Manage GCP Region Backend Service IAM Permissions

The gcp:compute/regionBackendServiceIamMember:RegionBackendServiceIamMember resource, part of the Pulumi GCP provider, grants IAM roles to individual members on RegionBackendService resources without affecting other role assignments. This guide focuses on three capabilities: single-member role grants, time-limited access with IAM Conditions, and authoritative role bindings.

GCP provides three related resources for managing RegionBackendService IAM: RegionBackendServiceIamMember (non-authoritative, adds one member), RegionBackendServiceIamBinding (authoritative for a role, replaces all members), and RegionBackendServiceIamPolicy (authoritative for entire policy, replaces everything). The examples are intentionally small. Combine them with your own RegionBackendService resources and organizational IAM strategy.

Grant a role to a single member

Most IAM configurations start by granting a specific role to one user or service account without affecting others who already have that role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.RegionBackendServiceIamMember("member", {
    project: _default.project,
    region: _default.region,
    name: _default.name,
    role: "roles/compute.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.RegionBackendServiceIamMember("member",
    project=default["project"],
    region=default["region"],
    name=default["name"],
    role="roles/compute.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewRegionBackendServiceIamMember(ctx, "member", &compute.RegionBackendServiceIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Region:  pulumi.Any(_default.Region),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.admin"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.RegionBackendServiceIamMember("member", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        Name = @default.Name,
        Role = "roles/compute.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionBackendServiceIamMember;
import com.pulumi.gcp.compute.RegionBackendServiceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RegionBackendServiceIamMember("member", RegionBackendServiceIamMemberArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .name(default_.name())
            .role("roles/compute.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:RegionBackendServiceIamMember
    properties:
      project: ${default.project}
      region: ${default.region}
      name: ${default.name}
      role: roles/compute.admin
      member: user:jane@example.com

The member property identifies who receives access using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property specifies the permission set to grant. RegionBackendServiceIamMember is non-authoritative: it adds this member to the role without removing existing members.

Add time-limited access with IAM Conditions

Teams often grant temporary access that expires automatically, such as contractor access or time-boxed troubleshooting.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.RegionBackendServiceIamMember("member", {
    project: _default.project,
    region: _default.region,
    name: _default.name,
    role: "roles/compute.admin",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.RegionBackendServiceIamMember("member",
    project=default["project"],
    region=default["region"],
    name=default["name"],
    role="roles/compute.admin",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewRegionBackendServiceIamMember(ctx, "member", &compute.RegionBackendServiceIamMemberArgs{
			Project: pulumi.Any(_default.Project),
			Region:  pulumi.Any(_default.Region),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.admin"),
			Member:  pulumi.String("user:jane@example.com"),
			Condition: &compute.RegionBackendServiceIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.RegionBackendServiceIamMember("member", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        Name = @default.Name,
        Role = "roles/compute.admin",
        Member = "user:jane@example.com",
        Condition = new Gcp.Compute.Inputs.RegionBackendServiceIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionBackendServiceIamMember;
import com.pulumi.gcp.compute.RegionBackendServiceIamMemberArgs;
import com.pulumi.gcp.compute.inputs.RegionBackendServiceIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RegionBackendServiceIamMember("member", RegionBackendServiceIamMemberArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .name(default_.name())
            .role("roles/compute.admin")
            .member("user:jane@example.com")
            .condition(RegionBackendServiceIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:compute:RegionBackendServiceIamMember
    properties:
      project: ${default.project}
      region: ${default.region}
      name: ${default.name}
      role: roles/compute.admin
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds time-based or attribute-based restrictions to the role grant. The expression property uses CEL (Common Expression Language) to define when access is valid. Here, access expires at midnight on 2020-01-01. IAM Conditions have known limitations; review Google Cloud’s documentation before relying on complex expressions.

Manage all members for a role with binding

When you need to define the complete list of members for a role, RegionBackendServiceIamBinding provides authoritative control.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.RegionBackendServiceIamBinding("binding", {
    project: _default.project,
    region: _default.region,
    name: _default.name,
    role: "roles/compute.admin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.RegionBackendServiceIamBinding("binding",
    project=default["project"],
    region=default["region"],
    name=default["name"],
    role="roles/compute.admin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewRegionBackendServiceIamBinding(ctx, "binding", &compute.RegionBackendServiceIamBindingArgs{
			Project: pulumi.Any(_default.Project),
			Region:  pulumi.Any(_default.Region),
			Name:    pulumi.Any(_default.Name),
			Role:    pulumi.String("roles/compute.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.RegionBackendServiceIamBinding("binding", new()
    {
        Project = @default.Project,
        Region = @default.Region,
        Name = @default.Name,
        Role = "roles/compute.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.RegionBackendServiceIamBinding;
import com.pulumi.gcp.compute.RegionBackendServiceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new RegionBackendServiceIamBinding("binding", RegionBackendServiceIamBindingArgs.builder()
            .project(default_.project())
            .region(default_.region())
            .name(default_.name())
            .role("roles/compute.admin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:RegionBackendServiceIamBinding
    properties:
      project: ${default.project}
      region: ${default.region}
      name: ${default.name}
      role: roles/compute.admin
      members:
        - user:jane@example.com

The members property lists all identities that should have this role. RegionBackendServiceIamBinding is authoritative for the specified role: it replaces any existing members with this list. Use this when you want to ensure only these members have the role, not when adding to existing grants.

Beyond these examples

These snippets focus on specific IAM grant features: single-member grants (IamMember), role-level member lists (IamBinding), and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control policies.

The examples reference pre-existing infrastructure such as RegionBackendService resources and GCP project and region configuration. They focus on granting access rather than provisioning the backend services themselves.

To keep things focused, common IAM patterns are omitted, including:

Full policy replacement (RegionBackendServiceIamPolicy)
Multiple roles per resource
Custom role definitions and formatting
Federated identity and workload identity pool configuration

These omissions are intentional: the goal is to illustrate how each IAM grant type is wired, not provide drop-in access control modules. See the RegionBackendServiceIamMember resource reference for all available configuration options.

Let's manage GCP Region Backend Service IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Can I use RegionBackendServiceIamPolicy with IamBinding or IamMember?

No, RegionBackendServiceIamPolicy cannot be used with RegionBackendServiceIamBinding or RegionBackendServiceIamMember as they will conflict over the policy configuration.

Can I use IamBinding and IamMember together?

Yes, but only if they don’t grant privileges to the same role. Using both for the same role will cause conflicts.

Which IAM resource should I use for my use case?

Use RegionBackendServiceIamPolicy to replace the entire policy authoritatively, RegionBackendServiceIamBinding to authoritatively manage all members for a specific role, or RegionBackendServiceIamMember to non-authoritatively add individual members to a role.

Configuration & Identity Management

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

How do I specify a custom IAM role?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.

What properties are immutable after creation?

All input properties are immutable: member, role, name, project, region, and condition. Changes require resource replacement.

Advanced Features

Can I use IAM Conditions with this resource?

Yes, IAM Conditions are supported via the condition property with title, description, and expression fields. However, be aware of known limitations.

What are the limitations of IAM Conditions?

IAM Conditions have known limitations that may cause issues. Review the GCP documentation on IAM Conditions limitations if you encounter problems.

How do I add a time-based IAM Condition?

Set condition with a title, description, and expression like request.time < timestamp("2020-01-01T00:00:00Z") as shown in the examples.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides