SubscriptionIAMBinding class
Three different resources help you manage your IAM policy for pubsub subscription. Each of these resources serves a different use case:
gcp.pubsub.SubscriptionIAMPolicy: Authoritative. Sets the IAM policy for the subscription and replaces any existing policy already attached.gcp.pubsub.SubscriptionIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the subscription are preserved.gcp.pubsub.SubscriptionIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the subscription are preserved.
> Note: gcp.pubsub.SubscriptionIAMPolicy cannot be used in conjunction with gcp.pubsub.SubscriptionIAMBinding and gcp.pubsub.SubscriptionIAMMember or they will fight over what your policy should be.
> Note: gcp.pubsub.SubscriptionIAMBinding resources can be used in conjunction with gcp.pubsub.SubscriptionIAMMember resources only if they do not grant privilege to the same role.
gcp.pubsub.SubscriptionIAMPolicy
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const admin = gcp.organizations.getIAMPolicy({
bindings: [{
role: "roles/editor",
members: ["user:jane@example.com"],
}],
});
const editor = new gcp.pubsub.SubscriptionIAMPolicy("editor", {
subscription: "your-subscription-name",
policyData: admin.then(admin => admin.policyData),
});
import pulumi
import pulumi_gcp as gcp
admin = gcp.organizations.get_iam_policy(bindings=[{
"role": "roles/editor",
"members": ["user:jane@example.com"],
}])
editor = gcp.pubsub.SubscriptionIAMPolicy("editor",
subscription="your-subscription-name",
policy_data=admin.policy_data)
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
{
Bindings = new[]
{
new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
{
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
},
},
});
var editor = new Gcp.PubSub.SubscriptionIAMPolicy("editor", new()
{
Subscription = "your-subscription-name",
PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
Bindings: []organizations.GetIAMPolicyBinding{
{
Role: "roles/editor",
Members: []string{
"user:jane@example.com",
},
},
},
}, nil)
if err != nil {
return err
}
_, err = pubsub.NewSubscriptionIAMPolicy(ctx, "editor", &pubsub.SubscriptionIAMPolicyArgs{
Subscription: pulumi.String("your-subscription-name"),
PolicyData: pulumi.String(admin.PolicyData),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
data "gcp_organizations_getiampolicy" "admin" {
bindings {
role = "roles/editor"
members = ["user:jane@example.com"]
}
}
resource "gcp_pubsub_subscriptioniampolicy" "editor" {
subscription = "your-subscription-name"
policy_data = data.gcp_organizations_getiampolicy.admin.policy_data
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingArgs;
import com.pulumi.gcp.pubsub.SubscriptionIAMPolicy;
import com.pulumi.gcp.pubsub.SubscriptionIAMPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
.bindings(GetIAMPolicyBindingArgs.builder()
.role("roles/editor")
.members("user:jane@example.com")
.build())
.build());
var editor = new SubscriptionIAMPolicy("editor", SubscriptionIAMPolicyArgs.builder()
.subscription("your-subscription-name")
.policyData(admin.policyData())
.build());
}
}
resources:
editor:
type: gcp:pubsub:SubscriptionIAMPolicy
properties:
subscription: your-subscription-name
policyData: ${admin.policyData}
variables:
admin:
fn::invoke:
function: gcp:organizations:getIAMPolicy
arguments:
bindings:
- role: roles/editor
members:
- user:jane@example.com
gcp.pubsub.SubscriptionIAMBinding
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.pubsub.SubscriptionIAMBinding("editor", {
subscription: "your-subscription-name",
role: "roles/editor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.pubsub.SubscriptionIAMBinding("editor",
subscription="your-subscription-name",
role="roles/editor",
members=["user:jane@example.com"])
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.PubSub.SubscriptionIAMBinding("editor", new()
{
Subscription = "your-subscription-name",
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := pubsub.NewSubscriptionIAMBinding(ctx, "editor", &pubsub.SubscriptionIAMBindingArgs{
Subscription: pulumi.String("your-subscription-name"),
Role: pulumi.String("roles/editor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
resource "gcp_pubsub_subscriptioniambinding" "editor" {
subscription = "your-subscription-name"
role = "roles/editor"
members = ["user:jane@example.com"]
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.pubsub.SubscriptionIAMBinding;
import com.pulumi.gcp.pubsub.SubscriptionIAMBindingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new SubscriptionIAMBinding("editor", SubscriptionIAMBindingArgs.builder()
.subscription("your-subscription-name")
.role("roles/editor")
.members("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:pubsub:SubscriptionIAMBinding
properties:
subscription: your-subscription-name
role: roles/editor
members:
- user:jane@example.com
gcp.pubsub.SubscriptionIAMMember
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.pubsub.SubscriptionIAMMember("editor", {
subscription: "your-subscription-name",
role: "roles/editor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.pubsub.SubscriptionIAMMember("editor",
subscription="your-subscription-name",
role="roles/editor",
member="user:jane@example.com")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.PubSub.SubscriptionIAMMember("editor", new()
{
Subscription = "your-subscription-name",
Role = "roles/editor",
Member = "user:jane@example.com",
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := pubsub.NewSubscriptionIAMMember(ctx, "editor", &pubsub.SubscriptionIAMMemberArgs{
Subscription: pulumi.String("your-subscription-name"),
Role: pulumi.String("roles/editor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
resource "gcp_pubsub_subscriptioniammember" "editor" {
subscription = "your-subscription-name"
role = "roles/editor"
member = "user:jane@example.com"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.pubsub.SubscriptionIAMMember;
import com.pulumi.gcp.pubsub.SubscriptionIAMMemberArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new SubscriptionIAMMember("editor", SubscriptionIAMMemberArgs.builder()
.subscription("your-subscription-name")
.role("roles/editor")
.member("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:pubsub:SubscriptionIAMMember
properties:
subscription: your-subscription-name
role: roles/editor
member: user:jane@example.com
gcp.pubsub.SubscriptionIAMPolicy
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const admin = gcp.organizations.getIAMPolicy({
bindings: [{
role: "roles/editor",
members: ["user:jane@example.com"],
}],
});
const editor = new gcp.pubsub.SubscriptionIAMPolicy("editor", {
subscription: "your-subscription-name",
policyData: admin.then(admin => admin.policyData),
});
import pulumi
import pulumi_gcp as gcp
admin = gcp.organizations.get_iam_policy(bindings=[{
"role": "roles/editor",
"members": ["user:jane@example.com"],
}])
editor = gcp.pubsub.SubscriptionIAMPolicy("editor",
subscription="your-subscription-name",
policy_data=admin.policy_data)
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
{
Bindings = new[]
{
new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
{
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
},
},
});
var editor = new Gcp.PubSub.SubscriptionIAMPolicy("editor", new()
{
Subscription = "your-subscription-name",
PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
Bindings: []organizations.GetIAMPolicyBinding{
{
Role: "roles/editor",
Members: []string{
"user:jane@example.com",
},
},
},
}, nil)
if err != nil {
return err
}
_, err = pubsub.NewSubscriptionIAMPolicy(ctx, "editor", &pubsub.SubscriptionIAMPolicyArgs{
Subscription: pulumi.String("your-subscription-name"),
PolicyData: pulumi.String(admin.PolicyData),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
data "gcp_organizations_getiampolicy" "admin" {
bindings {
role = "roles/editor"
members = ["user:jane@example.com"]
}
}
resource "gcp_pubsub_subscriptioniampolicy" "editor" {
subscription = "your-subscription-name"
policy_data = data.gcp_organizations_getiampolicy.admin.policy_data
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingArgs;
import com.pulumi.gcp.pubsub.SubscriptionIAMPolicy;
import com.pulumi.gcp.pubsub.SubscriptionIAMPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
.bindings(GetIAMPolicyBindingArgs.builder()
.role("roles/editor")
.members("user:jane@example.com")
.build())
.build());
var editor = new SubscriptionIAMPolicy("editor", SubscriptionIAMPolicyArgs.builder()
.subscription("your-subscription-name")
.policyData(admin.policyData())
.build());
}
}
resources:
editor:
type: gcp:pubsub:SubscriptionIAMPolicy
properties:
subscription: your-subscription-name
policyData: ${admin.policyData}
variables:
admin:
fn::invoke:
function: gcp:organizations:getIAMPolicy
arguments:
bindings:
- role: roles/editor
members:
- user:jane@example.com
gcp.pubsub.SubscriptionIAMBinding
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.pubsub.SubscriptionIAMBinding("editor", {
subscription: "your-subscription-name",
role: "roles/editor",
members: ["user:jane@example.com"],
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.pubsub.SubscriptionIAMBinding("editor",
subscription="your-subscription-name",
role="roles/editor",
members=["user:jane@example.com"])
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.PubSub.SubscriptionIAMBinding("editor", new()
{
Subscription = "your-subscription-name",
Role = "roles/editor",
Members = new[]
{
"user:jane@example.com",
},
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := pubsub.NewSubscriptionIAMBinding(ctx, "editor", &pubsub.SubscriptionIAMBindingArgs{
Subscription: pulumi.String("your-subscription-name"),
Role: pulumi.String("roles/editor"),
Members: pulumi.StringArray{
pulumi.String("user:jane@example.com"),
},
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
resource "gcp_pubsub_subscriptioniambinding" "editor" {
subscription = "your-subscription-name"
role = "roles/editor"
members = ["user:jane@example.com"]
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.pubsub.SubscriptionIAMBinding;
import com.pulumi.gcp.pubsub.SubscriptionIAMBindingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new SubscriptionIAMBinding("editor", SubscriptionIAMBindingArgs.builder()
.subscription("your-subscription-name")
.role("roles/editor")
.members("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:pubsub:SubscriptionIAMBinding
properties:
subscription: your-subscription-name
role: roles/editor
members:
- user:jane@example.com
gcp.pubsub.SubscriptionIAMMember
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const editor = new gcp.pubsub.SubscriptionIAMMember("editor", {
subscription: "your-subscription-name",
role: "roles/editor",
member: "user:jane@example.com",
});
import pulumi
import pulumi_gcp as gcp
editor = gcp.pubsub.SubscriptionIAMMember("editor",
subscription="your-subscription-name",
role="roles/editor",
member="user:jane@example.com")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var editor = new Gcp.PubSub.SubscriptionIAMMember("editor", new()
{
Subscription = "your-subscription-name",
Role = "roles/editor",
Member = "user:jane@example.com",
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := pubsub.NewSubscriptionIAMMember(ctx, "editor", &pubsub.SubscriptionIAMMemberArgs{
Subscription: pulumi.String("your-subscription-name"),
Role: pulumi.String("roles/editor"),
Member: pulumi.String("user:jane@example.com"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
gcp = {
source = "pulumi/gcp"
}
}
}
resource "gcp_pubsub_subscriptioniammember" "editor" {
subscription = "your-subscription-name"
role = "roles/editor"
member = "user:jane@example.com"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.pubsub.SubscriptionIAMMember;
import com.pulumi.gcp.pubsub.SubscriptionIAMMemberArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var editor = new SubscriptionIAMMember("editor", SubscriptionIAMMemberArgs.builder()
.subscription("your-subscription-name")
.role("roles/editor")
.member("user:jane@example.com")
.build());
}
}
resources:
editor:
type: gcp:pubsub:SubscriptionIAMMember
properties:
subscription: your-subscription-name
role: roles/editor
member: user:jane@example.com
Import
> Custom Roles If you're importing a IAM resource with a custom role, make sure to use the
full name of the custom role, e.g. [projects/my-project|organizations/my-org]/roles/my-custom-role.
Constructors
- SubscriptionIAMBinding(String name, {SubscriptionIAMBindingArgs? args, CustomResourceOptions? options})
-
Creates a new SubscriptionIAMBinding.
nameThe Pulumi resource name.argsArguments used to configure this SubscriptionIAMBinding. The set of arguments for SubscriptionIAMBinding.optionsResource options controlling this resource's behavior. - SubscriptionIAMBinding.reference(String urn)
- Creates a typed reference to an existing SubscriptionIAMBinding resource.
Properties
-
childResources
→ Set<
Resource> -
finalinherited
-
completionSources
↔ Map<
String, IOutputCompletionSource> -
latefinalinherited
-
condition
↔ Output<
SubscriptionIAMBindingCondition?> -
latefinal
-
etag
↔ Output<
String> -
(Computed) The etag of the subscription's IAM policy.
latefinal
- hashCode → int
-
The hash code for this object.
no setterinherited
-
id
↔ Output<
String> -
getter/setter pairinherited
- isCustom → bool
-
Returns whether this resource is provider-managed.
no setterinherited
- isProtected → bool
-
Returns whether this resource is protected from deletion.
no setterinherited
- isRemote → bool
-
Whether this resource is registered as remote.
no setterinherited
- isResourceReference → bool
-
Whether this instance represents a resource value returned over RPC.
finalinherited
-
members
↔ Output<
List< String> > -
Identities that will be granted the privilege in
role. Each entry can have one of the following values:latefinal -
project
↔ Output<
String> -
The project in which the resource belongs. If it
is not provided, the provider project is used.
latefinal
-
resourceTransforms
→ List<
ResourceTransform> -
Inherited/explicit async transforms.
no setterinherited
-
role
↔ Output<
String> -
The role that should be applied. Only one
gcp.pubsub.SubscriptionIAMBindingcan be used per role. Note that custom roles must be of the format[projects|organizations]/{parent-name}/roles/{role-name}.latefinal - runtimeType → Type
-
A representation of the runtime type of the object.
no setterinherited
-
subscription
↔ Output<
String> -
The subscription name or id to bind to attach IAM policy to.
latefinal
-
transformations
→ List<
ResourceTransformation> -
Inherited/explicit legacy transformations.
no setterinherited
-
urn
↔ Output<
String> -
latefinalinherited
Methods
-
failId(
Object error) → void -
Completes this resource ID with an error when registration fails.
inherited
-
failOutputs(
Object error) → void -
Completes all output properties with
error.inherited -
failUrn(
Object error) → void -
Completes this resource URN with an error when registration fails.
inherited
-
getProvider(
String moduleMember) → ProviderResource? -
Returns provider for
moduleMember's package, if configured.inherited -
getResourceName(
) → String -
Returns this resource's logical name.
inherited
-
getResourceType(
) → String -
Returns this resource's Pulumi type token.
inherited
-
noSuchMethod(
Invocation invocation) → dynamic -
Invoked when a nonexistent method or property is accessed.
inherited
-
registerOutput<
T> (String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output< T> -
Registers a dynamic output property for this resource.
inherited
-
resolveId(
String? value, {required bool isKnown}) → void -
Resolves the provider-assigned ID for this resource.
inherited
-
resolveOutputs(
Struct outputs) → void -
Resolves all output properties from a monitor response payload.
inherited
-
resolveUrn(
String value) → void -
Resolves this resource's URN once assigned by the engine.
inherited
-
serializeProperties(
Map< String, dynamic> properties) → Future<Struct> -
Serializes resource properties for RPC transmission.
inherited
-
toString(
) → String -
A string representation of this object.
inherited
Operators
-
operator ==(
Object other) → bool -
The equality operator.
inherited
Static Methods
-
get(
String name, Input< String> id, {SubscriptionIAMBindingState? state, CustomResourceOptions? options}) → SubscriptionIAMBinding -
Gets an existing SubscriptionIAMBinding resource's state with the given
nameandid.