Manage GCP Cloud Storage Bucket IAM Permissions

The gcp:storage/bucketIAMMember:BucketIAMMember resource, part of the Pulumi GCP provider, grants a single member access to a Cloud Storage bucket by adding them to a role. This guide focuses on two capabilities: adding individual members to roles and applying time-based IAM Conditions.

BucketIAMMember is non-authoritative: it adds one member to one role without removing other members or affecting other roles. The examples reference existing buckets and grant access to existing user accounts or service accounts. They’re intentionally small. Combine them with your own bucket and identity management.

Grant a role to a single member

Most IAM configurations add a specific user or service account to a bucket role without affecting existing access.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.storage.BucketIAMMember("member", {
    bucket: _default.name,
    role: "roles/storage.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.storage.BucketIAMMember("member",
    bucket=default["name"],
    role="roles/storage.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := storage.NewBucketIAMMember(ctx, "member", &storage.BucketIAMMemberArgs{
			Bucket: pulumi.Any(_default.Name),
			Role:   pulumi.String("roles/storage.admin"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Storage.BucketIAMMember("member", new()
    {
        Bucket = @default.Name,
        Role = "roles/storage.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMMember;
import com.pulumi.gcp.storage.BucketIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new BucketIAMMember("member", BucketIAMMemberArgs.builder()
            .bucket(default_.name())
            .role("roles/storage.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:storage:BucketIAMMember
    properties:
      bucket: ${default.name}
      role: roles/storage.admin
      member: user:jane@example.com

The bucket property identifies the target bucket by name. The role property specifies a predefined role like “roles/storage.admin” or a custom role in the format “[projects|organizations]/{parent-name}/roles/{role-name}”. The member property identifies who receives access using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. This resource preserves other members already assigned to the role.

Add time-limited access with IAM Conditions

Temporary access grants expire automatically when conditions are no longer met, reducing manual cleanup.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.storage.BucketIAMMember("member", {
    bucket: _default.name,
    role: "roles/storage.admin",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.storage.BucketIAMMember("member",
    bucket=default["name"],
    role="roles/storage.admin",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := storage.NewBucketIAMMember(ctx, "member", &storage.BucketIAMMemberArgs{
			Bucket: pulumi.Any(_default.Name),
			Role:   pulumi.String("roles/storage.admin"),
			Member: pulumi.String("user:jane@example.com"),
			Condition: &storage.BucketIAMMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Storage.BucketIAMMember("member", new()
    {
        Bucket = @default.Name,
        Role = "roles/storage.admin",
        Member = "user:jane@example.com",
        Condition = new Gcp.Storage.Inputs.BucketIAMMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMMember;
import com.pulumi.gcp.storage.BucketIAMMemberArgs;
import com.pulumi.gcp.storage.inputs.BucketIAMMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new BucketIAMMember("member", BucketIAMMemberArgs.builder()
            .bucket(default_.name())
            .role("roles/storage.admin")
            .member("user:jane@example.com")
            .condition(BucketIAMMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:storage:BucketIAMMember
    properties:
      bucket: ${default.name}
      role: roles/storage.admin
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition property adds an IAM Condition that restricts when the grant is active. The expression uses CEL (Common Expression Language) to define the constraint; here, “request.time < timestamp(…)” expires access at midnight on 2020-01-01. The title and description document the condition’s purpose. IAM Conditions have known limitations documented in the GCP IAM Conditions overview.

Beyond these examples

These snippets focus on specific BucketIAMMember features: single-member role grants and time-based IAM Conditions. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as Cloud Storage buckets and user accounts or service accounts to grant access to. They focus on granting access to individual members rather than managing complete policies.

To keep things focused, common IAM patterns are omitted, including:

  • Multi-member role grants (use BucketIAMBinding)
  • Complete policy replacement (use BucketIAMPolicy)
  • Complex condition expressions (location, resource tags)
  • Custom role definitions

These omissions are intentional: the goal is to illustrate how BucketIAMMember grants are wired, not provide drop-in access control modules. See the BucketIAMMember resource reference for all available configuration options.

Let's manage GCP Cloud Storage Bucket IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
Which IAM resource should I use for my bucket?
Use gcp.storage.BucketIAMPolicy for full policy control (authoritative), gcp.storage.BucketIAMBinding to manage all members for a specific role, or gcp.storage.BucketIAMMember to add individual members without affecting others.
Can I use BucketIAMPolicy with BucketIAMBinding or BucketIAMMember?
No, gcp.storage.BucketIAMPolicy cannot be used with gcp.storage.BucketIAMBinding or gcp.storage.BucketIAMMember because they’ll conflict over the policy.
Can I use BucketIAMBinding and BucketIAMMember together?
Yes, but only if they don’t grant privileges to the same role. Each role must be managed by only one resource type.
Member & Role Configuration
What member formats are supported?
Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:projectid, projectEditor:projectid, and projectViewer:projectid.
How do I grant access to everyone on the internet?
Use allUsers for anyone (with or without a Google account), or allAuthenticatedUsers for anyone authenticated with a Google account or service account.
What format do custom roles require?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.
IAM Conditions
How do I add time-based or conditional access?
Add a condition block with title, description, and expression fields. For example, use request.time < timestamp("2020-01-01T00:00:00Z") for time-based expiration.
Are there limitations with IAM Conditions?
Yes, IAM Conditions have known limitations. Review the GCP documentation if you encounter issues with conditions.
Immutability & Updates
What properties can't be changed after creation?
The bucket, member, role, and condition properties are all immutable and require resource replacement if changed.

Using a different cloud?

Explore storage guides for other cloud providers:

AWS Guides Azure Guides