Configure GCP Security Command Center IAM Bindings

The gcp:securitycenter/v2OrganizationSourceIamBinding:V2OrganizationSourceIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Security Command Center v2 organization sources. This guide focuses on two capabilities: granting roles to multiple members and adding individual members incrementally.

IAM bindings for Security Command Center sources control which identities can access security findings. The V2OrganizationSourceIamBinding resource is authoritative for a given role, meaning it replaces all members for that role. It can work alongside V2OrganizationSourceIamMember resources as long as they don’t manage the same role. The examples are intentionally small. Combine them with your own source references and identity management.

Grant a role to multiple members at once

When managing Security Command Center sources, teams often need to give the same role to multiple users or service accounts simultaneously, such as granting viewer access to an entire security team.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.securitycenter.V2OrganizationSourceIamBinding("binding", {
    source: customSource.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.securitycenter.V2OrganizationSourceIamBinding("binding",
    source=custom_source["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/securitycenter"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securitycenter.NewV2OrganizationSourceIamBinding(ctx, "binding", &securitycenter.V2OrganizationSourceIamBindingArgs{
			Source: pulumi.Any(customSource.Name),
			Role:   pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.SecurityCenter.V2OrganizationSourceIamBinding("binding", new()
    {
        Source = customSource.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.securitycenter.V2OrganizationSourceIamBinding;
import com.pulumi.gcp.securitycenter.V2OrganizationSourceIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new V2OrganizationSourceIamBinding("binding", V2OrganizationSourceIamBindingArgs.builder()
            .source(customSource.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:securitycenter:V2OrganizationSourceIamBinding
    properties:
      source: ${customSource.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The members property accepts a list of identity strings in specific formats: user emails, service accounts, groups, domains, or federated identities. The binding replaces any existing members for the specified role on this source. If you need to preserve existing members while adding new ones, use V2OrganizationSourceIamMember instead.

Add individual members to a role incrementally

As access needs evolve, you can add individual members to roles without affecting existing grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.securitycenter.V2OrganizationSourceIamMember("member", {
    source: customSource.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.securitycenter.V2OrganizationSourceIamMember("member",
    source=custom_source["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/securitycenter"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securitycenter.NewV2OrganizationSourceIamMember(ctx, "member", &securitycenter.V2OrganizationSourceIamMemberArgs{
			Source: pulumi.Any(customSource.Name),
			Role:   pulumi.String("roles/viewer"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.SecurityCenter.V2OrganizationSourceIamMember("member", new()
    {
        Source = customSource.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.securitycenter.V2OrganizationSourceIamMember;
import com.pulumi.gcp.securitycenter.V2OrganizationSourceIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new V2OrganizationSourceIamMember("member", V2OrganizationSourceIamMemberArgs.builder()
            .source(customSource.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:securitycenter:V2OrganizationSourceIamMember
    properties:
      source: ${customSource.name}
      role: roles/viewer
      member: user:jane@example.com

The member property (singular) adds one identity to the role without replacing others already assigned. This non-authoritative approach lets you manage access grants independently. Multiple V2OrganizationSourceIamMember resources can target the same role, and they won’t conflict with each other.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and batch and incremental member grants. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Security Command Center v2 organization sources. They focus on configuring IAM bindings rather than provisioning sources or defining custom roles.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy-level management (V2OrganizationSourceIamPolicy)
Custom role definitions and formatting

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the V2OrganizationSourceIamBinding resource reference for all available configuration options.

Let's configure GCP Security Command Center IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

Which IAM resources conflict with each other?

V2OrganizationSourceIamPolicy cannot be used with V2OrganizationSourceIamBinding or V2OrganizationSourceIamMember, as they will fight over policy state. Use either the authoritative Policy resource OR the granular Binding/Member resources, never both.

Can I use IamBinding and IamMember resources together?

Yes, but only if they don’t grant privileges to the same role. If both resources target the same role, they will conflict.

Resource Selection

Which IAM resource should I use?

Choose based on your needs:

V2OrganizationSourceIamPolicy for full policy control (replaces entire policy)
V2OrganizationSourceIamBinding for managing all members of a specific role (preserves other roles)
V2OrganizationSourceIamMember for adding individual members without affecting others (non-authoritative)

Configuration & Custom Roles

How do I specify custom roles?

Custom roles must use the full path format: [projects|organizations]/{parent-name}/roles/{role-name}. For example, use organizations/my-org/roles/my-custom-role instead of just roles/my-custom-role.

What member identity formats are supported?

The members property supports: user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, allUsers, allAuthenticatedUsers, and federated identities like principal://iam.googleapis.com/....

Immutability & Updates

What properties can't I change after creation?

The role, source, organization, and condition properties are immutable and cannot be modified after the resource is created.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides