Manage GCP Service Account IAM Bindings

The gcp:serviceaccount/iAMBinding:IAMBinding resource, part of the Pulumi GCP provider, grants an IAM role to a list of members on a service account, replacing any existing bindings for that role. This guide focuses on three capabilities: binding roles to multiple members, time-based access with conditions, and service account impersonation patterns.

IAMBinding references service accounts that must exist separately. It controls who can impersonate or modify those accounts, not the accounts themselves. The examples are intentionally small. Combine them with your own service account creation and application workloads.

Grant a role to multiple members at once

When multiple users or service accounts need the same permission, IAMBinding grants the role to all members as a single unit.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const sa = new gcp.serviceaccount.Account("sa", {
    accountId: "my-service-account",
    displayName: "A service account that only Jane can use",
});
const admin_account_iam = new gcp.serviceaccount.IAMBinding("admin-account-iam", {
    serviceAccountId: sa.name,
    role: "roles/iam.serviceAccountUser",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

sa = gcp.serviceaccount.Account("sa",
    account_id="my-service-account",
    display_name="A service account that only Jane can use")
admin_account_iam = gcp.serviceaccount.IAMBinding("admin-account-iam",
    service_account_id=sa.name,
    role="roles/iam.serviceAccountUser",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		sa, err := serviceaccount.NewAccount(ctx, "sa", &serviceaccount.AccountArgs{
			AccountId:   pulumi.String("my-service-account"),
			DisplayName: pulumi.String("A service account that only Jane can use"),
		})
		if err != nil {
			return err
		}
		_, err = serviceaccount.NewIAMBinding(ctx, "admin-account-iam", &serviceaccount.IAMBindingArgs{
			ServiceAccountId: sa.Name,
			Role:             pulumi.String("roles/iam.serviceAccountUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var sa = new Gcp.ServiceAccount.Account("sa", new()
    {
        AccountId = "my-service-account",
        DisplayName = "A service account that only Jane can use",
    });

    var admin_account_iam = new Gcp.ServiceAccount.IAMBinding("admin-account-iam", new()
    {
        ServiceAccountId = sa.Name,
        Role = "roles/iam.serviceAccountUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.serviceaccount.IAMBinding;
import com.pulumi.gcp.serviceaccount.IAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that only Jane can use")
            .build());

        var admin_account_iam = new IAMBinding("admin-account-iam", IAMBindingArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  sa:
    type: gcp:serviceaccount:Account
    properties:
      accountId: my-service-account
      displayName: A service account that only Jane can use
  admin-account-iam:
    type: gcp:serviceaccount:IAMBinding
    properties:
      serviceAccountId: ${sa.name}
      role: roles/iam.serviceAccountUser
      members:
        - user:jane@example.com

The serviceAccountId identifies the target service account by name. The role property specifies which permission to grant (here, roles/iam.serviceAccountUser allows impersonation). The members array lists all identities that receive this role; IAMBinding replaces any previous members for this role, making it authoritative for that specific role.

Add time-based access with IAM conditions

Some permissions should expire automatically, such as temporary contractor access or time-limited testing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const sa = new gcp.serviceaccount.Account("sa", {
    accountId: "my-service-account",
    displayName: "A service account that only Jane can use",
});
const admin_account_iam = new gcp.serviceaccount.IAMBinding("admin-account-iam", {
    serviceAccountId: sa.name,
    role: "roles/iam.serviceAccountUser",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

sa = gcp.serviceaccount.Account("sa",
    account_id="my-service-account",
    display_name="A service account that only Jane can use")
admin_account_iam = gcp.serviceaccount.IAMBinding("admin-account-iam",
    service_account_id=sa.name,
    role="roles/iam.serviceAccountUser",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		sa, err := serviceaccount.NewAccount(ctx, "sa", &serviceaccount.AccountArgs{
			AccountId:   pulumi.String("my-service-account"),
			DisplayName: pulumi.String("A service account that only Jane can use"),
		})
		if err != nil {
			return err
		}
		_, err = serviceaccount.NewIAMBinding(ctx, "admin-account-iam", &serviceaccount.IAMBindingArgs{
			ServiceAccountId: sa.Name,
			Role:             pulumi.String("roles/iam.serviceAccountUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &serviceaccount.IAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var sa = new Gcp.ServiceAccount.Account("sa", new()
    {
        AccountId = "my-service-account",
        DisplayName = "A service account that only Jane can use",
    });

    var admin_account_iam = new Gcp.ServiceAccount.IAMBinding("admin-account-iam", new()
    {
        ServiceAccountId = sa.Name,
        Role = "roles/iam.serviceAccountUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.ServiceAccount.Inputs.IAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.serviceaccount.IAMBinding;
import com.pulumi.gcp.serviceaccount.IAMBindingArgs;
import com.pulumi.gcp.serviceaccount.inputs.IAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that only Jane can use")
            .build());

        var admin_account_iam = new IAMBinding("admin-account-iam", IAMBindingArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .members("user:jane@example.com")
            .condition(IAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  sa:
    type: gcp:serviceaccount:Account
    properties:
      accountId: my-service-account
      displayName: A service account that only Jane can use
  admin-account-iam:
    type: gcp:serviceaccount:IAMBinding
    properties:
      serviceAccountId: ${sa.name}
      role: roles/iam.serviceAccountUser
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds constraints to the binding. The expression uses CEL (Common Expression Language) to check request.time against a timestamp, automatically revoking access after the specified date. The title and description document the condition’s purpose for auditing.

Allow service accounts to impersonate each other

Applications running as one service account often need to impersonate another to access resources with different permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const _default = gcp.compute.getDefaultServiceAccount({});
const sa = new gcp.serviceaccount.Account("sa", {
    accountId: "my-service-account",
    displayName: "A service account that Jane can use",
});
const admin_account_iam = new gcp.serviceaccount.IAMMember("admin-account-iam", {
    serviceAccountId: sa.name,
    role: "roles/iam.serviceAccountUser",
    member: "user:jane@example.com",
});
// Allow SA service account use the default GCE account
const gce_default_account_iam = new gcp.serviceaccount.IAMMember("gce-default-account-iam", {
    serviceAccountId: _default.then(_default => _default.name),
    role: "roles/iam.serviceAccountUser",
    member: pulumi.interpolate`serviceAccount:${sa.email}`,
});

import pulumi
import pulumi_gcp as gcp

default = gcp.compute.get_default_service_account()
sa = gcp.serviceaccount.Account("sa",
    account_id="my-service-account",
    display_name="A service account that Jane can use")
admin_account_iam = gcp.serviceaccount.IAMMember("admin-account-iam",
    service_account_id=sa.name,
    role="roles/iam.serviceAccountUser",
    member="user:jane@example.com")
# Allow SA service account use the default GCE account
gce_default_account_iam = gcp.serviceaccount.IAMMember("gce-default-account-iam",
    service_account_id=default.name,
    role="roles/iam.serviceAccountUser",
    member=sa.email.apply(lambda email: f"serviceAccount:{email}"))

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/serviceaccount"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_default, err := compute.GetDefaultServiceAccount(ctx, &compute.GetDefaultServiceAccountArgs{}, nil)
		if err != nil {
			return err
		}
		sa, err := serviceaccount.NewAccount(ctx, "sa", &serviceaccount.AccountArgs{
			AccountId:   pulumi.String("my-service-account"),
			DisplayName: pulumi.String("A service account that Jane can use"),
		})
		if err != nil {
			return err
		}
		_, err = serviceaccount.NewIAMMember(ctx, "admin-account-iam", &serviceaccount.IAMMemberArgs{
			ServiceAccountId: sa.Name,
			Role:             pulumi.String("roles/iam.serviceAccountUser"),
			Member:           pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		// Allow SA service account use the default GCE account
		_, err = serviceaccount.NewIAMMember(ctx, "gce-default-account-iam", &serviceaccount.IAMMemberArgs{
			ServiceAccountId: pulumi.String(_default.Name),
			Role:             pulumi.String("roles/iam.serviceAccountUser"),
			Member: sa.Email.ApplyT(func(email string) (string, error) {
				return fmt.Sprintf("serviceAccount:%v", email), nil
			}).(pulumi.StringOutput),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var @default = Gcp.Compute.GetDefaultServiceAccount.Invoke();

    var sa = new Gcp.ServiceAccount.Account("sa", new()
    {
        AccountId = "my-service-account",
        DisplayName = "A service account that Jane can use",
    });

    var admin_account_iam = new Gcp.ServiceAccount.IAMMember("admin-account-iam", new()
    {
        ServiceAccountId = sa.Name,
        Role = "roles/iam.serviceAccountUser",
        Member = "user:jane@example.com",
    });

    // Allow SA service account use the default GCE account
    var gce_default_account_iam = new Gcp.ServiceAccount.IAMMember("gce-default-account-iam", new()
    {
        ServiceAccountId = @default.Apply(@default => @default.Apply(getDefaultServiceAccountResult => getDefaultServiceAccountResult.Name)),
        Role = "roles/iam.serviceAccountUser",
        Member = sa.Email.Apply(email => $"serviceAccount:{email}"),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ComputeFunctions;
import com.pulumi.gcp.compute.inputs.GetDefaultServiceAccountArgs;
import com.pulumi.gcp.serviceaccount.Account;
import com.pulumi.gcp.serviceaccount.AccountArgs;
import com.pulumi.gcp.serviceaccount.IAMMember;
import com.pulumi.gcp.serviceaccount.IAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var default = ComputeFunctions.getDefaultServiceAccount(GetDefaultServiceAccountArgs.builder()
            .build());

        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that Jane can use")
            .build());

        var admin_account_iam = new IAMMember("admin-account-iam", IAMMemberArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .member("user:jane@example.com")
            .build());

        // Allow SA service account use the default GCE account
        var gce_default_account_iam = new IAMMember("gce-default-account-iam", IAMMemberArgs.builder()
            .serviceAccountId(default_.name())
            .role("roles/iam.serviceAccountUser")
            .member(sa.email().applyValue(_email -> String.format("serviceAccount:%s", _email)))
            .build());

    }
}

resources:
  sa:
    type: gcp:serviceaccount:Account
    properties:
      accountId: my-service-account
      displayName: A service account that Jane can use
  admin-account-iam:
    type: gcp:serviceaccount:IAMMember
    properties:
      serviceAccountId: ${sa.name}
      role: roles/iam.serviceAccountUser
      member: user:jane@example.com
  # Allow SA service account use the default GCE account
  gce-default-account-iam:
    type: gcp:serviceaccount:IAMMember
    properties:
      serviceAccountId: ${default.name}
      role: roles/iam.serviceAccountUser
      member: serviceAccount:${sa.email}
variables:
  default:
    fn::invoke:
      function: gcp:compute:getDefaultServiceAccount
      arguments: {}

The member property uses the serviceAccount: prefix followed by the email address of the service account that needs permission. This pattern enables workload identity: your application’s service account can impersonate the default GCE account (or any other service account) to access resources. The pulumi.interpolate constructs the member string from the service account’s email output.

Beyond these examples

These snippets focus on specific IAMBinding features: role binding to multiple members, time-based access with IAM conditions, and service account impersonation. They’re intentionally minimal rather than full identity management solutions.

The examples reference pre-existing infrastructure such as service accounts created separately via gcp.serviceaccount.Account. They focus on binding permissions rather than provisioning the accounts themselves.

To keep things focused, common IAM patterns are omitted, including:

  • IAMPolicy for full policy replacement
  • IAMMember for single-member grants
  • Custom role formatting ([projects|organizations]/{parent}/roles/{name})
  • Conflict resolution between IAMPolicy, IAMBinding, and IAMMember

These omissions are intentional: the goal is to illustrate how IAMBinding wires permissions, not provide drop-in identity modules. See the Service Account IAMBinding resource reference for all available configuration options.

Let's manage GCP Service Account IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between IAMPolicy, IAMBinding, and IAMMember?
gcp.serviceaccount.IAMPolicy is authoritative for the entire policy and replaces any existing policy. gcp.serviceaccount.IAMBinding is authoritative for a specific role and preserves other roles. gcp.serviceaccount.IAMMember is non-authoritative and adds individual members while preserving existing ones.
Can I use IAMPolicy with IAMBinding or IAMMember?
No, gcp.serviceaccount.IAMPolicy cannot be used with gcp.serviceaccount.IAMBinding or gcp.serviceaccount.IAMMember as they will conflict over policy control.
Can I use IAMBinding and IAMMember together?
Yes, but only if they don’t grant privileges to the same role. Using both for the same role will cause conflicts.
Configuration & Member Formats
What member formats are supported?
You can use: allUsers (anyone on internet), allAuthenticatedUsers (anyone with Google account), user:{email} (specific user), serviceAccount:{email} (service account), group:{email} (Google group), or domain:{domain} (G Suite domain).
How do I specify custom roles?
Use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example: projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.
How do I grant a service account permission to use another service account?
Set member to serviceAccount:{email} format. For example: member: pulumi.interpolateserviceAccount:${sa.email}`` to reference another service account’s email.
Advanced Features & Limitations
How do I add time-based or conditional access?
Use the condition property with title, description, and expression. For example, to expire access: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".
What properties can't I change after creation?
The role, serviceAccountId, and condition properties are immutable and require resource replacement if changed.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides