Manage GCP Runtime Config IAM Bindings

The gcp:runtimeconfig/configIamBinding:ConfigIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Runtime Configurator configs. It grants a specific role to a list of members authoritatively, meaning it controls the complete member list for that role. This guide focuses on two capabilities: authoritative role binding for multiple members and non-authoritative single member addition.

IAM bindings reference existing Runtime Configurator configs and require appropriate GCP project permissions. The examples are intentionally small. Combine them with your own config resources and identity management strategy.

Grant a role to multiple members

Teams managing Runtime Configurator access typically grant the same role to multiple users or service accounts at once, ensuring consistent permissions across a group.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.runtimeconfig.ConfigIamBinding("binding", {
    project: config.project,
    config: config.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.runtimeconfig.ConfigIamBinding("binding",
    project=config["project"],
    config=config["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/runtimeconfig"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := runtimeconfig.NewConfigIamBinding(ctx, "binding", &runtimeconfig.ConfigIamBindingArgs{
			Project: pulumi.Any(config.Project),
			Config:  pulumi.Any(config.Name),
			Role:    pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.RuntimeConfig.ConfigIamBinding("binding", new()
    {
        Project = config.Project,
        Config = config.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.runtimeconfig.ConfigIamBinding;
import com.pulumi.gcp.runtimeconfig.ConfigIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new ConfigIamBinding("binding", ConfigIamBindingArgs.builder()
            .project(config.project())
            .config(config.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:runtimeconfig:ConfigIamBinding
    properties:
      project: ${config.project}
      config: ${config.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The binding resource is authoritative for the specified role: it replaces any existing member list for that role on the config. The members array accepts user accounts, service accounts, groups, and special identifiers like allUsers. The config property references the Runtime Configurator config by name, and project specifies where the config lives.

Add a single member to a role

When you need to grant access to one additional user without affecting existing permissions, the non-authoritative member resource adds that identity to the role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.runtimeconfig.ConfigIamMember("member", {
    project: config.project,
    config: config.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.runtimeconfig.ConfigIamMember("member",
    project=config["project"],
    config=config["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/runtimeconfig"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := runtimeconfig.NewConfigIamMember(ctx, "member", &runtimeconfig.ConfigIamMemberArgs{
			Project: pulumi.Any(config.Project),
			Config:  pulumi.Any(config.Name),
			Role:    pulumi.String("roles/viewer"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.RuntimeConfig.ConfigIamMember("member", new()
    {
        Project = config.Project,
        Config = config.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.runtimeconfig.ConfigIamMember;
import com.pulumi.gcp.runtimeconfig.ConfigIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new ConfigIamMember("member", ConfigIamMemberArgs.builder()
            .project(config.project())
            .config(config.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:runtimeconfig:ConfigIamMember
    properties:
      project: ${config.project}
      config: ${config.name}
      role: roles/viewer
      member: user:jane@example.com

Unlike ConfigIamBinding, ConfigIamMember is non-authoritative: it adds one member to a role without removing others. This is useful when multiple teams manage access independently. The member property takes a single identity string, while the role and config properties work the same way as in the binding resource.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Runtime Configurator config resources and a GCP project with appropriate permissions. They focus on configuring IAM bindings rather than provisioning the underlying configs.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy-level management (ConfigIamPolicy resource)
Custom role definitions
Federated identity configuration

These omissions are intentional: the goal is to illustrate how IAM bindings are wired, not provide drop-in access control modules. See the Runtime Config IAM Binding resource reference for all available configuration options.

Let's manage GCP Runtime Config IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

Can I use ConfigIamPolicy with ConfigIamBinding or ConfigIamMember?

No, gcp.runtimeconfig.ConfigIamPolicy cannot be used with gcp.runtimeconfig.ConfigIamBinding or gcp.runtimeconfig.ConfigIamMember because they will conflict over the policy configuration.

Can I use ConfigIamBinding and ConfigIamMember together?

Yes, but only if they don’t grant privileges to the same role. Each role must be managed by either gcp.runtimeconfig.ConfigIamBinding or gcp.runtimeconfig.ConfigIamMember, not both.

Resource Selection & Usage

What's the difference between ConfigIamPolicy, ConfigIamBinding, and ConfigIamMember?

gcp.runtimeconfig.ConfigIamPolicy is authoritative and replaces the entire IAM policy. gcp.runtimeconfig.ConfigIamBinding is authoritative for a specific role, preserving other roles. gcp.runtimeconfig.ConfigIamMember is non-authoritative, adding a single member to a role while preserving other members.

Can I use multiple ConfigIamBinding resources for the same config?

Yes, but only one gcp.runtimeconfig.ConfigIamBinding can be used per role. You can have multiple bindings for different roles on the same config.

Configuration & Formatting

How do I format custom roles in the role parameter?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.

What member identity formats are supported?

The members parameter supports: allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

Provider & Beta Status

Is this resource in beta?

Yes, this resource is in beta and should be used with the terraform-provider-google-beta provider.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides