The gcp:tags/tagKeyIamMember:TagKeyIamMember resource, part of the Pulumi GCP provider, grants IAM permissions to individual identities on tag keys without affecting other members or roles. This guide focuses on two capabilities: single-member permission grants and time-based access expiration with IAM Conditions.
This resource is non-authoritative, meaning it adds one identity to one role while preserving existing permissions. It references existing tag keys and grants access to user accounts, service accounts, or groups. The examples are intentionally small. Combine them with your own tag key infrastructure and identity management.
Grant a single user access to a tag key
Most IAM configurations start by granting individual users or service accounts access to specific resources without disrupting existing permissions.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.tags.TagKeyIamMember("member", {
tagKey: key.name,
role: "roles/viewer",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
member = gcp.tags.TagKeyIamMember("member",
tag_key=key["name"],
role="roles/viewer",
member="user:jane@example.com")
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/tags"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := tags.NewTagKeyIamMember(ctx, "member", &tags.TagKeyIamMemberArgs{
TagKey: pulumi.Any(key.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Tags.TagKeyIamMember("member", new()
{
TagKey = key.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.tags.TagKeyIamMember;
import com.pulumi.gcp.tags.TagKeyIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new TagKeyIamMember("member", TagKeyIamMemberArgs.builder()
.tagKey(key.name())
.role("roles/viewer")
.member("user:jane@example.com")
.build());
}
}
resources:
member:
type: gcp:tags:TagKeyIamMember
properties:
tagKey: ${key.name}
role: roles/viewer
member: user:jane@example.com
The member property specifies the identity receiving access, using formats like “user:jane@example.com” for Google accounts or “serviceAccount:app@project.iam.gserviceaccount.com” for service accounts. The role property defines the permission level. The tagKey property references the tag key by name. This resource adds the member to the role without removing other members or affecting other roles on the same tag key.
Add time-limited access with IAM Conditions
Temporary access grants expire automatically when conditions evaluate to false, eliminating manual cleanup.
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const member = new gcp.tags.TagKeyIamMember("member", {
tagKey: key.name,
role: "roles/viewer",
member: "user:jane@example.com",
condition: {
title: "expires_after_2019_12_31",
description: "Expiring at midnight of 2019-12-31",
expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
import pulumi
import pulumi_gcp as gcp
member = gcp.tags.TagKeyIamMember("member",
tag_key=key["name"],
role="roles/viewer",
member="user:jane@example.com",
condition={
"title": "expires_after_2019_12_31",
"description": "Expiring at midnight of 2019-12-31",
"expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
})
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/tags"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := tags.NewTagKeyIamMember(ctx, "member", &tags.TagKeyIamMemberArgs{
TagKey: pulumi.Any(key.Name),
Role: pulumi.String("roles/viewer"),
Member: pulumi.String("user:jane@example.com"),
Condition: &tags.TagKeyIamMemberConditionArgs{
Title: pulumi.String("expires_after_2019_12_31"),
Description: pulumi.String("Expiring at midnight of 2019-12-31"),
Expression: pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var member = new Gcp.Tags.TagKeyIamMember("member", new()
{
TagKey = key.Name,
Role = "roles/viewer",
Member = "user:jane@example.com",
Condition = new Gcp.Tags.Inputs.TagKeyIamMemberConditionArgs
{
Title = "expires_after_2019_12_31",
Description = "Expiring at midnight of 2019-12-31",
Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.tags.TagKeyIamMember;
import com.pulumi.gcp.tags.TagKeyIamMemberArgs;
import com.pulumi.gcp.tags.inputs.TagKeyIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var member = new TagKeyIamMember("member", TagKeyIamMemberArgs.builder()
.tagKey(key.name())
.role("roles/viewer")
.member("user:jane@example.com")
.condition(TagKeyIamMemberConditionArgs.builder()
.title("expires_after_2019_12_31")
.description("Expiring at midnight of 2019-12-31")
.expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
.build())
.build());
}
}
resources:
member:
type: gcp:tags:TagKeyIamMember
properties:
tagKey: ${key.name}
role: roles/viewer
member: user:jane@example.com
condition:
title: expires_after_2019_12_31
description: Expiring at midnight of 2019-12-31
expression: request.time < timestamp("2020-01-01T00:00:00Z")
The condition block adds temporal constraints to the permission grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here, it expires at midnight on 2020-01-01. The title and description properties document the condition’s purpose. When the condition evaluates to false, GCP automatically denies access without requiring resource updates.
Beyond these examples
These snippets focus on specific TagKeyIamMember features: single-member permission grants and time-based access expiration. They’re intentionally minimal rather than full IAM configurations.
The examples reference pre-existing infrastructure such as tag keys (referenced by name) and user accounts or service accounts. They focus on granting permissions rather than provisioning the underlying tag infrastructure.
To keep things focused, common IAM patterns are omitted, including:
- Bulk member grants (use TagKeyIamBinding for multiple members per role)
- Complete policy replacement (use TagKeyIamPolicy for authoritative control)
- Complex condition expressions (location, resource attributes)
- Custom role definitions and formatting
These omissions are intentional: the goal is to illustrate how TagKeyIamMember grants are wired, not provide drop-in IAM modules. See the TagKeyIamMember resource reference for all available configuration options.
Let's manage GCP Tag Key IAM Permissions
Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.
Try Pulumi Cloud for FREEFrequently Asked Questions
Resource Selection & Conflicts
gcp.tags.TagKeyIamPolicy is authoritative and replaces the entire IAM policy. gcp.tags.TagKeyIamBinding is authoritative for a specific role, managing all members for that role while preserving other roles. gcp.tags.TagKeyIamMember is non-authoritative, adding a single member to a role without affecting other members.gcp.tags.TagKeyIamPolicy cannot be used with gcp.tags.TagKeyIamBinding or gcp.tags.TagKeyIamMember because they will conflict over policy management. Choose one approach: use Policy for full control, or use Binding/Member for granular management.Configuration & Identity Management
allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, or federated identity principals like principal://iam.googleapis.com/....[projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.Advanced Features
condition property with title, description, and expression. For example, use expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")" to expire access at midnight on January 1, 2020.