Configure GCP Cloud Storage IAM Permissions

The gcp:storage/bucketIAMBinding:BucketIAMBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Cloud Storage buckets by controlling which identities have specific permissions. This guide focuses on three capabilities: authoritative role binding for multiple members, time-based access with IAM Conditions, and non-authoritative single-member grants.

IAM bindings reference existing buckets and Google Cloud identities. The examples are intentionally small. Combine them with your own bucket resources and identity management.

Grant a role to multiple members at once

When managing bucket access, you often need to grant the same role to multiple users, service accounts, or groups simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.storage.BucketIAMBinding("binding", {
    bucket: _default.name,
    role: "roles/storage.admin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.storage.BucketIAMBinding("binding",
    bucket=default["name"],
    role="roles/storage.admin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := storage.NewBucketIAMBinding(ctx, "binding", &storage.BucketIAMBindingArgs{
			Bucket: pulumi.Any(_default.Name),
			Role:   pulumi.String("roles/storage.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Storage.BucketIAMBinding("binding", new()
    {
        Bucket = @default.Name,
        Role = "roles/storage.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMBinding;
import com.pulumi.gcp.storage.BucketIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new BucketIAMBinding("binding", BucketIAMBindingArgs.builder()
            .bucket(default_.name())
            .role("roles/storage.admin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:storage:BucketIAMBinding
    properties:
      bucket: ${default.name}
      role: roles/storage.admin
      members:
        - user:jane@example.com

The members array lists all identities that receive the specified role. BucketIAMBinding is authoritative for this role: it replaces any existing members for roles/storage.admin. Other roles on the bucket remain unchanged. Each member follows the format “type:identifier” (e.g., “user:jane@example.com”, “serviceAccount:app@project.iam.gserviceaccount.com”).

Add time-based access with IAM Conditions

Access requirements sometimes include expiration dates or time windows for compliance or temporary access scenarios.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.storage.BucketIAMBinding("binding", {
    bucket: _default.name,
    role: "roles/storage.admin",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.storage.BucketIAMBinding("binding",
    bucket=default["name"],
    role="roles/storage.admin",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := storage.NewBucketIAMBinding(ctx, "binding", &storage.BucketIAMBindingArgs{
			Bucket: pulumi.Any(_default.Name),
			Role:   pulumi.String("roles/storage.admin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &storage.BucketIAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Storage.BucketIAMBinding("binding", new()
    {
        Bucket = @default.Name,
        Role = "roles/storage.admin",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Storage.Inputs.BucketIAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMBinding;
import com.pulumi.gcp.storage.BucketIAMBindingArgs;
import com.pulumi.gcp.storage.inputs.BucketIAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new BucketIAMBinding("binding", BucketIAMBindingArgs.builder()
            .bucket(default_.name())
            .role("roles/storage.admin")
            .members("user:jane@example.com")
            .condition(BucketIAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:storage:BucketIAMBinding
    properties:
      bucket: ${default.name}
      role: roles/storage.admin
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block attaches temporal constraints to the role binding. The expression uses CEL (Common Expression Language) to evaluate request.time against a timestamp. When the condition evaluates to false, the binding no longer grants access. The title and description help identify the condition’s purpose in audit logs.

Add a single member to an existing role

When you need to grant access to one additional user without managing the full member list, use BucketIAMMember for non-authoritative updates.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.storage.BucketIAMMember("member", {
    bucket: _default.name,
    role: "roles/storage.admin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.storage.BucketIAMMember("member",
    bucket=default["name"],
    role="roles/storage.admin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := storage.NewBucketIAMMember(ctx, "member", &storage.BucketIAMMemberArgs{
			Bucket: pulumi.Any(_default.Name),
			Role:   pulumi.String("roles/storage.admin"),
			Member: pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Storage.BucketIAMMember("member", new()
    {
        Bucket = @default.Name,
        Role = "roles/storage.admin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.BucketIAMMember;
import com.pulumi.gcp.storage.BucketIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new BucketIAMMember("member", BucketIAMMemberArgs.builder()
            .bucket(default_.name())
            .role("roles/storage.admin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:storage:BucketIAMMember
    properties:
      bucket: ${default.name}
      role: roles/storage.admin
      member: user:jane@example.com

Unlike BucketIAMBinding, BucketIAMMember adds a single principal without affecting other members of the same role. This is useful when multiple teams manage access independently. The member property specifies one identity; use multiple BucketIAMMember resources to add multiple individuals incrementally.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control, IAM Conditions for temporal constraints, and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control policies.

The examples reference pre-existing infrastructure such as Cloud Storage buckets and Google Cloud identities (users, service accounts, groups). They focus on configuring IAM bindings rather than provisioning buckets or managing identity lifecycle.

To keep things focused, common IAM patterns are omitted, including:

Full policy replacement (BucketIAMPolicy resource)
Complex condition expressions (location, resource attributes)
Custom role definitions and formatting
Mixing authoritative and non-authoritative resources for the same role

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the BucketIAMBinding resource reference for all available configuration options.

Let's configure GCP Cloud Storage IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between BucketIAMPolicy, BucketIAMBinding, and BucketIAMMember?

BucketIAMPolicy is fully authoritative and replaces the entire IAM policy. BucketIAMBinding is authoritative for a specific role but preserves other roles. BucketIAMMember is non-authoritative and preserves other members for the same role.

Can I mix BucketIAMPolicy with other IAM resources?

No, BucketIAMPolicy cannot be used with BucketIAMBinding or BucketIAMMember because they will conflict over the policy configuration.

Can I use BucketIAMBinding and BucketIAMMember together?

Yes, but only if they manage different roles. Using both resources for the same role will cause conflicts.

Configuration & Identity Formats

What member identity formats are supported?

You can use these formats in the members property:

allUsers or allAuthenticatedUsers for public/authenticated access
user:{email}, serviceAccount:{email}, or group:{email} for specific identities
domain:{domain} for G Suite domains
projectOwner:projectid, projectEditor:projectid, or projectViewer:projectid for project roles

How do I specify custom IAM roles?

Custom roles must follow the format [projects|organizations]/{parent-name}/roles/{role-name} in the role property.

What properties can't I change after creation?

The bucket, role, and condition properties are immutable and require resource replacement if changed.

IAM Conditions & Advanced Features

How do I add time-based access restrictions?

Use the condition property with title, description, and expression fields. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.

Are there limitations with IAM Conditions?

Yes, IAM Conditions have known limitations that may affect functionality. Review the GCP IAM Conditions documentation if you encounter issues.

Using a different cloud?

Explore storage guides for other cloud providers:

AWS Guides Azure Guides