pulumi-gcp-kotlin/com.pulumi.gcp.spanner.kotlin/InstanceIAMBinding

InstanceIAMBinding

class InstanceIAMBinding : KotlinCustomResource

Three different resources help you manage your IAM policy for a Spanner instance. Each of these resources serves a different use case:

gcp.spanner.InstanceIAMPolicy: Authoritative. Sets the IAM policy for the instance and replaces any existing policy already attached.

Warning: It's entirely possibly to lock yourself out of your instance using gcp.spanner.InstanceIAMPolicy. Any permissions granted by default will be removed unless you include them in your config.

gcp.spanner.InstanceIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the instance are preserved.
gcp.spanner.InstanceIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the instance are preserved.

Note: gcp.spanner.InstanceIAMPolicy cannot be used in conjunction with gcp.spanner.InstanceIAMBinding and gcp.spanner.InstanceIAMMember or they will fight over what your policy should be. Note: gcp.spanner.InstanceIAMBinding resources can be used in conjunction with gcp.spanner.InstanceIAMMember resources only if they do not grant privilege to the same role.

google\_spanner\_instance\_iam\_policy

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:jane@example&#46;com"],
    }],
});
const instance = new gcp.spanner.InstanceIAMPolicy("instance", {
    instance: "your-instance-name",
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp
admin = gcp.organizations.get_iam_policy(bindings=[gcp.organizations.GetIAMPolicyBindingArgs(
    role="roles/editor",
    members=["user:jane@example&#46;com"],
)])
instance = gcp.spanner.InstanceIAMPolicy("instance",
    instance="your-instance-name",
    policy_data=admin.policy_data)

using System.Collections.Generic;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:jane@example.com",
                },
            },
        },
    });
    var instance = new Gcp.Spanner.InstanceIAMPolicy("instance", new()
    {
        Instance = "your-instance-name",
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });
});

package main
import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:jane@example.com",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = spanner.NewInstanceIAMPolicy(ctx, "instance", &spanner.InstanceIAMPolicyArgs{
			Instance:   pulumi.String("your-instance-name"),
			PolicyData: *pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.spanner.InstanceIAMPolicy;
import com.pulumi.gcp.spanner.InstanceIAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:jane@example.com")
                .build())
            .build());
        var instance = new InstanceIAMPolicy("instance", InstanceIAMPolicyArgs.builder()
            .instance("your-instance-name")
            .policyData(admin.applyValue(getIAMPolicyResult -> getIAMPolicyResult.policyData()))
            .build());
    }
}

resources:
  instance:
    type: gcp:spanner:InstanceIAMPolicy
    properties:
      instance: your-instance-name
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      Function: gcp:organizations:getIAMPolicy
      Arguments:
        bindings:
          - role: roles/editor
            members:
              - user:jane@example.com

google\_spanner\_instance\_iam\_binding

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const instance = new gcp.spanner.InstanceIAMBinding("instance", {
    instance: "your-instance-name",
    members: ["user:jane@example&#46;com"],
    role: "roles/spanner.databaseAdmin",
});

import pulumi
import pulumi_gcp as gcp
instance = gcp.spanner.InstanceIAMBinding("instance",
    instance="your-instance-name",
    members=["user:jane@example&#46;com"],
    role="roles/spanner.databaseAdmin")

using System.Collections.Generic;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
    var instance = new Gcp.Spanner.InstanceIAMBinding("instance", new()
    {
        Instance = "your-instance-name",
        Members = new[]
        {
            "user:jane@example.com",
        },
        Role = "roles/spanner.databaseAdmin",
    });
});

package main
import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewInstanceIAMBinding(ctx, "instance", &spanner.InstanceIAMBindingArgs{
			Instance: pulumi.String("your-instance-name"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
			Role: pulumi.String("roles/spanner.databaseAdmin"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.InstanceIAMBinding;
import com.pulumi.gcp.spanner.InstanceIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var instance = new InstanceIAMBinding("instance", InstanceIAMBindingArgs.builder()
            .instance("your-instance-name")
            .members("user:jane@example.com")
            .role("roles/spanner.databaseAdmin")
            .build());
    }
}

resources:
  instance:
    type: gcp:spanner:InstanceIAMBinding
    properties:
      instance: your-instance-name
      members:
        - user:jane@example.com
      role: roles/spanner.databaseAdmin

google\_spanner\_instance\_iam\_member

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const instance = new gcp.spanner.InstanceIAMMember("instance", {
    instance: "your-instance-name",
    member: "user:jane@example.com",
    role: "roles/spanner.databaseAdmin",
});

import pulumi
import pulumi_gcp as gcp
instance = gcp.spanner.InstanceIAMMember("instance",
    instance="your-instance-name",
    member="user:jane@example.com",
    role="roles/spanner.databaseAdmin")

using System.Collections.Generic;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
    var instance = new Gcp.Spanner.InstanceIAMMember("instance", new()
    {
        Instance = "your-instance-name",
        Member = "user:jane@example.com",
        Role = "roles/spanner.databaseAdmin",
    });
});

package main
import (
	"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewInstanceIAMMember(ctx, "instance", &spanner.InstanceIAMMemberArgs{
			Instance: pulumi.String("your-instance-name"),
			Member:   pulumi.String("user:jane@example.com"),
			Role:     pulumi.String("roles/spanner.databaseAdmin"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.InstanceIAMMember;
import com.pulumi.gcp.spanner.InstanceIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var instance = new InstanceIAMMember("instance", InstanceIAMMemberArgs.builder()
            .instance("your-instance-name")
            .member("user:jane@example.com")
            .role("roles/spanner.databaseAdmin")
            .build());
    }
}

resources:
  instance:
    type: gcp:spanner:InstanceIAMMember
    properties:
      instance: your-instance-name
      member: user:jane@example.com
      role: roles/spanner.databaseAdmin

Import

For all import syntaxes, the "resource in question" can take any of the following forms* {{project}}/{{name}} * {{name}} (project is taken from provider project) IAM member imports use space-delimited identifiers; the resource in question, the role, and the account, e.g.

$ pulumi import gcp:spanner/instanceIAMBinding:InstanceIAMBinding instance "project-name/instance-name roles/viewer user:foo@example.com"

IAM binding imports use space-delimited identifiers; the resource in question and the role, e.g.

$ pulumi import gcp:spanner/instanceIAMBinding:InstanceIAMBinding instance "project-name/instance-name roles/viewer"

IAM policy imports use the identifier of the resource in question, e.g.

$ pulumi import gcp:spanner/instanceIAMBinding:InstanceIAMBinding instance project-name/instance-name

->Custom RolesIf you're importing a IAM resource with a custom role, make sure to use the full name of the custom role, e.g. [projects/my-project|organizations/my-org]/roles/my-custom-role.

Properties

condition

val condition: Output<InstanceIAMBindingCondition>?

etag

val etag: Output<String>

(Computed) The etag of the instance's IAM policy.

val id: Output<String>

instance

val instance: Output<String>

The name of the instance.

members

val members: Output<List<String>>

project

val project: Output<String>

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

role

val role: Output<String>

The role that should be applied. Only one gcp.spanner.InstanceIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

urn

val urn: Output<String>