Manage GCP Cloud Workstations IAM Access

The gcp:workstations/workstationConfigIamMember:WorkstationConfigIamMember resource, part of the Pulumi GCP provider, manages IAM permissions for Cloud Workstations workstation configs. This guide focuses on three approaches: authoritative policy replacement, role-level member management, and individual member grants.

IAM resources for workstation configs come in three variants (Policy, Binding, Member), each with different authoritativeness guarantees. Policy cannot be used with Binding or Member; Binding and Member can coexist if they manage different roles. The examples are intentionally small. Combine them with your own workstation config infrastructure and access requirements.

Replace the entire IAM policy with a new definition

When you need complete control over all IAM bindings, you can replace the entire policy in one operation.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.workstations.WorkstationConfigIamPolicy("policy", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.workstations.WorkstationConfigIamPolicy("policy",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = workstations.NewWorkstationConfigIamPolicy(ctx, "policy", &workstations.WorkstationConfigIamPolicyArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			PolicyData:           pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Workstations.WorkstationConfigIamPolicy("policy", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.workstations.WorkstationConfigIamPolicy;
import com.pulumi.gcp.workstations.WorkstationConfigIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new WorkstationConfigIamPolicy("policy", WorkstationConfigIamPolicyArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:workstations:WorkstationConfigIamPolicy
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The WorkstationConfigIamPolicy resource sets all IAM bindings authoritatively. The getIAMPolicy data source constructs the policy document with bindings that specify roles and members. The policyData property contains the complete policy; any existing bindings not in this policy are removed.

Grant a role to multiple members at once

Teams often need to grant the same role to several users or service accounts simultaneously.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.workstations.WorkstationConfigIamBinding("binding", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.workstations.WorkstationConfigIamBinding("binding",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := workstations.NewWorkstationConfigIamBinding(ctx, "binding", &workstations.WorkstationConfigIamBindingArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			Role:                 pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Workstations.WorkstationConfigIamBinding("binding", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.workstations.WorkstationConfigIamBinding;
import com.pulumi.gcp.workstations.WorkstationConfigIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WorkstationConfigIamBinding("binding", WorkstationConfigIamBindingArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:workstations:WorkstationConfigIamBinding
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      role: roles/viewer
      members:
        - user:jane@example.com

The WorkstationConfigIamBinding resource manages all members for a single role. The members property lists all identities that should have this role. This resource is authoritative for the specified role but preserves other roles in the policy.

Add a single member to a role incrementally

When you need to grant access to one user without affecting existing permissions, member resources add individual grants.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.workstations.WorkstationConfigIamMember("member", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.workstations.WorkstationConfigIamMember("member",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := workstations.NewWorkstationConfigIamMember(ctx, "member", &workstations.WorkstationConfigIamMemberArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			Role:                 pulumi.String("roles/viewer"),
			Member:               pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Workstations.WorkstationConfigIamMember("member", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.workstations.WorkstationConfigIamMember;
import com.pulumi.gcp.workstations.WorkstationConfigIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WorkstationConfigIamMember("member", WorkstationConfigIamMemberArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:workstations:WorkstationConfigIamMember
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      role: roles/viewer
      member: user:jane@example.com

The WorkstationConfigIamMember resource adds one member to one role non-authoritatively. The member property specifies a single identity. This resource preserves existing members for the same role, making it safe for environments where multiple teams manage IAM.

Beyond these examples

These snippets focus on specific IAM management features: authoritative vs non-authoritative management, and policy-level, role-level, and member-level grants. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as workstation configs (via project, location, workstationClusterId, workstationConfigId). They focus on IAM binding configuration rather than provisioning the workstation configs themselves.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Custom role definitions
Combining Policy with Binding/Member resources (causes conflicts)
IAM policy data source for read-only access

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the WorkstationConfigIamMember resource reference for all available configuration options.

Let's manage GCP Cloud Workstations IAM Access

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between WorkstationConfigIamPolicy, Binding, and Member?

WorkstationConfigIamPolicy is fully authoritative and replaces the entire IAM policy. WorkstationConfigIamBinding is authoritative for a specific role, replacing all members for that role while preserving other roles. WorkstationConfigIamMember is non-authoritative and adds a single member to a role without affecting other members.

Can I use these IAM resources together?

You cannot use WorkstationConfigIamPolicy with WorkstationConfigIamBinding or WorkstationConfigIamMember, as they will conflict. You can use WorkstationConfigIamBinding and WorkstationConfigIamMember together only if they grant different roles.

Configuration & Identity Formats

What member identity formats are supported?

Supported formats include allUsers, allAuthenticatedUsers, user:{email}, serviceAccount:{email}, group:{email}, domain:{domain}, projectOwner:{projectid}, projectEditor:{projectid}, projectViewer:{projectid}, and federated identities like principal://iam.googleapis.com/....

How do I specify custom IAM roles?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}, for example projects/my-project/roles/my-custom-role.

Beta Status & Limitations

Is this resource production-ready?

This resource is in beta and requires the terraform-provider-google-beta provider. Review the provider documentation for beta resource considerations.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides