Manage GCP Subnetwork IAM Bindings

The gcp:compute/subnetworkIAMBinding:SubnetworkIAMBinding resource, part of the Pulumi GCP provider, grants a specific IAM role to a list of members on a VPC subnetwork while preserving other roles in the policy. This guide focuses on three capabilities: binding multiple members to a role, adding individual members incrementally, and applying time-based access with IAM Conditions.

IAM bindings reference existing VPC subnetworks and require project and region identifiers. The examples are intentionally small. Combine them with your own subnetwork references and identity management workflows.

Grant a role to multiple members at once

Teams managing VPC access often need to grant the same role to multiple users or service accounts simultaneously, ensuring consistent permissions across a group.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.SubnetworkIAMBinding("binding", {
    project: network_with_private_secondary_ip_ranges.project,
    region: network_with_private_secondary_ip_ranges.region,
    subnetwork: network_with_private_secondary_ip_ranges.name,
    role: "roles/compute.networkUser",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.SubnetworkIAMBinding("binding",
    project=network_with_private_secondary_ip_ranges["project"],
    region=network_with_private_secondary_ip_ranges["region"],
    subnetwork=network_with_private_secondary_ip_ranges["name"],
    role="roles/compute.networkUser",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewSubnetworkIAMBinding(ctx, "binding", &compute.SubnetworkIAMBindingArgs{
			Project:    pulumi.Any(network_with_private_secondary_ip_ranges.Project),
			Region:     pulumi.Any(network_with_private_secondary_ip_ranges.Region),
			Subnetwork: pulumi.Any(network_with_private_secondary_ip_ranges.Name),
			Role:       pulumi.String("roles/compute.networkUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.SubnetworkIAMBinding("binding", new()
    {
        Project = network_with_private_secondary_ip_ranges.Project,
        Region = network_with_private_secondary_ip_ranges.Region,
        Subnetwork = network_with_private_secondary_ip_ranges.Name,
        Role = "roles/compute.networkUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.SubnetworkIAMBinding;
import com.pulumi.gcp.compute.SubnetworkIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new SubnetworkIAMBinding("binding", SubnetworkIAMBindingArgs.builder()
            .project(network_with_private_secondary_ip_ranges.project())
            .region(network_with_private_secondary_ip_ranges.region())
            .subnetwork(network_with_private_secondary_ip_ranges.name())
            .role("roles/compute.networkUser")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:SubnetworkIAMBinding
    properties:
      project: ${["network-with-private-secondary-ip-ranges"].project}
      region: ${["network-with-private-secondary-ip-ranges"].region}
      subnetwork: ${["network-with-private-secondary-ip-ranges"].name}
      role: roles/compute.networkUser
      members:
        - user:jane@example.com

The SubnetworkIAMBinding resource is authoritative for the specified role: it replaces all members for that role on the subnetwork. The members array accepts user accounts, service accounts, groups, and special identifiers like allAuthenticatedUsers. The subnetwork, project, and region properties identify which VPC subnetwork receives the binding.

Add a single member to a role incrementally

When onboarding individual users or service accounts, teams often add them one at a time without affecting existing role assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.compute.SubnetworkIAMMember("member", {
    project: network_with_private_secondary_ip_ranges.project,
    region: network_with_private_secondary_ip_ranges.region,
    subnetwork: network_with_private_secondary_ip_ranges.name,
    role: "roles/compute.networkUser",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.compute.SubnetworkIAMMember("member",
    project=network_with_private_secondary_ip_ranges["project"],
    region=network_with_private_secondary_ip_ranges["region"],
    subnetwork=network_with_private_secondary_ip_ranges["name"],
    role="roles/compute.networkUser",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewSubnetworkIAMMember(ctx, "member", &compute.SubnetworkIAMMemberArgs{
			Project:    pulumi.Any(network_with_private_secondary_ip_ranges.Project),
			Region:     pulumi.Any(network_with_private_secondary_ip_ranges.Region),
			Subnetwork: pulumi.Any(network_with_private_secondary_ip_ranges.Name),
			Role:       pulumi.String("roles/compute.networkUser"),
			Member:     pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Compute.SubnetworkIAMMember("member", new()
    {
        Project = network_with_private_secondary_ip_ranges.Project,
        Region = network_with_private_secondary_ip_ranges.Region,
        Subnetwork = network_with_private_secondary_ip_ranges.Name,
        Role = "roles/compute.networkUser",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.SubnetworkIAMMember;
import com.pulumi.gcp.compute.SubnetworkIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new SubnetworkIAMMember("member", SubnetworkIAMMemberArgs.builder()
            .project(network_with_private_secondary_ip_ranges.project())
            .region(network_with_private_secondary_ip_ranges.region())
            .subnetwork(network_with_private_secondary_ip_ranges.name())
            .role("roles/compute.networkUser")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:compute:SubnetworkIAMMember
    properties:
      project: ${["network-with-private-secondary-ip-ranges"].project}
      region: ${["network-with-private-secondary-ip-ranges"].region}
      subnetwork: ${["network-with-private-secondary-ip-ranges"].name}
      role: roles/compute.networkUser
      member: user:jane@example.com

The SubnetworkIAMMember resource is non-authoritative: it adds a single member to a role without replacing existing members. Use this when you need to grant access incrementally, such as onboarding contractors or adding service accounts as applications deploy. The member property accepts a single identity in the same formats as the members array.

Apply time-based access with IAM Conditions

Temporary access grants, such as contractor permissions or time-limited testing, require IAM Conditions to automatically expire without manual cleanup.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.compute.SubnetworkIAMBinding("binding", {
    project: network_with_private_secondary_ip_ranges.project,
    region: network_with_private_secondary_ip_ranges.region,
    subnetwork: network_with_private_secondary_ip_ranges.name,
    role: "roles/compute.networkUser",
    members: ["user:jane@example.com"],
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.compute.SubnetworkIAMBinding("binding",
    project=network_with_private_secondary_ip_ranges["project"],
    region=network_with_private_secondary_ip_ranges["region"],
    subnetwork=network_with_private_secondary_ip_ranges["name"],
    role="roles/compute.networkUser",
    members=["user:jane@example.com"],
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/compute"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := compute.NewSubnetworkIAMBinding(ctx, "binding", &compute.SubnetworkIAMBindingArgs{
			Project:    pulumi.Any(network_with_private_secondary_ip_ranges.Project),
			Region:     pulumi.Any(network_with_private_secondary_ip_ranges.Region),
			Subnetwork: pulumi.Any(network_with_private_secondary_ip_ranges.Name),
			Role:       pulumi.String("roles/compute.networkUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Condition: &compute.SubnetworkIAMBindingConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Compute.SubnetworkIAMBinding("binding", new()
    {
        Project = network_with_private_secondary_ip_ranges.Project,
        Region = network_with_private_secondary_ip_ranges.Region,
        Subnetwork = network_with_private_secondary_ip_ranges.Name,
        Role = "roles/compute.networkUser",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Condition = new Gcp.Compute.Inputs.SubnetworkIAMBindingConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.SubnetworkIAMBinding;
import com.pulumi.gcp.compute.SubnetworkIAMBindingArgs;
import com.pulumi.gcp.compute.inputs.SubnetworkIAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new SubnetworkIAMBinding("binding", SubnetworkIAMBindingArgs.builder()
            .project(network_with_private_secondary_ip_ranges.project())
            .region(network_with_private_secondary_ip_ranges.region())
            .subnetwork(network_with_private_secondary_ip_ranges.name())
            .role("roles/compute.networkUser")
            .members("user:jane@example.com")
            .condition(SubnetworkIAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  binding:
    type: gcp:compute:SubnetworkIAMBinding
    properties:
      project: ${["network-with-private-secondary-ip-ranges"].project}
      region: ${["network-with-private-secondary-ip-ranges"].region}
      subnetwork: ${["network-with-private-secondary-ip-ranges"].name}
      role: roles/compute.networkUser
      members:
        - user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

IAM Conditions add temporal or attribute-based constraints to role bindings. The condition block requires a title for identification, an expression using Common Expression Language (CEL), and an optional description. The expression request.time < timestamp("2020-01-01T00:00:00Z") grants access until midnight on December 31, 2019, after which GCP automatically denies requests. Conditions work with both SubnetworkIAMBinding and SubnetworkIAMMember resources.

Beyond these examples

These snippets focus on specific subnetwork IAM features: role-based access control (binding vs member resources) and IAM Conditions for time-based access. They’re intentionally minimal rather than full access control policies.

The examples reference pre-existing infrastructure such as VPC subnetworks (referenced but not created). They focus on configuring IAM bindings rather than provisioning the underlying network resources.

To keep things focused, common IAM patterns are omitted, including:

  • SubnetworkIAMPolicy for full policy replacement
  • Complex condition expressions (attribute-based, resource-based)
  • Custom role definitions and formatting
  • Federated identity and workload identity pool configuration

These omissions are intentional: the goal is to illustrate how each IAM binding approach is wired, not provide drop-in access control modules. See the Subnetwork IAM Binding resource reference for all available configuration options.

Let's manage GCP Subnetwork IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility
Can I use SubnetworkIAMPolicy with SubnetworkIAMBinding or SubnetworkIAMMember?
No, SubnetworkIAMPolicy cannot be used with SubnetworkIAMBinding or SubnetworkIAMMember as they will conflict over policy control. Use either SubnetworkIAMPolicy alone (authoritative) or SubnetworkIAMBinding/SubnetworkIAMMember (granular).
Can I use SubnetworkIAMBinding and SubnetworkIAMMember together?
Yes, but only if they grant different roles. Using both for the same role causes conflicts.
What's the difference between SubnetworkIAMPolicy, IAMBinding, and IAMMember?
SubnetworkIAMPolicy is fully authoritative and replaces the entire policy. SubnetworkIAMBinding is authoritative for a specific role but preserves other roles. SubnetworkIAMMember is non-authoritative and preserves other members for the same role.
IAM Roles & Permissions
Can I create multiple SubnetworkIAMBinding resources for the same role?
No, only one SubnetworkIAMBinding can be used per role. To grant the same role to multiple members, include all members in the members array of a single binding.
What's the format for custom IAM roles?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.
Member Identities
What member identity formats are supported?
You can specify members as user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, allUsers, allAuthenticatedUsers, projectOwner:projectid, projectEditor:projectid, projectViewer:projectid, or federated identities using the principal identifier format.
IAM Conditions
How do I add time-based or conditional access restrictions?
Use the condition property with title, description, and expression fields. For example, to expire access: expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")".
Are there any limitations with IAM Conditions?
Yes, IAM Conditions have known limitations. The condition property is immutable after creation, and you should review the limitations before using conditions in production.
Can I modify a condition after creating the binding?
No, the condition property is immutable. You must delete and recreate the binding to change conditions.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides