Configure GCP Workforce Pool IAM Bindings

The gcp:iam/workforcePoolIamBinding:WorkforcePoolIamBinding resource, part of the Pulumi GCP provider, grants IAM roles to members on workforce pools, controlling who can manage or use workforce identity federation. This guide focuses on two capabilities: authoritative role bindings for multiple members and non-authoritative single-member grants.

Workforce pool IAM bindings reference existing workforce pools and must not conflict with WorkforcePoolIamPolicy resources, which would create competing policy definitions. The examples are intentionally small. Combine them with your own workforce pool infrastructure and identity management strategy.

Grant a role to multiple members at once

Teams managing workforce pool access often need to grant the same role to multiple users or service accounts simultaneously, ensuring consistent permissions across a group.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iam.WorkforcePoolIamBinding("binding", {
    location: example.location,
    workforcePoolId: example.workforcePoolId,
    role: "roles/iam.workforcePoolAdmin",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iam.WorkforcePoolIamBinding("binding",
    location=example["location"],
    workforce_pool_id=example["workforcePoolId"],
    role="roles/iam.workforcePoolAdmin",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkforcePoolIamBinding(ctx, "binding", &iam.WorkforcePoolIamBindingArgs{
			Location:        pulumi.Any(example.Location),
			WorkforcePoolId: pulumi.Any(example.WorkforcePoolId),
			Role:            pulumi.String("roles/iam.workforcePoolAdmin"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iam.WorkforcePoolIamBinding("binding", new()
    {
        Location = example.Location,
        WorkforcePoolId = example.WorkforcePoolId,
        Role = "roles/iam.workforcePoolAdmin",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePoolIamBinding;
import com.pulumi.gcp.iam.WorkforcePoolIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WorkforcePoolIamBinding("binding", WorkforcePoolIamBindingArgs.builder()
            .location(example.location())
            .workforcePoolId(example.workforcePoolId())
            .role("roles/iam.workforcePoolAdmin")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iam:WorkforcePoolIamBinding
    properties:
      location: ${example.location}
      workforcePoolId: ${example.workforcePoolId}
      role: roles/iam.workforcePoolAdmin
      members:
        - user:jane@example.com

The WorkforcePoolIamBinding resource is authoritative for the specified role: it replaces any existing member list for that role. The members array accepts user emails, service accounts, groups, domains, and federated identities. The workforcePoolId identifies the target pool, and location specifies the geographic region.

Add a single member to a role incrementally

When onboarding individual users or adding service accounts one at a time, non-authoritative member grants preserve existing role assignments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iam.WorkforcePoolIamMember("member", {
    location: example.location,
    workforcePoolId: example.workforcePoolId,
    role: "roles/iam.workforcePoolAdmin",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iam.WorkforcePoolIamMember("member",
    location=example["location"],
    workforce_pool_id=example["workforcePoolId"],
    role="roles/iam.workforcePoolAdmin",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkforcePoolIamMember(ctx, "member", &iam.WorkforcePoolIamMemberArgs{
			Location:        pulumi.Any(example.Location),
			WorkforcePoolId: pulumi.Any(example.WorkforcePoolId),
			Role:            pulumi.String("roles/iam.workforcePoolAdmin"),
			Member:          pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iam.WorkforcePoolIamMember("member", new()
    {
        Location = example.Location,
        WorkforcePoolId = example.WorkforcePoolId,
        Role = "roles/iam.workforcePoolAdmin",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkforcePoolIamMember;
import com.pulumi.gcp.iam.WorkforcePoolIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WorkforcePoolIamMember("member", WorkforcePoolIamMemberArgs.builder()
            .location(example.location())
            .workforcePoolId(example.workforcePoolId())
            .role("roles/iam.workforcePoolAdmin")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iam:WorkforcePoolIamMember
    properties:
      location: ${example.location}
      workforcePoolId: ${example.workforcePoolId}
      role: roles/iam.workforcePoolAdmin
      member: user:jane@example.com

The WorkforcePoolIamMember resource adds a single member to a role without affecting other members already granted that role. This non-authoritative approach lets you manage individual grants independently. Use member (singular) instead of members (array) to specify one identity at a time.

Beyond these examples

These snippets focus on specific workforce pool IAM features: role binding for multiple members and incremental member grants. They’re intentionally minimal rather than full identity federation configurations.

The examples reference pre-existing infrastructure such as workforce pools. They focus on configuring IAM bindings rather than provisioning the pools themselves.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Policy-level management (WorkforcePoolIamPolicy)
Custom role formatting

These omissions are intentional: the goal is to illustrate how each IAM binding approach is wired, not provide drop-in identity modules. See the WorkforcePoolIamBinding resource reference for all available configuration options.

Let's configure GCP Workforce Pool IAM Bindings

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Conflicts & Compatibility

Can I use WorkforcePoolIamPolicy with WorkforcePoolIamBinding or WorkforcePoolIamMember?

No, gcp.iam.WorkforcePoolIamPolicy cannot be used with gcp.iam.WorkforcePoolIamBinding or gcp.iam.WorkforcePoolIamMember because they will conflict over the policy configuration.

Can I use WorkforcePoolIamBinding and WorkforcePoolIamMember together?

Yes, but only if they grant different roles. Using both resources for the same role will cause conflicts.

Resource Selection & Use Cases

What's the difference between WorkforcePoolIamPolicy, WorkforcePoolIamBinding, and WorkforcePoolIamMember?

gcp.iam.WorkforcePoolIamPolicy is authoritative and replaces the entire policy. gcp.iam.WorkforcePoolIamBinding is authoritative for a specific role, preserving other roles. gcp.iam.WorkforcePoolIamMember is non-authoritative and adds a single member to a role without affecting other members.

Role Configuration

Can I create multiple WorkforcePoolIamBinding resources for the same role?

No, only one gcp.iam.WorkforcePoolIamBinding can be used per role.

How do I specify custom roles?

Custom roles must use the full format: [projects/my-project|organizations/my-org]/roles/my-custom-role.

What properties are immutable after creation?

The role, location, workforcePoolId, and condition properties cannot be changed after creation.

Member Identity Configuration

What member identity formats are supported?

Supported formats include:

allUsers and allAuthenticatedUsers for public access
user:{email}, serviceAccount:{email}, group:{email} for specific identities
domain:{domain} for G Suite domains
projectOwner:, projectEditor:, projectViewer: with project ID
Federated identities using principal:// URIs

How do I grant access to a workforce pool?

Create a gcp.iam.WorkforcePoolIamBinding with role, members array, location, and workforcePoolId properties.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides