Manage GCP Secret Manager IAM Bindings

The gcp:secretmanager/secretIamBinding:SecretIamBinding resource, part of the Pulumi GCP provider, grants IAM roles to members for Secret Manager secrets, with authoritative control over who has each role. This guide focuses on three capabilities: role-based access grants, time-limited access with IAM Conditions, and adding individual members non-authoritatively.

Bindings reference existing secrets and Google Cloud identities. The examples are intentionally small. Combine them with your own secret resources and identity management.

Grant a role to multiple members at once

Teams managing secret access often need to grant the same role to multiple users or service accounts simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.secretmanager.SecretIamBinding("binding", {
    project: secret_basic.project,
    secretId: secret_basic.secretId,
    role: "roles/secretmanager.secretAccessor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.secretmanager.SecretIamBinding("binding",
    project=secret_basic["project"],
    secret_id=secret_basic["secretId"],
    role="roles/secretmanager.secretAccessor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/secretmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := secretmanager.NewSecretIamBinding(ctx, "binding", &secretmanager.SecretIamBindingArgs{
			Project:  pulumi.Any(secret_basic.Project),
			SecretId: pulumi.Any(secret_basic.SecretId),
			Role:     pulumi.String("roles/secretmanager.secretAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.SecretManager.SecretIamBinding("binding", new()
    {
        Project = secret_basic.Project,
        SecretId = secret_basic.SecretId,
        Role = "roles/secretmanager.secretAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.secretmanager.SecretIamBinding;
import com.pulumi.gcp.secretmanager.SecretIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new SecretIamBinding("binding", SecretIamBindingArgs.builder()
            .project(secret_basic.project())
            .secretId(secret_basic.secretId())
            .role("roles/secretmanager.secretAccessor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:secretmanager:SecretIamBinding
    properties:
      project: ${["secret-basic"].project}
      secretId: ${["secret-basic"].secretId}
      role: roles/secretmanager.secretAccessor
      members:
        - user:jane@example.com

The role property specifies which permission set to grant (here, secretAccessor allows reading secret values). The members array lists all identities that receive this role. SecretIamBinding is authoritative for the specified role: it replaces any previous members, ensuring only the listed identities have access.

Add time-based access with IAM Conditions

Temporary access grants expire automatically when you attach IAM Conditions, eliminating manual cleanup for contractors or time-limited service accounts.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.secretmanager.SecretIamBinding("binding", {
    project: secret_basic.project,
    secretId: secret_basic.secretId,
    role: "roles/secretmanager.secretAccessor",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.secretmanager.SecretIamBinding("binding",
    project=secret_basic["project"],
    secret_id=secret_basic["secretId"],
    role="roles/secretmanager.secretAccessor",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/secretmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := secretmanager.NewSecretIamBinding(ctx, "binding", &secretmanager.SecretIamBindingArgs{
			Project:  pulumi.Any(secret_basic.Project),
			SecretId: pulumi.Any(secret_basic.SecretId),
			Role:     pulumi.String("roles/secretmanager.secretAccessor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &secretmanager.SecretIamBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.SecretManager.SecretIamBinding("binding", new()
    {
        Project = secret_basic.Project,
        SecretId = secret_basic.SecretId,
        Role = "roles/secretmanager.secretAccessor",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.SecretManager.Inputs.SecretIamBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.secretmanager.SecretIamBinding;
import com.pulumi.gcp.secretmanager.SecretIamBindingArgs;
import com.pulumi.gcp.secretmanager.inputs.SecretIamBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new SecretIamBinding("binding", SecretIamBindingArgs.builder()
            .project(secret_basic.project())
            .secretId(secret_basic.secretId())
            .role("roles/secretmanager.secretAccessor")
            .members("user:jane@example.com")
            .condition(SecretIamBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:secretmanager:SecretIamBinding
    properties:
      project: ${["secret-basic"].project}
      secretId: ${["secret-basic"].secretId}
      role: roles/secretmanager.secretAccessor
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds temporal constraints to the binding. The expression property uses CEL (Common Expression Language) to define when access is valid; here, access expires at midnight on 2020-01-01. The title and description provide human-readable context for auditing. IAM Conditions have known limitations documented in the GCP IAM Conditions overview.

Add a single member to an existing role

When you need to grant access to one additional user without affecting other members, SecretIamMember provides non-authoritative updates.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.secretmanager.SecretIamMember("member", {
    project: secret_basic.project,
    secretId: secret_basic.secretId,
    role: "roles/secretmanager.secretAccessor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.secretmanager.SecretIamMember("member",
    project=secret_basic["project"],
    secret_id=secret_basic["secretId"],
    role="roles/secretmanager.secretAccessor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/secretmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := secretmanager.NewSecretIamMember(ctx, "member", &secretmanager.SecretIamMemberArgs{
			Project:  pulumi.Any(secret_basic.Project),
			SecretId: pulumi.Any(secret_basic.SecretId),
			Role:     pulumi.String("roles/secretmanager.secretAccessor"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.SecretManager.SecretIamMember("member", new()
    {
        Project = secret_basic.Project,
        SecretId = secret_basic.SecretId,
        Role = "roles/secretmanager.secretAccessor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.secretmanager.SecretIamMember;
import com.pulumi.gcp.secretmanager.SecretIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new SecretIamMember("member", SecretIamMemberArgs.builder()
            .project(secret_basic.project())
            .secretId(secret_basic.secretId())
            .role("roles/secretmanager.secretAccessor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:secretmanager:SecretIamMember
    properties:
      project: ${["secret-basic"].project}
      secretId: ${["secret-basic"].secretId}
      role: roles/secretmanager.secretAccessor
      member: user:jane@example.com

The member property specifies a single identity to add (note the singular form, unlike members in SecretIamBinding). This resource preserves existing grants for the role while adding the new member. You can use multiple SecretIamMember resources for the same role, or combine them with SecretIamBinding resources as long as they target different roles.

Beyond these examples

These snippets focus on specific IAM binding features: role bindings and member grants, and IAM Conditions for time-based access. They’re intentionally minimal rather than full access control policies.

The examples reference pre-existing infrastructure such as Secret Manager secrets (referenced by secretId) and Google Cloud identities (users, service accounts, groups). They focus on configuring access grants rather than provisioning secrets or identities.

To keep things focused, common IAM patterns are omitted, including:

  • SecretIamPolicy for full policy replacement
  • Custom role definitions and formatting
  • Federated identity and workload identity pool configuration
  • Conflict resolution between Policy, Binding, and Member resources

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the Secret Manager SecretIamBinding resource reference for all available configuration options.

Let's manage GCP Secret Manager IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
Which IAM resource should I use for managing secret access?
Choose based on your needs: SecretIamPolicy for full policy control (replaces entire policy), SecretIamBinding for managing all members of a specific role (preserves other roles), or SecretIamMember for adding individual members (preserves other members for the same role).
Can I use SecretIamPolicy together with SecretIamBinding or SecretIamMember?
No, SecretIamPolicy cannot be used with SecretIamBinding or SecretIamMember as they will conflict over the policy configuration.
Can I use SecretIamBinding and SecretIamMember together?
Yes, but only if they don’t grant privileges to the same role. Each role must be managed by only one resource type.
Configuration & Member Identities
What member identity formats are supported?

You can use multiple formats in the members array:

  • Public access: allUsers, allAuthenticatedUsers
  • Individual accounts: user:{email}, serviceAccount:{email}
  • Groups and domains: group:{email}, domain:{domain}
  • Project roles: projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}
  • Federated identities: Workload/workforce identity pools (see Principal identifiers documentation)
How do I specify a custom IAM role?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role.
Can I create multiple SecretIamBinding resources for the same secret?
Yes, but only one SecretIamBinding per role. Each binding manages all members for a specific role.
IAM Conditions & Advanced Features
How do I add time-based or conditional access to a secret?
Use the condition property with title, description, and expression. For example, to expire access at a specific time, set expression to request.time < timestamp("2020-01-01T00:00:00Z").
Are there limitations with IAM Conditions?
Yes, IAM Conditions have known limitations. If you experience issues, review the GCP IAM Conditions limitations documentation.
Immutability & Lifecycle
What properties can't be changed after creating a SecretIamBinding?
The role, secretId, project, and condition properties are immutable and require resource replacement if changed.
What happens to the project property if I don't specify it?
If not provided, the project is parsed from the parent resource identifier. If no project is found there, the provider’s default project is used.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides