Manage GCP Secure Source Manager Repository IAM Access

The gcp:securesourcemanager/repositoryIamMember:RepositoryIamMember resource, part of the Pulumi GCP provider, grants IAM roles to users, service accounts, or groups for Secure Source Manager repositories. This guide focuses on three capabilities: single-member role grants, multi-member role bindings, and complete policy replacement.

IAM resources for Secure Source Manager come in three variants: RepositoryIamMember (non-authoritative, adds one member), RepositoryIamBinding (authoritative for a role, sets all members), and RepositoryIamPolicy (authoritative for the entire policy). The examples are intentionally small. Combine them with your own repository references and organizational identity management.

Grant a role to a single user

Most IAM configurations add repository access for one user or service account without affecting other permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.securesourcemanager.RepositoryIamMember("member", {
    project: _default.project,
    location: _default.location,
    repositoryId: _default.repositoryId,
    role: "roles/securesourcemanager.repoAdmin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.securesourcemanager.RepositoryIamMember("member",
    project=default["project"],
    location=default["location"],
    repository_id=default["repositoryId"],
    role="roles/securesourcemanager.repoAdmin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/securesourcemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securesourcemanager.NewRepositoryIamMember(ctx, "member", &securesourcemanager.RepositoryIamMemberArgs{
			Project:      pulumi.Any(_default.Project),
			Location:     pulumi.Any(_default.Location),
			RepositoryId: pulumi.Any(_default.RepositoryId),
			Role:         pulumi.String("roles/securesourcemanager.repoAdmin"),
			Member:       pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.SecureSourceManager.RepositoryIamMember("member", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        RepositoryId = @default.RepositoryId,
        Role = "roles/securesourcemanager.repoAdmin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.securesourcemanager.RepositoryIamMember;
import com.pulumi.gcp.securesourcemanager.RepositoryIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RepositoryIamMember("member", RepositoryIamMemberArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .repositoryId(default_.repositoryId())
            .role("roles/securesourcemanager.repoAdmin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:securesourcemanager:RepositoryIamMember
    properties:
      project: ${default.project}
      location: ${default.location}
      repositoryId: ${default.repositoryId}
      role: roles/securesourcemanager.repoAdmin
      member: user:jane@example.com

The member property identifies who receives access using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property specifies the permission level, such as “roles/securesourcemanager.repoAdmin”. This resource is non-authoritative: it adds the member to the role without removing other members who already have that role.

Grant a role to multiple users at once

When a team needs the same access level, binding a role to multiple members ensures consistent permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.securesourcemanager.RepositoryIamBinding("binding", {
    project: _default.project,
    location: _default.location,
    repositoryId: _default.repositoryId,
    role: "roles/securesourcemanager.repoAdmin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.securesourcemanager.RepositoryIamBinding("binding",
    project=default["project"],
    location=default["location"],
    repository_id=default["repositoryId"],
    role="roles/securesourcemanager.repoAdmin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/securesourcemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securesourcemanager.NewRepositoryIamBinding(ctx, "binding", &securesourcemanager.RepositoryIamBindingArgs{
			Project:      pulumi.Any(_default.Project),
			Location:     pulumi.Any(_default.Location),
			RepositoryId: pulumi.Any(_default.RepositoryId),
			Role:         pulumi.String("roles/securesourcemanager.repoAdmin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.SecureSourceManager.RepositoryIamBinding("binding", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        RepositoryId = @default.RepositoryId,
        Role = "roles/securesourcemanager.repoAdmin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.securesourcemanager.RepositoryIamBinding;
import com.pulumi.gcp.securesourcemanager.RepositoryIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new RepositoryIamBinding("binding", RepositoryIamBindingArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .repositoryId(default_.repositoryId())
            .role("roles/securesourcemanager.repoAdmin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:securesourcemanager:RepositoryIamBinding
    properties:
      project: ${default.project}
      location: ${default.location}
      repositoryId: ${default.repositoryId}
      role: roles/securesourcemanager.repoAdmin
      members:
        - user:jane@example.com

The members property takes a list of identifiers, allowing you to assign the same role to multiple users, service accounts, or groups in one resource. This resource is authoritative for the specified role: it replaces all members for that role. Other roles on the repository remain unchanged.

Replace the entire IAM policy with a new definition

Organizations managing IAM centrally can define the complete policy in one place, replacing any existing configuration.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/securesourcemanager.repoAdmin",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.securesourcemanager.RepositoryIamPolicy("policy", {
    project: _default.project,
    location: _default.location,
    repositoryId: _default.repositoryId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/securesourcemanager.repoAdmin",
    "members": ["user:jane@example.com"],
}])
policy = gcp.securesourcemanager.RepositoryIamPolicy("policy",
    project=default["project"],
    location=default["location"],
    repository_id=default["repositoryId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/securesourcemanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/securesourcemanager.repoAdmin",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = securesourcemanager.NewRepositoryIamPolicy(ctx, "policy", &securesourcemanager.RepositoryIamPolicyArgs{
			Project:      pulumi.Any(_default.Project),
			Location:     pulumi.Any(_default.Location),
			RepositoryId: pulumi.Any(_default.RepositoryId),
			PolicyData:   pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/securesourcemanager.repoAdmin",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.SecureSourceManager.RepositoryIamPolicy("policy", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        RepositoryId = @default.RepositoryId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.securesourcemanager.RepositoryIamPolicy;
import com.pulumi.gcp.securesourcemanager.RepositoryIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/securesourcemanager.repoAdmin")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new RepositoryIamPolicy("policy", RepositoryIamPolicyArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .repositoryId(default_.repositoryId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:securesourcemanager:RepositoryIamPolicy
    properties:
      project: ${default.project}
      location: ${default.location}
      repositoryId: ${default.repositoryId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/securesourcemanager.repoAdmin
            members:
              - user:jane@example.com

The policyData property accepts the output from getIAMPolicy, which defines all roles and their members in a single structure. This resource is fully authoritative: it replaces the entire IAM policy for the repository. You cannot use RepositoryIamPolicy alongside RepositoryIamBinding or RepositoryIamMember resources, as they will conflict over policy ownership.

Beyond these examples

These snippets focus on specific IAM assignment patterns: single-member and multi-member role grants, and complete policy replacement. They’re intentionally minimal rather than full access control systems.

The examples reference pre-existing infrastructure such as Secure Source Manager repositories and GCP projects with configured locations. They focus on granting access rather than provisioning repositories or managing organizational identity.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Federated identity configuration
Policy retrieval via data sources

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Secure Source Manager RepositoryIamMember resource reference for all available configuration options.

Let's manage GCP Secure Source Manager Repository IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Why am I getting IAM policy conflicts between my resources?

RepositoryIamPolicy cannot be used with RepositoryIamBinding or RepositoryIamMember because Policy is fully authoritative and will conflict with the other resources. Use either Policy alone, or use Binding/Member together.

Can I use RepositoryIamBinding and RepositoryIamMember together?

Yes, but only if they don’t grant privileges to the same role. If both resources target the same role, they’ll conflict over the member list.

IAM Configuration

What's the difference between RepositoryIamPolicy, RepositoryIamBinding, and RepositoryIamMember?

RepositoryIamPolicy is fully authoritative and replaces the entire IAM policy. RepositoryIamBinding is authoritative for a specific role, preserving other roles. RepositoryIamMember is non-authoritative, adding a single member to a role while preserving other members.

What member identity formats can I use?

You can use allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, or federated identities like principal://iam.googleapis.com/....

How do I use custom IAM roles?

Custom roles must use the full format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

How do I grant repository access to a single user?

Use RepositoryIamMember with the member property set to user:{emailid} format and specify the desired role. For example, member: "user:jane@example.com" with role: "roles/securesourcemanager.repoAdmin".

Import & Resource Management

What formats can I use when importing IAM resources?

You can use four formats: full path projects/{{project}}/locations/{{location}}/repositories/{{repository_id}}, or shorter forms like {{project}}/{{location}}/{{repository_id}}, {{location}}/{{repository_id}}, or just {{repository_id}}. Missing values are taken from the provider configuration.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides