Manage GCP Cloud Workstations IAM Policies

The gcp:workstations/workstationConfigIamPolicy:WorkstationConfigIamPolicy resource, part of the Pulumi GCP provider, controls IAM access to Cloud Workstations workstation configurations. Three related resources serve different use cases: WorkstationConfigIamPolicy for authoritative policy replacement, WorkstationConfigIamBinding for role-level member management, and WorkstationConfigIamMember for incremental member additions. This guide focuses on all three approaches.

These resources reference existing workstation configs and clusters. They manage access control, not the workstation infrastructure itself. The examples are intentionally small. Combine them with your own workstation config and cluster resources.

Replace the entire IAM policy with a new definition

When you need complete control over who can access a workstation configuration, WorkstationConfigIamPolicy replaces the entire IAM policy.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/viewer",
        members: ["user:jane@example.com"],
    }],
});
const policy = new gcp.workstations.WorkstationConfigIamPolicy("policy", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/viewer",
    "members": ["user:jane@example.com"],
}])
policy = gcp.workstations.WorkstationConfigIamPolicy("policy",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    policy_data=admin.policy_data)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/viewer",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = workstations.NewWorkstationConfigIamPolicy(ctx, "policy", &workstations.WorkstationConfigIamPolicyArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			PolicyData:           pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/viewer",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });

    var policy = new Gcp.Workstations.WorkstationConfigIamPolicy("policy", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.workstations.WorkstationConfigIamPolicy;
import com.pulumi.gcp.workstations.WorkstationConfigIamPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/viewer")
                .members("user:jane@example.com")
                .build())
            .build());

        var policy = new WorkstationConfigIamPolicy("policy", WorkstationConfigIamPolicyArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  policy:
    type: gcp:workstations:WorkstationConfigIamPolicy
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/viewer
            members:
              - user:jane@example.com

The policyData property accepts output from the getIAMPolicy data source, which defines bindings between roles and members. This resource is authoritative: it removes any existing bindings not included in your policy definition. WorkstationConfigIamPolicy cannot be used alongside WorkstationConfigIamBinding or WorkstationConfigIamMember, as they would conflict over the policy state.

Grant a role to multiple members at once

When multiple users or service accounts need the same access level, WorkstationConfigIamBinding manages all members for a single role together.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const binding = new gcp.workstations.WorkstationConfigIamBinding("binding", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    role: "roles/viewer",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

binding = gcp.workstations.WorkstationConfigIamBinding("binding",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    role="roles/viewer",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := workstations.NewWorkstationConfigIamBinding(ctx, "binding", &workstations.WorkstationConfigIamBindingArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			Role:                 pulumi.String("roles/viewer"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var binding = new Gcp.Workstations.WorkstationConfigIamBinding("binding", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        Role = "roles/viewer",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.workstations.WorkstationConfigIamBinding;
import com.pulumi.gcp.workstations.WorkstationConfigIamBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var binding = new WorkstationConfigIamBinding("binding", WorkstationConfigIamBindingArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .role("roles/viewer")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  binding:
    type: gcp:workstations:WorkstationConfigIamBinding
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      role: roles/viewer
      members:
        - user:jane@example.com

The role property specifies which role to grant, and members lists all identities that should receive it. This resource is authoritative for the specified role but preserves other roles in the policy. You can use multiple WorkstationConfigIamBinding resources for different roles, or combine them with WorkstationConfigIamMember resources as long as they don’t target the same role.

Add a single member to a role incrementally

When you need to grant access to one user without affecting other members, WorkstationConfigIamMember adds individual members non-authoritatively.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const member = new gcp.workstations.WorkstationConfigIamMember("member", {
    project: _default.project,
    location: _default.location,
    workstationClusterId: _default.workstationClusterId,
    workstationConfigId: _default.workstationConfigId,
    role: "roles/viewer",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

member = gcp.workstations.WorkstationConfigIamMember("member",
    project=default["project"],
    location=default["location"],
    workstation_cluster_id=default["workstationClusterId"],
    workstation_config_id=default["workstationConfigId"],
    role="roles/viewer",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/workstations"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := workstations.NewWorkstationConfigIamMember(ctx, "member", &workstations.WorkstationConfigIamMemberArgs{
			Project:              pulumi.Any(_default.Project),
			Location:             pulumi.Any(_default.Location),
			WorkstationClusterId: pulumi.Any(_default.WorkstationClusterId),
			WorkstationConfigId:  pulumi.Any(_default.WorkstationConfigId),
			Role:                 pulumi.String("roles/viewer"),
			Member:               pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var member = new Gcp.Workstations.WorkstationConfigIamMember("member", new()
    {
        Project = @default.Project,
        Location = @default.Location,
        WorkstationClusterId = @default.WorkstationClusterId,
        WorkstationConfigId = @default.WorkstationConfigId,
        Role = "roles/viewer",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.workstations.WorkstationConfigIamMember;
import com.pulumi.gcp.workstations.WorkstationConfigIamMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var member = new WorkstationConfigIamMember("member", WorkstationConfigIamMemberArgs.builder()
            .project(default_.project())
            .location(default_.location())
            .workstationClusterId(default_.workstationClusterId())
            .workstationConfigId(default_.workstationConfigId())
            .role("roles/viewer")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  member:
    type: gcp:workstations:WorkstationConfigIamMember
    properties:
      project: ${default.project}
      location: ${default.location}
      workstationClusterId: ${default.workstationClusterId}
      workstationConfigId: ${default.workstationConfigId}
      role: roles/viewer
      member: user:jane@example.com

The member property specifies a single identity to grant the role. This resource is non-authoritative: it adds the member without removing others who already have the role. Multiple WorkstationConfigIamMember resources can target the same role, making this approach useful for incremental access grants managed by different teams or modules.

Beyond these examples

These snippets focus on specific IAM management approaches: authoritative policy replacement, role-level member management, and incremental member additions. They’re intentionally minimal rather than full access control solutions.

The examples reference pre-existing infrastructure such as Cloud Workstations workstation configs and clusters, and a GCP project with location configured. They focus on configuring IAM access rather than provisioning the workstation infrastructure.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition blocks)
Custom role definitions
Service account creation and management
Workstation config and cluster provisioning

These omissions are intentional: the goal is to illustrate how each IAM resource type is wired, not provide drop-in access control modules. See the WorkstationConfigIamPolicy resource reference for all available configuration options.

Let's manage GCP Cloud Workstations IAM Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

What's the difference between WorkstationConfigIamPolicy, WorkstationConfigIamBinding, and WorkstationConfigIamMember?

WorkstationConfigIamPolicy is authoritative and replaces the entire IAM policy. WorkstationConfigIamBinding is authoritative for a specific role, preserving other roles. WorkstationConfigIamMember is non-authoritative, adding a single member while preserving other members for that role.

Can I use WorkstationConfigIamPolicy with WorkstationConfigIamBinding or WorkstationConfigIamMember?

No, WorkstationConfigIamPolicy cannot be used with WorkstationConfigIamBinding or WorkstationConfigIamMember as they will conflict over policy management. Choose one approach for your workstation config.

Can I use WorkstationConfigIamBinding and WorkstationConfigIamMember together?

Yes, but only if they don’t grant privileges to the same role. Each role must be managed by either Binding or Member, not both.

Configuration & Usage

Which properties can I change after creating an IAM policy resource?

Only policyData is mutable. The location, project, workstationClusterId, and workstationConfigId properties are all immutable.

How do I grant a role to multiple users at once?

Use WorkstationConfigIamBinding with a members array containing all user identities (e.g., ["user:jane@example.com", "user:john@example.com"]).

Import & Management

How do I import IAM resources with custom roles?

Use the full name of the custom role in the format [projects/my-project|organizations/my-org]/roles/my-custom-role when importing.

Using a different cloud?

Explore security guides for other cloud providers:

AWS Guides Azure Guides