Manage GCP Cloud Workstations IAM Access

The gcp:workstations/workstationConfigIamMember:WorkstationConfigIamMember resource, part of the Pulumi GCP provider, manages IAM permissions for Cloud Workstations workstation configs by adding individual members to roles. This guide focuses on three approaches: adding single members to roles, binding roles to multiple members, and replacing entire IAM policies.

Cloud Workstations provides three IAM resource types that differ in how they modify policies. WorkstationConfigIamMember adds members non-authoritatively (preserving other members), WorkstationConfigIamBinding manages all members for a role authoritatively, and WorkstationConfigIamPolicy replaces the entire policy. The examples are intentionally small. Combine them with your own workstation configs and identity management.

Grant a single user access to a workstation config

When you need to give individual developers or service accounts access to specific workstation configurations, you can add them one at a time without affecting existing permissions.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.workstations.WorkstationConfigIamMember("member", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.workstations.WorkstationConfigIamMember("member",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := workstations.NewWorkstationConfigIamMember(ctx, "member", &workstations.WorkstationConfigIamMemberArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			Role:                 pulumi.String("roles/viewer"),
			Member:               pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Workstations.WorkstationConfigIamMember("member", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.workstations.WorkstationConfigIamMember;
import com.pulumi.gcp.workstations.WorkstationConfigIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WorkstationConfigIamMember("member", WorkstationConfigIamMemberArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:workstations:WorkstationConfigIamMember
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies the identity to grant access, using formats like “user:jane@example.com” for Google accounts or “serviceAccount:…” for service accounts. The role property defines what permissions they receive. This resource is non-authoritative: it adds the member without removing others who already have the same role.

Grant a role to multiple members at once

When onboarding a team or granting access to a group, you can bind a role to multiple members in a single resource.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.workstations.WorkstationConfigIamBinding("binding", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.workstations.WorkstationConfigIamBinding("binding",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := workstations.NewWorkstationConfigIamBinding(ctx, "binding", &workstations.WorkstationConfigIamBindingArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			Role:                 pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Workstations.WorkstationConfigIamBinding("binding", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.workstations.WorkstationConfigIamBinding;
import com.pulumi.gcp.workstations.WorkstationConfigIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WorkstationConfigIamBinding("binding", WorkstationConfigIamBindingArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:workstations:WorkstationConfigIamBinding
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      role: roles/viewer
      members:
        - user:jane@example.com

WorkstationConfigIamBinding uses the members property (plural) to list all identities that should have the role. Unlike WorkstationConfigIamMember, this resource is authoritative for the specified role: it replaces the member list for that role while preserving other roles in the policy. You can use WorkstationConfigIamBinding and WorkstationConfigIamMember together as long as they don’t manage the same role.

Replace the entire IAM policy with a data source

Organizations with centralized IAM policies can define the complete policy structure using a data source and apply it authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.workstations.WorkstationConfigIamPolicy("policy", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.workstations.WorkstationConfigIamPolicy("policy",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = workstations.NewWorkstationConfigIamPolicy(ctx, "policy", &workstations.WorkstationConfigIamPolicyArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			PolicyData:           pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Workstations.WorkstationConfigIamPolicy("policy", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.workstations.WorkstationConfigIamPolicy;
import com.pulumi.gcp.workstations.WorkstationConfigIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new WorkstationConfigIamPolicy("policy", WorkstationConfigIamPolicyArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:workstations:WorkstationConfigIamPolicy
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

WorkstationConfigIamPolicy sets the complete IAM policy from the policyData returned by getIAMPolicy. The bindings array in the data source defines all roles and their members. This resource replaces the entire policy, removing any permissions not explicitly listed. You cannot use WorkstationConfigIamPolicy alongside WorkstationConfigIamBinding or WorkstationConfigIamMember; they will conflict over policy ownership.

Beyond these examples

These snippets focus on specific IAM management features: incremental member grants, role-level binding management, and authoritative policy replacement. They’re intentionally minimal rather than complete access control systems.

The examples reference pre-existing infrastructure such as workstation configs and clusters, and a GCP project with appropriate location. They focus on IAM configuration rather than provisioning the workstation infrastructure itself.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Policy conflict resolution between resource types
Federated identity configuration

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the WorkstationConfigIamMember resource reference for all available configuration options.

Let's manage GCP Cloud Workstations IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Why am I getting IAM policy conflicts between my resources?

WorkstationConfigIamPolicy can’t be used with WorkstationConfigIamBinding or WorkstationConfigIamMember because they’ll conflict over policy management. Additionally, WorkstationConfigIamBinding and WorkstationConfigIamMember can only be used together if they manage different roles.

What's the difference between the three IAM resources?

Each serves a different use case:

WorkstationConfigIamPolicy: Authoritative, replaces the entire IAM policy
WorkstationConfigIamBinding: Authoritative for a specific role, manages all members for that role
WorkstationConfigIamMember: Non-authoritative, adds individual members without affecting others

Configuration & Identity Formats

What member identity formats are supported?

You can use:

Special identifiers: allUsers, allAuthenticatedUsers
Email-based: user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}
Project roles: projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}
Federated identities: principal://iam.googleapis.com/... (see Principal identifiers documentation)

How do I specify custom roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}. For example, projects/my-project/roles/my-custom-role or organizations/my-org/roles/my-custom-role.

Resource Behavior & Limitations

Can I modify the role or member after creation?

No, all properties (location, member, project, role, workstationClusterId, workstationConfigId, and condition) are immutable and require resource replacement if changed.

How do I import an existing IAM member?

Use space-delimited identifiers: resource path, role, and member identity. For example:

pulumi import gcp:workstations/workstationConfigIamMember:WorkstationConfigIamMember editor "projects/{{project}}/locations/{{location}}/workstationClusters/{{workstation_cluster_id}}/workstationConfigs/{{workstation_config_id}} roles/viewer user:jane@example.com"

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides