Manage GCP Tag Value IAM Members

The gcp:tags/tagValueIamMember:TagValueIamMember resource, part of the Pulumi GCP provider, grants IAM permissions to individual members on tag values without affecting other members or roles. This guide focuses on two capabilities: single-member role grants and time-based access with IAM Conditions.

This resource is non-authoritative, meaning it adds one member to one role while preserving existing permissions. It’s one of three IAM management options (TagValueIamPolicy, TagValueIamBinding, TagValueIamMember) that have different authoritativeness levels and cannot be mixed for the same role. The examples are intentionally small. Combine them with your own TagValue resources and member identities.

Grant a single user access to a tag value

Most IAM configurations add individual users or service accounts to specific tag values without disrupting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.tags.TagValueIamMember("member", {
    tagValue: value.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.tags.TagValueIamMember("member",
    tag_value=value["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/tags"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := tags.NewTagValueIamMember(ctx, "member", &tags.TagValueIamMemberArgs{
			TagValue: pulumi.Any(value.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Tags.TagValueIamMember("member", new()
    {
        TagValue = @value.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.tags.TagValueIamMember;
import com.pulumi.gcp.tags.TagValueIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new TagValueIamMember("member", TagValueIamMemberArgs.builder()
            .tagValue(value.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:tags:TagValueIamMember
    properties:
      tagValue: ${value.name}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies who receives access using formats like “user:jane@example.com”, “serviceAccount:app@project.iam.gserviceaccount.com”, or “group:team@example.com”. The role property defines what they can do (e.g., “roles/viewer”). The tagValue property identifies which tag value to grant access to. This resource is non-authoritative: it adds this one member without removing others who already have the same role.

Grant time-limited access with IAM Conditions

For contractors or time-bound projects, IAM Conditions attach expiration dates or other constraints to permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.tags.TagValueIamMember("member", {
    tagValue: value.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.tags.TagValueIamMember("member",
    tag_value=value["name"],
    role="roles/viewer",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/tags"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := tags.NewTagValueIamMember(ctx, "member", &tags.TagValueIamMemberArgs{
			TagValue: pulumi.Any(value.Name),
			Role:     pulumi.String("roles/viewer"),
			Member:   pulumi.String("user:jane@example.com"),
			Condition: &tags.TagValueIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Tags.TagValueIamMember("member", new()
    {
        TagValue = @value.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
        Condition = new Gcp.Tags.Inputs.TagValueIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.tags.TagValueIamMember;
import com.pulumi.gcp.tags.TagValueIamMemberArgs;
import com.pulumi.gcp.tags.inputs.TagValueIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new TagValueIamMember("member", TagValueIamMemberArgs.builder()
            .tagValue(value.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .condition(TagValueIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:tags:TagValueIamMember
    properties:
      tagValue: ${value.name}
      role: roles/viewer
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block adds constraints to the permission grant. The expression property uses CEL (Common Expression Language) to define when access is valid; here, it expires at midnight on 2020-01-01. The title and description properties document the condition’s purpose. IAM Conditions have known limitations around certain resource types and condition combinations, so review Google Cloud’s documentation if you encounter issues.

Beyond these examples

These snippets focus on specific TagValueIamMember features: single-member IAM grants and time-based access with IAM Conditions. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as TagValue resources (referenced via value.name). They focus on granting permissions rather than creating the tag values themselves.

To keep things focused, common IAM patterns are omitted, including:

  • Multi-member role grants (TagValueIamBinding)
  • Complete policy replacement (TagValueIamPolicy)
  • Complex condition expressions (location, resource type filters)
  • Service account and group member types

These omissions are intentional: the goal is to illustrate how TagValueIamMember grants are wired, not provide drop-in access control modules. See the TagValueIamMember resource reference for all available configuration options.

Let's manage GCP Tag Value IAM Members

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between TagValueIamPolicy, TagValueIamBinding, and TagValueIamMember?
TagValueIamPolicy is authoritative and replaces the entire IAM policy. TagValueIamBinding is authoritative for a specific role, preserving other roles. TagValueIamMember is non-authoritative, adding a single member to a role while preserving other members.
Can I use TagValueIamPolicy together with TagValueIamBinding or TagValueIamMember?
No, TagValueIamPolicy cannot be used with TagValueIamBinding or TagValueIamMember as they will conflict over the policy configuration.
Can I use TagValueIamBinding and TagValueIamMember together?
Yes, but only if they don’t grant privileges to the same role. Each role must be managed by only one resource type.
Configuration & Identity Types
What identity types can I specify in the member field?
You can use allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, or federated identities (e.g., principal://iam.googleapis.com/...).
What format should I use for custom roles?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, such as projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.
What properties can't be changed after creation?
All core properties are immutable: member, role, tagValue, and condition. You must recreate the resource to change any of these.
Advanced Features & Limitations
Can I use IAM Conditions with TagValueIamMember?
Yes, add a condition block with title, description, and expression fields. Note that IAM Conditions have known limitations that may affect certain use cases.
How do I grant time-limited access using IAM Conditions?
Add a condition block with an expression like request.time < timestamp("2020-01-01T00:00:00Z") to set an expiration time for the binding.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides