Manage GCP Source Repository IAM Policies

The gcp:sourcerepo/repositoryIamPolicy:RepositoryIamPolicy resource, part of the Pulumi GCP provider, manages IAM access control for Cloud Source Repositories at the policy, role, or member level. This guide focuses on three capabilities: authoritative policy replacement, role-level member management, and incremental member grants.

These resources reference an existing Cloud Source Repositories repository and require the Source Repositories API enabled. The examples are intentionally small. Combine them with your own repository infrastructure and access requirements.

Replace the entire IAM policy for a repository

When you need complete control over repository access, setting the entire IAM policy at once ensures your configuration is the single source of truth.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.sourcerepo.RepositoryIamPolicy("policy", {
    project: my_repo.project,
    repository: my_repo.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.sourcerepo.RepositoryIamPolicy("policy",
    project=my_repo["project"],
    repository=my_repo["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/sourcerepo"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = sourcerepo.NewRepositoryIamPolicy(ctx, "policy", &sourcerepo.RepositoryIamPolicyArgs{
			Project:    pulumi.Any(my_repo.Project),
			Repository: pulumi.Any(my_repo.Name),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.SourceRepo.RepositoryIamPolicy("policy", new()
    {
        Project = my_repo.Project,
        Repository = my_repo.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.sourcerepo.RepositoryIamPolicy;
import com.pulumi.gcp.sourcerepo.RepositoryIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new RepositoryIamPolicy("policy", RepositoryIamPolicyArgs.builder()
            .project(my_repo.project())
            .repository(my_repo.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:sourcerepo:RepositoryIamPolicy
    properties:
      project: ${["my-repo"].project}
      repository: ${["my-repo"].name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The RepositoryIamPolicy resource replaces any existing policy on the repository. The policyData property accepts output from the getIAMPolicy data source, which defines bindings (role-to-members mappings). This approach is authoritative: any roles or members not listed in policyData are removed.

Grant a role to multiple members at once

Teams often need to grant the same role to several users or service accounts while preserving other roles on the repository.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.sourcerepo.RepositoryIamBinding("binding", {
    project: my_repo.project,
    repository: my_repo.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.sourcerepo.RepositoryIamBinding("binding",
    project=my_repo["project"],
    repository=my_repo["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/sourcerepo"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := sourcerepo.NewRepositoryIamBinding(ctx, "binding", &sourcerepo.RepositoryIamBindingArgs{
			Project:    pulumi.Any(my_repo.Project),
			Repository: pulumi.Any(my_repo.Name),
			Role:       pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.SourceRepo.RepositoryIamBinding("binding", new()
    {
        Project = my_repo.Project,
        Repository = my_repo.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.sourcerepo.RepositoryIamBinding;
import com.pulumi.gcp.sourcerepo.RepositoryIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new RepositoryIamBinding("binding", RepositoryIamBindingArgs.builder()
            .project(my_repo.project())
            .repository(my_repo.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:sourcerepo:RepositoryIamBinding
    properties:
      project: ${["my-repo"].project}
      repository: ${["my-repo"].name}
      role: roles/viewer
      members:
        - user:jane@example.com

The RepositoryIamBinding resource manages all members for a specific role. The members array lists users, service accounts, or groups. This resource is authoritative for its role: it removes any members not listed in the array, but preserves other roles on the repository.

Add a single member to a role incrementally

When multiple teams manage access independently, non-authoritative member grants let you add individual users without coordinating with other configurations.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.sourcerepo.RepositoryIamMember("member", {
    project: my_repo.project,
    repository: my_repo.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.sourcerepo.RepositoryIamMember("member",
    project=my_repo["project"],
    repository=my_repo["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/sourcerepo"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := sourcerepo.NewRepositoryIamMember(ctx, "member", &sourcerepo.RepositoryIamMemberArgs{
			Project:    pulumi.Any(my_repo.Project),
			Repository: pulumi.Any(my_repo.Name),
			Role:       pulumi.String("roles/viewer"),
			Member:     pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.SourceRepo.RepositoryIamMember("member", new()
    {
        Project = my_repo.Project,
        Repository = my_repo.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.sourcerepo.RepositoryIamMember;
import com.pulumi.gcp.sourcerepo.RepositoryIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new RepositoryIamMember("member", RepositoryIamMemberArgs.builder()
            .project(my_repo.project())
            .repository(my_repo.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:sourcerepo:RepositoryIamMember
    properties:
      project: ${["my-repo"].project}
      repository: ${["my-repo"].name}
      role: roles/viewer
      member: user:jane@example.com

The RepositoryIamMember resource adds one member to a role without affecting other members. The member property specifies a single identity (user, service account, or group). This resource is non-authoritative: it preserves other members with the same role and other roles on the repository.

Beyond these examples

These snippets focus on specific IAM management approaches: authoritative vs non-authoritative management, and policy-level, role-level, and member-level grants. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as a Cloud Source Repositories repository (my_repo) and a GCP project with the Source Repositories API enabled. They focus on IAM binding configuration rather than repository provisioning.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition blocks)
Service account impersonation
Custom role definitions
Audit logging configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the Repository IAM Policy resource reference for all available configuration options.

Let's manage GCP Source Repository IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resources can I use together?

RepositoryIamPolicy cannot be used with RepositoryIamBinding or RepositoryIamMember (they will conflict). RepositoryIamBinding and RepositoryIamMember can be used together only if they don’t manage the same role.

What's the difference between RepositoryIamPolicy, RepositoryIamBinding, and RepositoryIamMember?

RepositoryIamPolicy is authoritative and replaces the entire IAM policy. RepositoryIamBinding is authoritative for a specific role, preserving other roles. RepositoryIamMember is non-authoritative, adding a single member to a role while preserving other members.

How do I choose which IAM resource to use?

Use RepositoryIamPolicy for full policy control. Use RepositoryIamBinding to manage all members for a specific role. Use RepositoryIamMember to add individual members without affecting others.

Configuration & Setup

How do I generate the policyData for RepositoryIamPolicy?

Use the gcp.organizations.getIAMPolicy data source to generate the policy data, as shown in the example.

Properties & Immutability

What properties can't be changed after creation?

Both project and repository are immutable and cannot be changed after the resource is created.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides