The gcp:storage/bucketIAMMember:BucketIAMMember resource, part of the Pulumi GCP provider, grants a single member access to a Cloud Storage bucket by adding them to a specific IAM role. This guide focuses on two capabilities: adding individual members to roles and applying time-based IAM Conditions.
BucketIAMMember is non-authoritative: it adds one member to one role without removing other members or affecting other roles. This resource references existing buckets and grants access to existing user accounts or service accounts. The examples are intentionally small. Combine them with your own bucket and identity management.
Grant a role to a single member
Most IAM configurations start by granting a specific user or service account access to a bucket without disrupting existing permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.storage.BucketIAMMember("member", {
bucket: _default.name,
role: "roles/storage.admin",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.storage.BucketIAMMember("member",
bucket=default["name"],
role="roles/storage.admin",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := storage.NewBucketIAMMember(ctx, "member", &storage.BucketIAMMemberArgs{
Bucket: pulumi.Any(_default.Name),
Role: pulumi.String("roles/storage.admin"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Storage.BucketIAMMember("member", new()
{
Bucket = @default.Name,
Role = "roles/storage.admin",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMMember;
import com.pulumi.gcp.storage.BucketIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new BucketIAMMember("member", BucketIAMMemberArgs.builder()
.bucket(default_.name())
.role("roles/storage.admin")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:storage:BucketIAMMember
properties:
bucket: ${default.name}
role: roles/storage.admin
member: user:jane@example.com
The member property identifies who receives access using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property specifies the permission level, such as “roles/storage.admin” for full bucket control or “roles/storage.objectViewer” for read-only access. BucketIAMMember preserves other members already assigned to this role and doesn’t touch other roles on the bucket.
Add time-limited access with IAM Conditions
Teams often need temporary access that expires automatically, such as contractor access or time-boxed testing.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.storage.BucketIAMMember("member", {
bucket: _default.name,
role: "roles/storage.admin",
member: "user:jane@example.com",
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
member = gcp.storage.BucketIAMMember("member",
bucket=default["name"],
role="roles/storage.admin",
member="user:jane@example.com",
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := storage.NewBucketIAMMember(ctx, "member", &storage.BucketIAMMemberArgs{
Bucket: pulumi.Any(_default.Name),
Role: pulumi.String("roles/storage.admin"),
Member: pulumi.String("user:jane@example.com"),
Condition: &storage.BucketIAMMemberConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Storage.BucketIAMMember("member", new()
{
Bucket = @default.Name,
Role = "roles/storage.admin",
Member = "user:jane@example.com",
Condition = new Gcp.Storage.Inputs.BucketIAMMemberConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMMember;
import com.pulumi.gcp.storage.BucketIAMMemberArgs;
import com.pulumi.gcp.storage.inputs.BucketIAMMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new BucketIAMMember("member", BucketIAMMemberArgs.builder()
.bucket(default_.name())
.role("roles/storage.admin")
.member("user:jane@example.com")
.condition(BucketIAMMemberConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
member:
type: gcp:storage:BucketIAMMember
properties:
bucket: ${default.name}
role: roles/storage.admin
member: user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds constraints to the role grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here, “request.time < timestamp(…)” expires access at midnight on 2020-01-01. The title and description properties document the condition’s purpose. IAM Conditions have known limitations around certain resource types and operations, documented in the GCP IAM Conditions overview.
Beyond these examples
These snippets focus on specific BucketIAMMember features: single-member role grants and time-based IAM Conditions. They’re intentionally minimal rather than complete access control configurations.
The examples reference pre-existing infrastructure such as Cloud Storage buckets and user accounts or service accounts to grant access to. They focus on granting access to individual members rather than managing complete IAM policies.
To keep things focused, common IAM patterns are omitted, including:
- Multi-member role grants (use BucketIAMBinding)
- Complete policy replacement (use BucketIAMPolicy)
- Complex condition expressions (location, resource tags)
- Custom role definitions
These omissions are intentional: the goal is to illustrate how BucketIAMMember grants are wired, not provide drop-in access control modules. See the BucketIAMMember resource reference for all available configuration options.
Let's manage GCP Cloud Storage Bucket IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
BucketIAMPolicy is authoritative and replaces the entire IAM policy. BucketIAMBinding is authoritative for a specific role but preserves other roles. BucketIAMMember is non-authoritative and preserves other members for the same role.BucketIAMPolicy cannot be used with BucketIAMBinding or BucketIAMMember as they will conflict over policy control. However, BucketIAMBinding and BucketIAMMember can coexist if they don’t grant the same role.BucketIAMPolicy for complete policy control, BucketIAMBinding to manage all members for a specific role, or BucketIAMMember to grant a role to individual members without affecting others.Configuration & Syntax
user:email, serviceAccount:email, group:email, domain:domain, allUsers, allAuthenticatedUsers, projectOwner:projectid, projectEditor:projectid, and projectViewer:projectid.[projects|organizations]/{parent-name}/roles/{role-name} for the role property.Advanced Features & Limitations
condition property with title, description, and expression fields. Note that IAM Conditions have known limitations you should review.bucket, member, role, and condition. Changes require resource replacement.