Manage GCP Vertex AI Feature Store IAM Access

The gcp:vertex/aiFeatureOnlineStoreFeatureviewIamMember:AiFeatureOnlineStoreFeatureviewIamMember resource, part of the Pulumi GCP provider, manages IAM permissions for Vertex AI Feature Online Store feature views. This guide focuses on three approaches: adding individual members, binding roles to multiple members, and replacing entire policies.

Three related resources manage feature view permissions. AiFeatureOnlineStoreFeatureviewIamMember adds individual users non-authoritatively, preserving other grants. AiFeatureOnlineStoreFeatureviewIamBinding manages all members for a specific role authoritatively. AiFeatureOnlineStoreFeatureviewIamPolicy replaces the entire policy. The examples are intentionally small. Combine them with your own feature stores and access requirements.

Grant a single user access to a feature view

When you need to add one user or service account to a feature view without affecting existing permissions, use the member resource.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.vertex.AiFeatureOnlineStoreFeatureviewIamMember("member", {
    region: featureview.region,
    featureOnlineStore: featureview.featureOnlineStore,
    featureView: featureview.name,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.vertex.AiFeatureOnlineStoreFeatureviewIamMember("member",
    region=featureview["region"],
    feature_online_store=featureview["featureOnlineStore"],
    feature_view=featureview["name"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vertex.NewAiFeatureOnlineStoreFeatureviewIamMember(ctx, "member", &vertex.AiFeatureOnlineStoreFeatureviewIamMemberArgs{
			Region:             pulumi.Any(featureview.Region),
			FeatureOnlineStore: pulumi.Any(featureview.FeatureOnlineStore),
			FeatureView:        pulumi.Any(featureview.Name),
			Role:               pulumi.String("roles/viewer"),
			Member:             pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Vertex.AiFeatureOnlineStoreFeatureviewIamMember("member", new()
    {
        Region = featureview.Region,
        FeatureOnlineStore = featureview.FeatureOnlineStore,
        FeatureView = featureview.Name,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreFeatureviewIamMember;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreFeatureviewIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new AiFeatureOnlineStoreFeatureviewIamMember("member", AiFeatureOnlineStoreFeatureviewIamMemberArgs.builder()
            .region(featureview.region())
            .featureOnlineStore(featureview.featureOnlineStore())
            .featureView(featureview.name())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:vertex:AiFeatureOnlineStoreFeatureviewIamMember
    properties:
      region: ${featureview.region}
      featureOnlineStore: ${featureview.featureOnlineStore}
      featureView: ${featureview.name}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies the identity to grant access, using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property defines the permission level. This resource is non-authoritative: it adds the member without removing other grants for the same role.

Grant a role to multiple members at once

When multiple identities need the same access level, binding them to a single role is more efficient than individual grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.vertex.AiFeatureOnlineStoreFeatureviewIamBinding("binding", {
    region: featureview.region,
    featureOnlineStore: featureview.featureOnlineStore,
    featureView: featureview.name,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.vertex.AiFeatureOnlineStoreFeatureviewIamBinding("binding",
    region=featureview["region"],
    feature_online_store=featureview["featureOnlineStore"],
    feature_view=featureview["name"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := vertex.NewAiFeatureOnlineStoreFeatureviewIamBinding(ctx, "binding", &vertex.AiFeatureOnlineStoreFeatureviewIamBindingArgs{
			Region:             pulumi.Any(featureview.Region),
			FeatureOnlineStore: pulumi.Any(featureview.FeatureOnlineStore),
			FeatureView:        pulumi.Any(featureview.Name),
			Role:               pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Vertex.AiFeatureOnlineStoreFeatureviewIamBinding("binding", new()
    {
        Region = featureview.Region,
        FeatureOnlineStore = featureview.FeatureOnlineStore,
        FeatureView = featureview.Name,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreFeatureviewIamBinding;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreFeatureviewIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new AiFeatureOnlineStoreFeatureviewIamBinding("binding", AiFeatureOnlineStoreFeatureviewIamBindingArgs.builder()
            .region(featureview.region())
            .featureOnlineStore(featureview.featureOnlineStore())
            .featureView(featureview.name())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:vertex:AiFeatureOnlineStoreFeatureviewIamBinding
    properties:
      region: ${featureview.region}
      featureOnlineStore: ${featureview.featureOnlineStore}
      featureView: ${featureview.name}
      role: roles/viewer
      members:
        - user:jane@example.com

The members property accepts a list of identities to grant the role. This resource is authoritative for the specified role: it replaces all members for that role but preserves other roles in the policy. You can combine binding resources for different roles on the same feature view.

Replace the entire IAM policy for a feature view

Some workflows require complete control over permissions, replacing any existing policy with a new definition.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.vertex.AiFeatureOnlineStoreFeatureviewIamPolicy("policy", {
    region: featureview.region,
    featureOnlineStore: featureview.featureOnlineStore,
    featureView: featureview.name,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.vertex.AiFeatureOnlineStoreFeatureviewIamPolicy("policy",
    region=featureview["region"],
    feature_online_store=featureview["featureOnlineStore"],
    feature_view=featureview["name"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/vertex"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = vertex.NewAiFeatureOnlineStoreFeatureviewIamPolicy(ctx, "policy", &vertex.AiFeatureOnlineStoreFeatureviewIamPolicyArgs{
			Region:             pulumi.Any(featureview.Region),
			FeatureOnlineStore: pulumi.Any(featureview.FeatureOnlineStore),
			FeatureView:        pulumi.Any(featureview.Name),
			PolicyData:         pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Vertex.AiFeatureOnlineStoreFeatureviewIamPolicy("policy", new()
    {
        Region = featureview.Region,
        FeatureOnlineStore = featureview.FeatureOnlineStore,
        FeatureView = featureview.Name,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreFeatureviewIamPolicy;
import com.pulumi.gcp.vertex.AiFeatureOnlineStoreFeatureviewIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new AiFeatureOnlineStoreFeatureviewIamPolicy("policy", AiFeatureOnlineStoreFeatureviewIamPolicyArgs.builder()
            .region(featureview.region())
            .featureOnlineStore(featureview.featureOnlineStore())
            .featureView(featureview.name())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:vertex:AiFeatureOnlineStoreFeatureviewIamPolicy
    properties:
      region: ${featureview.region}
      featureOnlineStore: ${featureview.featureOnlineStore}
      featureView: ${featureview.name}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The policyData property accepts the output from getIAMPolicy, which defines bindings for one or more roles. This resource is fully authoritative: it replaces the entire IAM policy, removing any grants not included in the new policy. Use this when you need to ensure no unexpected permissions exist.

Beyond these examples

These snippets focus on specific IAM management approaches: individual member grants, role bindings for multiple members, and authoritative policy replacement. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as Vertex AI Feature Online Stores and feature views within the store. They focus on permission management rather than provisioning the underlying feature store resources.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Cross-project access (project property)
Custom role definitions
Policy data source for reading existing policies

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the AiFeatureOnlineStoreFeatureviewIamMember resource reference for all available configuration options.

Let's manage GCP Vertex AI Feature Store IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Usage

What's the difference between IamPolicy, IamBinding, and IamMember?

AiFeatureOnlineStoreFeatureviewIamPolicy is authoritative and replaces the entire IAM policy. AiFeatureOnlineStoreFeatureviewIamBinding is authoritative for a specific role, managing all members for that role while preserving other roles. AiFeatureOnlineStoreFeatureviewIamMember is non-authoritative, adding individual members without affecting other members or roles.

Common Pitfalls & Conflicts

Can I mix IamPolicy, IamBinding, and IamMember resources?

IamPolicy cannot be used with IamBinding or IamMember because they will conflict over the policy. However, IamBinding and IamMember can be used together as long as they don’t grant privileges to the same role.

Configuration & Formats

What identity formats can I use for the member parameter?

The member parameter supports multiple formats: allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

How do I specify a custom IAM role?

Custom roles must use the full format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

Does the region parameter need to match my feature online store?

Yes, the region should match the featureonlinestore region. If not specified, it will be parsed from the parent resource identifier or taken from the provider configuration.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides