pulumi-gcp-kotlin/com.pulumi.gcp.serviceAccount.kotlin/IAMBindingArgs

IAMBindingArgs

data class IAMBindingArgs(val condition: Output<IAMBindingConditionArgs>? = null, val members: Output<List<String>>? = null, val role: Output<String>? = null, val serviceAccountId: Output<String>? = null) : ConvertibleToJava<IAMBindingArgs>

When managing IAM roles, you can treat a service account either as a resource or as an identity. This resource is to add iam policy bindings to a service account resource, such as allowing the members to run operations as or modify the service account. To configure permissions for a service account on other GCP resources, use the google_project_iam set of resources. Three different resources help you manage your IAM policy for a service account. Each of these resources serves a different use case:

  • gcp.serviceAccount.IAMPolicy: Authoritative. Sets the IAM policy for the service account and replaces any existing policy already attached.

  • gcp.serviceAccount.IAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the service account are preserved.

  • gcp.serviceAccount.IAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the service account are preserved.

Note: gcp.serviceAccount.IAMPolicy cannot be used in conjunction with gcp.serviceAccount.IAMBinding and gcp.serviceAccount.IAMMember or they will fight over what your policy should be. Note: gcp.serviceAccount.IAMBinding resources can be used in conjunction with gcp.serviceAccount.IAMMember resources only if they do not grant privilege to the same role.

Example Usage

Service Account IAM Policy

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.serviceAccount.Account;
import com.pulumi.gcp.serviceAccount.AccountArgs;
import com.pulumi.gcp.serviceAccount.IAMPolicy;
import com.pulumi.gcp.serviceAccount.IAMPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/iam.serviceAccountUser")
                .members("user:jane@example.com")
                .build())
            .build());
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that only Jane can interact with")
            .build());
        var admin_account_iam = new IAMPolicy("admin-account-iam", IAMPolicyArgs.builder()
            .serviceAccountId(sa.name())
            .policyData(admin.applyValue(getIAMPolicyResult -> getIAMPolicyResult.policyData()))
            .build());
    }
}
Content copied to clipboard

Service Account IAM Binding

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceAccount.Account;
import com.pulumi.gcp.serviceAccount.AccountArgs;
import com.pulumi.gcp.serviceAccount.IAMBinding;
import com.pulumi.gcp.serviceAccount.IAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that only Jane can use")
            .build());
        var admin_account_iam = new IAMBinding("admin-account-iam", IAMBindingArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .members("user:jane@example.com")
            .build());
    }
}
Content copied to clipboard

Service Account IAM Binding With IAM Conditions:

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceAccount.Account;
import com.pulumi.gcp.serviceAccount.AccountArgs;
import com.pulumi.gcp.serviceAccount.IAMBinding;
import com.pulumi.gcp.serviceAccount.IAMBindingArgs;
import com.pulumi.gcp.serviceAccount.inputs.IAMBindingConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that only Jane can use")
            .build());
        var admin_account_iam = new IAMBinding("admin-account-iam", IAMBindingArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .members("user:jane@example.com")
            .condition(IAMBindingConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());
    }
}
Content copied to clipboard

Service Account IAM Member

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.ComputeFunctions;
import com.pulumi.gcp.compute.inputs.GetDefaultServiceAccountArgs;
import com.pulumi.gcp.serviceAccount.Account;
import com.pulumi.gcp.serviceAccount.AccountArgs;
import com.pulumi.gcp.serviceAccount.IAMMember;
import com.pulumi.gcp.serviceAccount.IAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        final var default = ComputeFunctions.getDefaultServiceAccount();
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that Jane can use")
            .build());
        var admin_account_iam = new IAMMember("admin-account-iam", IAMMemberArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .member("user:jane@example.com")
            .build());
        var gce_default_account_iam = new IAMMember("gce-default-account-iam", IAMMemberArgs.builder()
            .serviceAccountId(default_.name())
            .role("roles/iam.serviceAccountUser")
            .member(sa.email().applyValue(email -> String.format("serviceAccount:%s", email)))
            .build());
    }
}
Content copied to clipboard

Service Account IAM Member With IAM Conditions:

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.serviceAccount.Account;
import com.pulumi.gcp.serviceAccount.AccountArgs;
import com.pulumi.gcp.serviceAccount.IAMMember;
import com.pulumi.gcp.serviceAccount.IAMMemberArgs;
import com.pulumi.gcp.serviceAccount.inputs.IAMMemberConditionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var sa = new Account("sa", AccountArgs.builder()
            .accountId("my-service-account")
            .displayName("A service account that Jane can use")
            .build());
        var admin_account_iam = new IAMMember("admin-account-iam", IAMMemberArgs.builder()
            .serviceAccountId(sa.name())
            .role("roles/iam.serviceAccountUser")
            .member("user:jane@example.com")
            .condition(IAMMemberConditionArgs.builder()
                .title("expires_after_2019_12_31")
                .description("Expiring at midnight of 2019-12-31")
                .expression("request.time < timestamp(\"2020-01-01T00:00:00Z\")")
                .build())
            .build());
    }
}
Content copied to clipboard

Import

Service account IAM resources can be imported using the project, service account email, role, member identity, and condition (beta).

$ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam projects/{your-project-id}/serviceAccounts/{your-service-account-email}
Content copied to clipboard
$ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser"
Content copied to clipboard
$ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/editor user:foo@example.com"
Content copied to clipboard

->Custom RolesIf you're importing a IAM resource with a custom role, make sure to use the full name of the custom role, e.g. [projects/my-project|organizations/my-org]/roles/my-custom-role. With conditions

$ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser expires_after_2019_12_31"
Content copied to clipboard
$ pulumi import gcp:serviceAccount/iAMBinding:IAMBinding admin-account-iam "projects/{your-project-id}/serviceAccounts/{your-service-account-email} roles/iam.serviceAccountUser user:foo@example.com expires_after_2019_12_31"
Content copied to clipboard

Constructors

Link copied to clipboard
constructor(condition: Output<IAMBindingConditionArgs>? = null, members: Output<List<String>>? = null, role: Output<String>? = null, serviceAccountId: Output<String>? = null)

Properties

Link copied to clipboard
val condition: Output<IAMBindingConditionArgs>? = null

An IAM Condition for a given binding. Structure is documented below.

Link copied to clipboard
val members: Output<List<String>>? = null
Link copied to clipboard
val role: Output<String>? = null

The role that should be applied. Only one gcp.serviceAccount.IAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

Link copied to clipboard
val serviceAccountId: Output<String>? = null

The fully-qualified name of the service account to apply policy to.

Functions

Link copied to clipboard
open override fun toJava(): IAMBindingArgs