Manage GCP Workload Identity Pool IAM Members

The gcp:iam/workloadIdentityPoolIamMember:WorkloadIdentityPoolIamMember resource, part of the Pulumi GCP provider, grants IAM roles to members on workload identity pools, controlling who can view or manage federated identity configurations. This guide focuses on three capabilities: non-authoritative member grants, time-limited access with IAM Conditions, and role-level and policy-level authoritative management.

Workload identity pools must exist before you can grant IAM permissions on them. The three IAM resource types (Member, Binding, Policy) cannot be mixed without conflicts: Policy replaces the entire IAM policy, Binding controls all members for one role, and Member adds individual members non-authoritatively. The examples are intentionally small. Choose the resource type that matches your management model.

Grant a single member access to a pool

Most IAM configurations add individual users or service accounts to roles without affecting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iam.WorkloadIdentityPoolIamMember("member", {
    project: example.project,
    workloadIdentityPoolId: example.workloadIdentityPoolId,
    role: "roles/iam.workloadIdentityPoolViewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iam.WorkloadIdentityPoolIamMember("member",
    project=example["project"],
    workload_identity_pool_id=example["workloadIdentityPoolId"],
    role="roles/iam.workloadIdentityPoolViewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkloadIdentityPoolIamMember(ctx, "member", &iam.WorkloadIdentityPoolIamMemberArgs{
			Project:                pulumi.Any(example.Project),
			WorkloadIdentityPoolId: pulumi.Any(example.WorkloadIdentityPoolId),
			Role:                   pulumi.String("roles/iam.workloadIdentityPoolViewer"),
			Member:                 pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iam.WorkloadIdentityPoolIamMember("member", new()
    {
        Project = example.Project,
        WorkloadIdentityPoolId = example.WorkloadIdentityPoolId,
        Role = "roles/iam.workloadIdentityPoolViewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamMember;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WorkloadIdentityPoolIamMember("member", WorkloadIdentityPoolIamMemberArgs.builder()
            .project(example.project())
            .workloadIdentityPoolId(example.workloadIdentityPoolId())
            .role("roles/iam.workloadIdentityPoolViewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:iam:WorkloadIdentityPoolIamMember
    properties:
      project: ${example.project}
      workloadIdentityPoolId: ${example.workloadIdentityPoolId}
      role: roles/iam.workloadIdentityPoolViewer
      member: user:jane@example.com

The member property specifies who receives access, using formats like “user:jane@example.com” or “serviceAccount:app@project.iam.gserviceaccount.com”. The role property defines what they can do. WorkloadIdentityPoolIamMember is non-authoritative: it adds this member without removing others who already have the role.

Add time-limited access with IAM Conditions

Teams often need temporary access that expires automatically, such as contractor access or time-boxed experiments.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.iam.WorkloadIdentityPoolIamMember("member", {
    project: example.project,
    workloadIdentityPoolId: example.workloadIdentityPoolId,
    role: "roles/iam.workloadIdentityPoolViewer",
    member: "user:jane@example.com",
    condition: {
        title: "expires_after_2019_12_31",
        description: "Expiring at midnight of 2019-12-31",
        expression: "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    },
});

import pulumi
import pulumi_gcp as gcp

member = gcp.iam.WorkloadIdentityPoolIamMember("member",
    project=example["project"],
    workload_identity_pool_id=example["workloadIdentityPoolId"],
    role="roles/iam.workloadIdentityPoolViewer",
    member="user:jane@example.com",
    condition={
        "title": "expires_after_2019_12_31",
        "description": "Expiring at midnight of 2019-12-31",
        "expression": "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkloadIdentityPoolIamMember(ctx, "member", &iam.WorkloadIdentityPoolIamMemberArgs{
			Project:                pulumi.Any(example.Project),
			WorkloadIdentityPoolId: pulumi.Any(example.WorkloadIdentityPoolId),
			Role:                   pulumi.String("roles/iam.workloadIdentityPoolViewer"),
			Member:                 pulumi.String("user:jane@example.com"),
			Condition: &iam.WorkloadIdentityPoolIamMemberConditionArgs{
				Title:       pulumi.String("expires_after_2019_12_31"),
				Description: pulumi.String("Expiring at midnight of 2019-12-31"),
				Expression:  pulumi.String("request.time < timestamp(\"2020-01-01T00:00:00Z\")"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Iam.WorkloadIdentityPoolIamMember("member", new()
    {
        Project = example.Project,
        WorkloadIdentityPoolId = example.WorkloadIdentityPoolId,
        Role = "roles/iam.workloadIdentityPoolViewer",
        Member = "user:jane@example.com",
        Condition = new Gcp.Iam.Inputs.WorkloadIdentityPoolIamMemberConditionArgs
        {
            Title = "expires_after_2019_12_31",
            Description = "Expiring at midnight of 2019-12-31",
            Expression = "request.time < timestamp(\"2020-01-01T00:00:00Z\")",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamMember;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamMemberArgs;
import com.pulumi.gcp.iam.inputs.WorkloadIdentityPoolIamMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WorkloadIdentityPoolIamMember("member", WorkloadIdentityPoolIamMemberArgs.builder()
            .project(example.project())
            .workloadIdentityPoolId(example.workloadIdentityPoolId())
            .role("roles/iam.workloadIdentityPoolViewer")
            .member("user:jane@example.com")
            .condition(WorkloadIdentityPoolIamMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());

    }
}

resources:
  member:
    type: gcp:iam:WorkloadIdentityPoolIamMember
    properties:
      project: ${example.project}
      workloadIdentityPoolId: ${example.workloadIdentityPoolId}
      role: roles/iam.workloadIdentityPoolViewer
      member: user:jane@example.com
      condition:
        title: expires_after_2019_12_31
        description: Expiring at midnight of 2019-12-31
        expression: request.time < timestamp("2020-01-01T00:00:00Z")

The condition block attaches expiration logic to the role grant. The expression property uses CEL (Common Expression Language) to compare request.time against a timestamp. When the condition evaluates to false, the member loses access automatically. The title and description properties document the condition’s purpose.

Manage all members for a role with Binding

When you need to control the complete member list for a role, WorkloadIdentityPoolIamBinding provides authoritative management for that role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.iam.WorkloadIdentityPoolIamBinding("binding", {
    project: example.project,
    workloadIdentityPoolId: example.workloadIdentityPoolId,
    role: "roles/iam.workloadIdentityPoolViewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.iam.WorkloadIdentityPoolIamBinding("binding",
    project=example["project"],
    workload_identity_pool_id=example["workloadIdentityPoolId"],
    role="roles/iam.workloadIdentityPoolViewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := iam.NewWorkloadIdentityPoolIamBinding(ctx, "binding", &iam.WorkloadIdentityPoolIamBindingArgs{
			Project:                pulumi.Any(example.Project),
			WorkloadIdentityPoolId: pulumi.Any(example.WorkloadIdentityPoolId),
			Role:                   pulumi.String("roles/iam.workloadIdentityPoolViewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Iam.WorkloadIdentityPoolIamBinding("binding", new()
    {
        Project = example.Project,
        WorkloadIdentityPoolId = example.WorkloadIdentityPoolId,
        Role = "roles/iam.workloadIdentityPoolViewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamBinding;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WorkloadIdentityPoolIamBinding("binding", WorkloadIdentityPoolIamBindingArgs.builder()
            .project(example.project())
            .workloadIdentityPoolId(example.workloadIdentityPoolId())
            .role("roles/iam.workloadIdentityPoolViewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:iam:WorkloadIdentityPoolIamBinding
    properties:
      project: ${example.project}
      workloadIdentityPoolId: ${example.workloadIdentityPoolId}
      role: roles/iam.workloadIdentityPoolViewer
      members:
        - user:jane@example.com

The members property lists all identities that should have this role. WorkloadIdentityPoolIamBinding replaces any existing members for this role while preserving other roles on the pool. If you remove a member from the list, they lose access on the next apply.

Replace the entire IAM policy with Policy

Some deployments require complete control over all IAM bindings on a pool.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/iam.workloadIdentityPoolViewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.iam.WorkloadIdentityPoolIamPolicy("policy", {
    project: example.project,
    workloadIdentityPoolId: example.workloadIdentityPoolId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/iam.workloadIdentityPoolViewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.iam.WorkloadIdentityPoolIamPolicy("policy",
    project=example["project"],
    workload_identity_pool_id=example["workloadIdentityPoolId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/iam"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/iam.workloadIdentityPoolViewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = iam.NewWorkloadIdentityPoolIamPolicy(ctx, "policy", &iam.WorkloadIdentityPoolIamPolicyArgs{
			Project:                pulumi.Any(example.Project),
			WorkloadIdentityPoolId: pulumi.Any(example.WorkloadIdentityPoolId),
			PolicyData:             pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/iam.workloadIdentityPoolViewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Iam.WorkloadIdentityPoolIamPolicy("policy", new()
    {
        Project = example.Project,
        WorkloadIdentityPoolId = example.WorkloadIdentityPoolId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamPolicy;
import com.pulumi.gcp.iam.WorkloadIdentityPoolIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/iam.workloadIdentityPoolViewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new WorkloadIdentityPoolIamPolicy("policy", WorkloadIdentityPoolIamPolicyArgs.builder()
            .project(example.project())
            .workloadIdentityPoolId(example.workloadIdentityPoolId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:iam:WorkloadIdentityPoolIamPolicy
    properties:
      project: ${example.project}
      workloadIdentityPoolId: ${example.workloadIdentityPoolId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/iam.workloadIdentityPoolViewer
            members:
              - user:jane@example.com

The policyData property accepts a complete IAM policy document from getIAMPolicy. WorkloadIdentityPoolIamPolicy replaces the entire policy, removing any bindings not included in the data source. This resource conflicts with WorkloadIdentityPoolIamBinding and WorkloadIdentityPoolIamMember; use only one approach per pool.

Beyond these examples

These snippets focus on specific IAM management features: non-authoritative member grants, role-level binding management, full policy replacement, and time-based IAM Conditions. They’re intentionally minimal rather than complete access control configurations.

The examples reference pre-existing infrastructure such as workload identity pools. They focus on granting IAM permissions rather than creating the pools themselves.

To keep things focused, common IAM patterns are omitted, including:

  • Custom role formatting (projects/organizations paths)
  • Federated identity principals and workforce pools
  • Multiple condition expressions (CEL syntax variations)
  • Policy conflict resolution between resource types

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the WorkloadIdentityPoolIamMember resource reference for all available configuration options.

Let's manage GCP Workload Identity Pool IAM Members

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts
What's the difference between WorkloadIdentityPoolIamPolicy, IamBinding, and IamMember?
WorkloadIdentityPoolIamPolicy is authoritative and replaces the entire IAM policy. WorkloadIdentityPoolIamBinding is authoritative for a specific role, managing all members for that role. WorkloadIdentityPoolIamMember is non-authoritative, adding a single member to a role without affecting other members.
Which IAM resources can I use together?
You cannot use WorkloadIdentityPoolIamPolicy with WorkloadIdentityPoolIamBinding or WorkloadIdentityPoolIamMember, as they will conflict. You can use WorkloadIdentityPoolIamBinding and WorkloadIdentityPoolIamMember together only if they manage different roles.
IAM Configuration
What formats can I use for the member identity?
You can use allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner/Editor/Viewer:{projectid}, or federated identities like principal://iam.googleapis.com/locations/global/workforcePools/example-contractors/subject/joe@example.com.
How do I specify a custom role?
Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.
How do I add time-based or conditional access restrictions?
Use the condition property with title, description, and expression fields. For example, set expression to request.time < timestamp("2020-01-01T00:00:00Z") to expire access at a specific time.
Can I change the member, role, or workloadIdentityPoolId after creation?
No, all of these properties are immutable. You must recreate the resource to change them.
Beta & Limitations
What provider do I need to use this resource?
This resource is in beta and requires the terraform-provider-google-beta provider.
Are there any limitations with IAM Conditions?
Yes, IAM Conditions have known limitations. If you experience issues with conditions, review the limitations documentation at cloud.google.com/iam/docs/conditions-overview#limitations.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides