", new()
    {
        OrgId = "1234567890",
        Role = "roles/editor",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Organizations.Inputs.IAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.IAMBinding;
import com.pulumi.gcp.organizations.IAMBindingArgs;
import com.pulumi.gcp.organizations.inputs.IAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var organization = new IAMBinding("organization", IAMBindingArgs.builder()
            .orgId("1234567890")
            .role("roles/editor")
            .members("user:jane@example.com")
            .condition(IAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  organization:
    type: gcp:organizations:IAMBinding
    properties:
      orgId: '1234567890'
      role: roles/editor
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds time-based constraints to role grants. The expression uses CEL (Common Expression Language) to define when access is valid; here, access expires at midnight on 2020-01-01. The title uniquely identifies the condition, and description provides human-readable context. Conditions work with IAMBinding, IAMMember, and IAMPolicy resources.

Add a single member to a role with IAMMember

When multiple teams manage IAM independently, IAMMember allows adding individual members without affecting other members of the same role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const organization = new gcp.organizations.IAMMember("organization", {
    orgId: "1234567890",
    role: "roles/editor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

organization = gcp.organizations.IAMMember("organization",
    org_id="1234567890",
    role="roles/editor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.NewIAMMember(ctx, "organization", &organizations.IAMMemberArgs{
			OrgId:  pulumi.String("1234567890"),
			Role:   pulumi.String("roles/editor"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var organization = new Gcp.Organizations.IAMMember("organization", new()
    {
        OrgId = "1234567890",
        Role = "roles/editor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.IAMMember;
import com.pulumi.gcp.organizations.IAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var organization = new IAMMember("organization", IAMMemberArgs.builder()
            .orgId("1234567890")
            .role("roles/editor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  organization:
    type: gcp:organizations:IAMMember
    properties:
      orgId: '1234567890'
      role: roles/editor
      member: user:jane@example.com

IAMMember is non-authoritative: it adds one member to a role without removing others. Use member (singular) instead of members (plural) to specify a single principal. Multiple IAMMember resources can grant the same role to different members, and they won’t conflict with each other. This approach works well when different teams need to manage their own access grants.

Enable audit logging for organization activity

Compliance and security teams need visibility into who performs what actions across the organization, with optional exemptions for specific users.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const organization = new gcp.organizations.IamAuditConfig("organization", {
    orgId: "1234567890",
    service: "allServices",
    auditLogConfigs: [
        {
            logType: "ADMIN_READ",
        },
        {
            logType: "DATA_READ",
            exemptedMembers: ["user:joebloggs@example.com"],
        },
    ],
});

import pulumi
import pulumi_gcp as gcp

organization = gcp.organizations.IamAuditConfig("organization",
    org_id="1234567890",
    service="allServices",
    audit_log_configs=[
        {
            "log_type": "ADMIN_READ",
        },
        {
            "log_type": "DATA_READ",
            "exempted_members": ["user:joebloggs@example.com"],
        },
    ])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := organizations.NewIamAuditConfig(ctx, "organization", &organizations.IamAuditConfigArgs{
			OrgId:   pulumi.String("1234567890"),
			Service: pulumi.String("allServices"),
			AuditLogConfigs: organizations.IamAuditConfigAuditLogConfigArray{
				&organizations.IamAuditConfigAuditLogConfigArgs{
					LogType: pulumi.String("ADMIN_READ"),
				},
				&organizations.IamAuditConfigAuditLogConfigArgs{
					LogType: pulumi.String("DATA_READ"),
					ExemptedMembers: pulumi.StringArray{
						pulumi.String("user:joebloggs@example.com"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var organization = new Gcp.Organizations.IamAuditConfig("organization", new()
    {
        OrgId = "1234567890",
        Service = "allServices",
        AuditLogConfigs = new[]
        {
            new Gcp.Organizations.Inputs.IamAuditConfigAuditLogConfigArgs
            {
                LogType = "ADMIN_READ",
            },
            new Gcp.Organizations.Inputs.IamAuditConfigAuditLogConfigArgs
            {
                LogType = "DATA_READ",
                ExemptedMembers = new[]
                {
                    "user:joebloggs@example.com",
                },
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.IamAuditConfig;
import com.pulumi.gcp.organizations.IamAuditConfigArgs;
import com.pulumi.gcp.organizations.inputs.IamAuditConfigAuditLogConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var organization = new IamAuditConfig("organization", IamAuditConfigArgs.builder()
            .orgId("1234567890")
            .service("allServices")
            .auditLogConfigs(            
                IamAuditConfigAuditLogConfigArgs.builder()
                    .logType("ADMIN_READ")
                    .build(),
                IamAuditConfigAuditLogConfigArgs.builder()
                    .logType("DATA_READ")
                    .exemptedMembers("user:joebloggs@example.com")
                    .build())
            .build());

    }
}

resources:
  organization:
    type: gcp:organizations:IamAuditConfig
    properties:
      orgId: '1234567890'
      service: allServices
      auditLogConfigs:
        - logType: ADMIN_READ
        - logType: DATA_READ
          exemptedMembers:
            - user:joebloggs@example.com

IamAuditConfig enables Cloud Audit Logs for a service. The service property can target “allServices” or a specific service like “storage.googleapis.com”. Each auditLogConfig entry specifies a logType (ADMIN_READ, DATA_READ, or DATA_WRITE) and optional exemptedMembers who won’t generate logs. This resource is authoritative for its service: it replaces any existing audit configuration.

Beyond these examples

These snippets focus on specific organization IAM features: role binding and member management, conditional access with time-based expiration, and audit logging configuration. They’re intentionally minimal rather than full access control systems.

The examples require pre-existing infrastructure such as a GCP organization with numeric organization ID. They focus on configuring IAM permissions rather than provisioning the organization itself.

To keep things focused, common IAM patterns are omitted, including:

IAMPolicy resource (authoritative, replaces entire policy)
Custom role definitions and organization-level roles
Service account creation and management
Policy conflict resolution between resource types

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Organizations IAMPolicy resource reference for all available configuration options.

Let's manage GCP Organization IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resource should I use for managing organization permissions?

Choose based on your needs:

gcp.organizations.IAMPolicy: Authoritative, replaces entire policy (use with extreme caution)
gcp.organizations.IAMBinding: Authoritative for a specific role, preserves other roles
gcp.organizations.IAMMember: Non-authoritative, adds individual members without affecting others
gcp.organizations.IamAuditConfig: Authoritative for audit logging on a specific service

Can I use IAMPolicy with IAMBinding or IAMMember?

No, gcp.organizations.IAMPolicy cannot be used with gcp.organizations.IAMBinding, gcp.organizations.IAMMember, or gcp.organizations.IamAuditConfig as they will conflict over policy state.

Can I use IAMBinding with IAMMember?

Yes, but only if they don’t grant privileges to the same role. Using both for the same role will cause conflicts.

Access Control Risks

How do I avoid locking myself out of my organization?

Follow these precautions:

When using gcp.organizations.IAMPolicy, import your existing policy first and examine diffs carefully, as it overwrites default policies
When setting role to roles/owner, always include a user or service account you have access to in members
Understand that deleting gcp.organizations.IAMPolicy removes all policies, potentially locking out users

Recovery from lockout requires contacting Google Support and can take multiple days.

What happens if I delete an IAMPolicy resource?

Deleting gcp.organizations.IAMPolicy removes all policies from the organization, locking out users without organization-level access.

When should I use IAMPolicy instead of IAMBinding?

Use gcp.organizations.IAMPolicy only for organizations fully managed by Pulumi. The safer alternative is multiple gcp.organizations.IAMBinding resources, as IAMPolicy overwrites default policies and makes it easy to accidentally remove your own access.

IAM Conditions

How do I set up time-based access with IAM conditions?

Add a condition block with title, description, and expression. For example, to expire access at midnight on 2019-12-31: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".

Import & Migration

How do I import IAM resources with custom roles?

Use the full custom role name in the format organizations/{{org_id}}/roles/{{role_id}} when importing.

How do I import IAM bindings that have conditions?

Include the condition title in your import command: terraform import google_organization_iam_binding.my_organization "your-org-id roles/{{role_id}} condition-title".

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides