Manage GCP Vertex AI Feature Store Entity Type IAM Bindings

The gcp:vertex/aiFeatureStoreEntityTypeIamBinding:AiFeatureStoreEntityTypeIamBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Vertex AI Featurestore EntityTypes, controlling which identities can access feature data. This guide focuses on two capabilities: granting roles to multiple members and adding individual members to roles.

IAM bindings reference existing Featurestore and EntityType resources. The Binding resource is authoritative for a given role, meaning it replaces the entire member list for that role. You can use Binding and Member resources together as long as they manage different roles. The examples are intentionally small. Combine them with your own Featurestore infrastructure and identity management.

Grant a role to multiple members at once

When onboarding a data science team, you often need to grant the same role to multiple users or service accounts simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.vertex.AiFeatureStoreEntityTypeIamBinding("binding", {
    featurestore: entity.featurestore,
    entitytype: entity.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.vertex.AiFeatureStoreEntityTypeIamBinding("binding",
    featurestore=entity["featurestore"],
    entitytype=entity["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vertex.NewAiFeatureStoreEntityTypeIamBinding(ctx, "binding", &vertex.AiFeatureStoreEntityTypeIamBindingArgs{
			Featurestore: pulumi.Any(entity.Featurestore),
			Entitytype:   pulumi.Any(entity.Name),
			Role:         pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Vertex.AiFeatureStoreEntityTypeIamBinding("binding", new()
    {
        Featurestore = entity.Featurestore,
        Entitytype = entity.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.vertex.AiFeatureStoreEntityTypeIamBinding;
import com.pulumi.gcp.vertex.AiFeatureStoreEntityTypeIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new AiFeatureStoreEntityTypeIamBinding("binding", AiFeatureStoreEntityTypeIamBindingArgs.builder()
            .featurestore(entity.featurestore())
            .entitytype(entity.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:vertex:AiFeatureStoreEntityTypeIamBinding
    properties:
      featurestore: ${entity.featurestore}
      entitytype: ${entity.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The Binding resource is authoritative for the specified role. The members array lists all identities that should have this role; any existing members not in this list are removed. The featurestore and entitytype properties identify which EntityType to grant access to. Use this approach when you want to define the complete member list for a role in one place.

Add a single member to an existing role

To grant access to one additional user without affecting other members, use the Member resource.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.vertex.AiFeatureStoreEntityTypeIamMember("member", {
    featurestore: entity.featurestore,
    entitytype: entity.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.vertex.AiFeatureStoreEntityTypeIamMember("member",
    featurestore=entity["featurestore"],
    entitytype=entity["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vertex.NewAiFeatureStoreEntityTypeIamMember(ctx, "member", &vertex.AiFeatureStoreEntityTypeIamMemberArgs{
			Featurestore: pulumi.Any(entity.Featurestore),
			Entitytype:   pulumi.Any(entity.Name),
			Role:         pulumi.String("roles/viewer"),
			Member:       pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Vertex.AiFeatureStoreEntityTypeIamMember("member", new()
    {
        Featurestore = entity.Featurestore,
        Entitytype = entity.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.vertex.AiFeatureStoreEntityTypeIamMember;
import com.pulumi.gcp.vertex.AiFeatureStoreEntityTypeIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new AiFeatureStoreEntityTypeIamMember("member", AiFeatureStoreEntityTypeIamMemberArgs.builder()
            .featurestore(entity.featurestore())
            .entitytype(entity.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:vertex:AiFeatureStoreEntityTypeIamMember
    properties:
      featurestore: ${entity.featurestore}
      entitytype: ${entity.name}
      role: roles/viewer
      member: user:jane@example.com

The Member resource is non-authoritative. It adds one identity to the role without removing other members. The member property takes a single identity string, while the role, featurestore, and entitytype properties work the same as in Binding. Use this when you need to grant access incrementally without managing the full member list.

Beyond these examples

These snippets focus on specific IAM binding features: role-based access control and multi-member and single-member grants. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Vertex AI Featurestore and EntityType resources. They focus on configuring IAM bindings rather than provisioning the feature store itself.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy resource for full policy replacement
Custom role definitions

These omissions are intentional: the goal is to illustrate how each IAM binding feature is wired, not provide drop-in access control modules. See the AiFeatureStoreEntityTypeIamBinding resource reference for all available configuration options.

Let's manage GCP Vertex AI Feature Store Entity Type IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resource should I use for managing permissions?

You have three options:

AiFeatureStoreEntityTypeIamPolicy - Authoritative, replaces the entire IAM policy
AiFeatureStoreEntityTypeIamBinding - Authoritative for a specific role, preserves other roles
AiFeatureStoreEntityTypeIamMember - Non-authoritative, adds individual members while preserving others

Can I mix different IAM resource types?

AiFeatureStoreEntityTypeIamPolicy cannot be used with AiFeatureStoreEntityTypeIamBinding or AiFeatureStoreEntityTypeIamMember as they will conflict. However, AiFeatureStoreEntityTypeIamBinding can be used with AiFeatureStoreEntityTypeIamMember only if they manage different roles.

What happens if I use IamPolicy with IamBinding or IamMember?

The resources will fight over policy control, causing conflicts and unpredictable behavior. Choose one approach and stick with it.

Configuration & Identity Management

What identity formats can I use in the members array?

Supported formats include user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, allUsers, allAuthenticatedUsers, project roles like projectOwner:projectid, and federated identities (see Principal identifiers documentation for examples).

What properties are immutable after creation?

The entitytype, featurestore, role, and condition properties cannot be changed after the resource is created.

What format should I use for the featurestore parameter?

Use the format projects/{project}/locations/{location}/featurestores/{featurestore}.

Custom Roles & Advanced Usage

How do I specify custom IAM roles?

Custom roles must use the full path format: [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

Beta Status & Limitations

Is this resource production-ready?

This resource is in beta and requires the terraform-provider-google-beta provider. Be aware of potential API changes.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides