Manage GCP Vertex AI Feature Store IAM Bindings

The gcp:vertex/aiFeatureOnlineStoreIamBinding:AiFeatureOnlineStoreIamBinding resource, part of the Pulumi GCP provider, manages IAM access control for Vertex AI Feature Online Store instances by binding roles to members. This guide focuses on three approaches: role-based access with Binding resources, incremental member grants, and complete policy replacement.

Three related resources manage feature store IAM: AiFeatureOnlineStoreIamPolicy (fully authoritative), AiFeatureOnlineStoreIamBinding (authoritative per role), and AiFeatureOnlineStoreIamMember (non-authoritative). Policy cannot be used with Binding or Member; Binding and Member can coexist only if they manage different roles. The examples are intentionally small. Choose the resource type that matches your access control workflow.

Grant a role to multiple members at once

Teams managing feature store access often grant the same role to multiple users, service accounts, or groups simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.vertex.AiFeatureOnlineStoreIamBinding("binding", {
    region: featureOnlineStore.region,
    featureOnlineStore: featureOnlineStore.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.vertex.AiFeatureOnlineStoreIamBinding("binding",
    region=feature_online_store["region"],
    feature_online_store=feature_online_store["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vertex.NewAiFeatureOnlineStoreIamBinding(ctx, "binding", &vertex.AiFeatureOnlineStoreIamBindingArgs{
			Region:             pulumi.Any(featureOnlineStore.Region),
			FeatureOnlineStore: pulumi.Any(featureOnlineStore.Name),
			Role:               pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Vertex.AiFeatureOnlineStoreIamBinding("binding", new()
    {
        Region = featureOnlineStore.Region,
        FeatureOnlineStore = featureOnlineStore.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreIamBinding;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new AiFeatureOnlineStoreIamBinding("binding", AiFeatureOnlineStoreIamBindingArgs.builder()
            .region(featureOnlineStore.region())
            .featureOnlineStore(featureOnlineStore.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:vertex:AiFeatureOnlineStoreIamBinding
    properties:
      region: ${featureOnlineStore.region}
      featureOnlineStore: ${featureOnlineStore.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The Binding resource is authoritative for a single role. The members array lists all identities that receive the role; any members not in this list lose access to this role (but keep other roles). The featureOnlineStore and region properties identify which feature store to configure. This approach works well when you manage all members for a role as a unit.

Add a single member to a role incrementally

When access needs evolve, you can add individual members without affecting existing grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.vertex.AiFeatureOnlineStoreIamMember("member", {
    region: featureOnlineStore.region,
    featureOnlineStore: featureOnlineStore.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.vertex.AiFeatureOnlineStoreIamMember("member",
    region=feature_online_store["region"],
    feature_online_store=feature_online_store["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vertex.NewAiFeatureOnlineStoreIamMember(ctx, "member", &vertex.AiFeatureOnlineStoreIamMemberArgs{
			Region:             pulumi.Any(featureOnlineStore.Region),
			FeatureOnlineStore: pulumi.Any(featureOnlineStore.Name),
			Role:               pulumi.String("roles/viewer"),
			Member:             pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Vertex.AiFeatureOnlineStoreIamMember("member", new()
    {
        Region = featureOnlineStore.Region,
        FeatureOnlineStore = featureOnlineStore.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreIamMember;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new AiFeatureOnlineStoreIamMember("member", AiFeatureOnlineStoreIamMemberArgs.builder()
            .region(featureOnlineStore.region())
            .featureOnlineStore(featureOnlineStore.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:vertex:AiFeatureOnlineStoreIamMember
    properties:
      region: ${featureOnlineStore.region}
      featureOnlineStore: ${featureOnlineStore.name}
      role: roles/viewer
      member: user:jane@example.com

The Member resource is non-authoritative. It adds one identity to a role without removing other members already assigned to that role. Use member (singular) instead of members (array) to specify the identity. This approach works well for incremental access grants where you don’t want to track or manage all members centrally.

Replace the entire IAM policy with a new definition

Some workflows require complete control over all IAM bindings, replacing any existing policy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.vertex.AiFeatureOnlineStoreIamPolicy("policy", {
    region: featureOnlineStore.region,
    featureOnlineStore: featureOnlineStore.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.vertex.AiFeatureOnlineStoreIamPolicy("policy",
    region=feature_online_store["region"],
    feature_online_store=feature_online_store["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = vertex.NewAiFeatureOnlineStoreIamPolicy(ctx, "policy", &vertex.AiFeatureOnlineStoreIamPolicyArgs{
			Region:             pulumi.Any(featureOnlineStore.Region),
			FeatureOnlineStore: pulumi.Any(featureOnlineStore.Name),
			PolicyData:         pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Vertex.AiFeatureOnlineStoreIamPolicy("policy", new()
    {
        Region = featureOnlineStore.Region,
        FeatureOnlineStore = featureOnlineStore.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreIamPolicy;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new AiFeatureOnlineStoreIamPolicy("policy", AiFeatureOnlineStoreIamPolicyArgs.builder()
            .region(featureOnlineStore.region())
            .featureOnlineStore(featureOnlineStore.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:vertex:AiFeatureOnlineStoreIamPolicy
    properties:
      region: ${featureOnlineStore.region}
      featureOnlineStore: ${featureOnlineStore.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The Policy resource is fully authoritative. It replaces the entire IAM policy with the bindings defined in policyData. The getIAMPolicy data source constructs the policy document from a list of role-to-members bindings. This approach requires careful coordination because it removes any grants not explicitly defined, including those created outside Pulumi.

Beyond these examples

These snippets focus on specific IAM management patterns: role-based access control (Binding, Member, Policy) and authoritative vs non-authoritative management. They’re intentionally minimal rather than complete access control solutions.

The examples reference pre-existing infrastructure such as Vertex AI Feature Online Store instances and IAM principals (users, service accounts, groups). They focus on configuring access rather than provisioning the feature stores themselves.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions and formatting
Cross-project access patterns
Federated identity configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the AiFeatureOnlineStoreIamBinding resource reference for all available configuration options.

Let's manage GCP Vertex AI Feature Store IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

Can I use AiFeatureOnlineStoreIamPolicy with AiFeatureOnlineStoreIamBinding or AiFeatureOnlineStoreIamMember?

No, AiFeatureOnlineStoreIamPolicy cannot be used together with AiFeatureOnlineStoreIamBinding or AiFeatureOnlineStoreIamMember because they will conflict over the policy configuration.

Can I use AiFeatureOnlineStoreIamBinding and AiFeatureOnlineStoreIamMember together?

Yes, but only if they don’t grant privileges to the same role. Each role must be managed by either Binding or Member, not both.

Resource Selection

What's the difference between the three IAM resource types?

AiFeatureOnlineStoreIamPolicy is authoritative and replaces the entire IAM policy. AiFeatureOnlineStoreIamBinding is authoritative for a specific role, updating the member list while preserving other roles. AiFeatureOnlineStoreIamMember is non-authoritative, adding a single member to a role while preserving other members.

Identity & Role Configuration

What member identity formats are supported?

The members property supports multiple formats: allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

How do I specify a custom IAM role?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

What properties can't be changed after creation?

The featureOnlineStore, project, region, role, and condition properties are all immutable and cannot be modified after the resource is created.

Import & Management

How do I import existing IAM bindings?

Use space-delimited identifiers in the import command. For Member imports: include the resource identifier, role, and member identity. For Binding imports: include the resource identifier and role. For Policy imports: use only the resource identifier.

What resource identifier formats can I use for import?

You can use any of these formats: projects/{{project}}/locations/{{region}}/featureOnlineStores/{{name}}, {{project}}/{{region}}/{{name}}, {{region}}/{{name}}, or just {{name}}. Variables not provided will be taken from the provider configuration.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides