DatabaseIAMBinding class

Three different resources help you manage your IAM policy for a Spanner database. Each of these resources serves a different use case:

• gcp.spanner.DatabaseIAMPolicy: Authoritative. Sets the IAM policy for the database and replaces any existing policy already attached.

> Warning: It's entirely possibly to lock yourself out of your database using gcp.spanner.DatabaseIAMPolicy. Any permissions granted by default will be removed unless you include them in your config.

• gcp.spanner.DatabaseIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the database are preserved.
• gcp.spanner.DatabaseIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the database are preserved.

> Note: gcp.spanner.DatabaseIAMPolicy cannot be used in conjunction with gcp.spanner.DatabaseIAMBinding and gcp.spanner.DatabaseIAMMember or they will fight over what your policy should be.

> Note: gcp.spanner.DatabaseIAMBinding resources can be used in conjunction with gcp.spanner.DatabaseIAMMember resources only if they do not grant privilege to the same role.

gcp.spanner.DatabaseIAMPolicy

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:[e-mail]"],
    }],
});
const database = new gcp.spanner.DatabaseIAMPolicy("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:[e-mail]"],
}])
database = gcp.spanner.DatabaseIAMPolicy("database",
    instance="your-instance-name",
    database="your-database-name",
    policy_data=admin.policy_data)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:[e-mail]",
                },
            },
        },
    });

    var database = new Gcp.Spanner.DatabaseIAMPolicy("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:[e-mail]",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = spanner.NewDatabaseIAMPolicy(ctx, "database", &spanner.DatabaseIAMPolicyArgs{
			Instance:   pulumi.String("your-instance-name"),
			Database:   pulumi.String("your-database-name"),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_organizations_getiampolicy" "admin" {
  bindings {
    role    = "roles/editor"
    members = ["user:[e-mail]"]
  }
}

resource "gcp_spanner_databaseiampolicy" "database" {
  instance    = "your-instance-name"
  database    = "your-database-name"
  policy_data = data.gcp_organizations_getiampolicy.admin.policy_data
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingArgs;
import com.pulumi.gcp.spanner.DatabaseIAMPolicy;
import com.pulumi.gcp.spanner.DatabaseIAMPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:[e-mail]")
                .build())
            .build());

        var database = new DatabaseIAMPolicy("database", DatabaseIAMPolicyArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMPolicy
    properties:
      instance: your-instance-name
      database: your-database-name
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:[e-mail]

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:[e-mail]"],
        condition: {
            title: "My Role",
            description: "Grant permissions on my_role",
            expression: "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
        },
    }],
});
const database = new gcp.spanner.DatabaseIAMPolicy("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:[e-mail]"],
    "condition": {
        "title": "My Role",
        "description": "Grant permissions on my_role",
        "expression": "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    },
}])
database = gcp.spanner.DatabaseIAMPolicy("database",
    instance="your-instance-name",
    database="your-database-name",
    policy_data=admin.policy_data)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:[e-mail]",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "My Role",
                    Description = "Grant permissions on my_role",
                    Expression = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
                },
            },
        },
    });

    var database = new Gcp.Spanner.DatabaseIAMPolicy("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:[e-mail]",
					},
					Condition: {
						Title:       "My Role",
						Description: pulumi.StringRef("Grant permissions on my_role"),
						Expression:  "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = spanner.NewDatabaseIAMPolicy(ctx, "database", &spanner.DatabaseIAMPolicyArgs{
			Instance:   pulumi.String("your-instance-name"),
			Database:   pulumi.String("your-database-name"),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_organizations_getiampolicy" "admin" {
  bindings {
    role    = "roles/editor"
    members = ["user:[e-mail]"]
    condition = {
      title       = "My Role"
      description = "Grant permissions on my_role"
      expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
    }
  }
}

resource "gcp_spanner_databaseiampolicy" "database" {
  instance    = "your-instance-name"
  database    = "your-database-name"
  policy_data = data.gcp_organizations_getiampolicy.admin.policy_data
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingConditionArgs;
import com.pulumi.gcp.spanner.DatabaseIAMPolicy;
import com.pulumi.gcp.spanner.DatabaseIAMPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:[e-mail]")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("My Role")
                    .description("Grant permissions on my_role")
                    .expression("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))")
                    .build())
                .build())
            .build());

        var database = new DatabaseIAMPolicy("database", DatabaseIAMPolicyArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMPolicy
    properties:
      instance: your-instance-name
      database: your-database-name
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:[e-mail]
            condition:
              title: My Role
              description: Grant permissions on my_role
              expression: (resource.type == "spanner.googleapis.com/DatabaseRole" && (resource.name.endsWith("/myrole")))

gcp.spanner.DatabaseIAMBinding

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMBinding("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    members: ["user:[e-mail]"],
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMBinding("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    members=["user:[e-mail]"])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMBinding("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Members = new[]
        {
            "user:[e-mail]",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMBinding(ctx, "database", &spanner.DatabaseIAMBindingArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:[e-mail]"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiambinding" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  members  = ["user:[e-mail]"]
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMBinding;
import com.pulumi.gcp.spanner.DatabaseIAMBindingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMBinding("database", DatabaseIAMBindingArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .members("user:[e-mail]")
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMBinding
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      members:
        - user:[e-mail]

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMBinding("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    members: ["user:[e-mail]"],
    condition: {
        title: "My Role",
        description: "Grant permissions on my_role",
        expression: "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    },
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMBinding("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    members=["user:[e-mail]"],
    condition={
        "title": "My Role",
        "description": "Grant permissions on my_role",
        "expression": "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMBinding("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Members = new[]
        {
            "user:[e-mail]",
        },
        Condition = new Gcp.Spanner.Inputs.DatabaseIAMBindingConditionArgs
        {
            Title = "My Role",
            Description = "Grant permissions on my_role",
            Expression = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMBinding(ctx, "database", &spanner.DatabaseIAMBindingArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:[e-mail]"),
			},
			Condition: &spanner.DatabaseIAMBindingConditionArgs{
				Title:       pulumi.String("My Role"),
				Description: pulumi.String("Grant permissions on my_role"),
				Expression:  pulumi.String("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiambinding" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  members  = ["user:[e-mail]"]
  condition = {
    title       = "My Role"
    description = "Grant permissions on my_role"
    expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMBinding;
import com.pulumi.gcp.spanner.DatabaseIAMBindingArgs;
import com.pulumi.gcp.spanner.inputs.DatabaseIAMBindingConditionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMBinding("database", DatabaseIAMBindingArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .members("user:[e-mail]")
            .condition(DatabaseIAMBindingConditionArgs.builder()
                .title("My Role")
                .description("Grant permissions on my_role")
                .expression("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))")
                .build())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMBinding
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      members:
        - user:[e-mail]
      condition:
        title: My Role
        description: Grant permissions on my_role
        expression: (resource.type == "spanner.googleapis.com/DatabaseRole" && (resource.name.endsWith("/myrole")))

gcp.spanner.DatabaseIAMMember

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMMember("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    member: "user:[e-mail]",
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMMember("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    member="user:[e-mail]")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMMember("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Member = "user:[e-mail]",
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMMember(ctx, "database", &spanner.DatabaseIAMMemberArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Member:   pulumi.String("user:[e-mail]"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiammember" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  member   = "user:[e-mail]"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMMember;
import com.pulumi.gcp.spanner.DatabaseIAMMemberArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMMember("database", DatabaseIAMMemberArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .member("user:[e-mail]")
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMMember
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      member: user:[e-mail]

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMMember("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    member: "user:[e-mail]",
    condition: {
        title: "My Role",
        description: "Grant permissions on my_role",
        expression: "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    },
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMMember("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    member="user:[e-mail]",
    condition={
        "title": "My Role",
        "description": "Grant permissions on my_role",
        "expression": "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMMember("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Member = "user:[e-mail]",
        Condition = new Gcp.Spanner.Inputs.DatabaseIAMMemberConditionArgs
        {
            Title = "My Role",
            Description = "Grant permissions on my_role",
            Expression = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMMember(ctx, "database", &spanner.DatabaseIAMMemberArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Member:   pulumi.String("user:[e-mail]"),
			Condition: &spanner.DatabaseIAMMemberConditionArgs{
				Title:       pulumi.String("My Role"),
				Description: pulumi.String("Grant permissions on my_role"),
				Expression:  pulumi.String("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiammember" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  member   = "user:[e-mail]"
  condition = {
    title       = "My Role"
    description = "Grant permissions on my_role"
    expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMMember;
import com.pulumi.gcp.spanner.DatabaseIAMMemberArgs;
import com.pulumi.gcp.spanner.inputs.DatabaseIAMMemberConditionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMMember("database", DatabaseIAMMemberArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .member("user:[e-mail]")
            .condition(DatabaseIAMMemberConditionArgs.builder()
                .title("My Role")
                .description("Grant permissions on my_role")
                .expression("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))")
                .build())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMMember
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      member: user:[e-mail]
      condition:
        title: My Role
        description: Grant permissions on my_role
        expression: (resource.type == "spanner.googleapis.com/DatabaseRole" && (resource.name.endsWith("/myrole")))

This resource supports User Project Overrides.

IAM policy for Spanner Databases

Three different resources help you manage your IAM policy for a Spanner database. Each of these resources serves a different use case:

• gcp.spanner.DatabaseIAMPolicy: Authoritative. Sets the IAM policy for the database and replaces any existing policy already attached.

> Warning: It's entirely possibly to lock yourself out of your database using gcp.spanner.DatabaseIAMPolicy. Any permissions granted by default will be removed unless you include them in your config.

• gcp.spanner.DatabaseIAMBinding: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the database are preserved.
• gcp.spanner.DatabaseIAMMember: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the database are preserved.

> Note: gcp.spanner.DatabaseIAMPolicy cannot be used in conjunction with gcp.spanner.DatabaseIAMBinding and gcp.spanner.DatabaseIAMMember or they will fight over what your policy should be.

> Note: gcp.spanner.DatabaseIAMBinding resources can be used in conjunction with gcp.spanner.DatabaseIAMMember resources only if they do not grant privilege to the same role.

gcp.spanner.DatabaseIAMPolicy

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:[e-mail]"],
    }],
});
const database = new gcp.spanner.DatabaseIAMPolicy("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:[e-mail]"],
}])
database = gcp.spanner.DatabaseIAMPolicy("database",
    instance="your-instance-name",
    database="your-database-name",
    policy_data=admin.policy_data)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:[e-mail]",
                },
            },
        },
    });

    var database = new Gcp.Spanner.DatabaseIAMPolicy("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:[e-mail]",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = spanner.NewDatabaseIAMPolicy(ctx, "database", &spanner.DatabaseIAMPolicyArgs{
			Instance:   pulumi.String("your-instance-name"),
			Database:   pulumi.String("your-database-name"),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_organizations_getiampolicy" "admin" {
  bindings {
    role    = "roles/editor"
    members = ["user:[e-mail]"]
  }
}

resource "gcp_spanner_databaseiampolicy" "database" {
  instance    = "your-instance-name"
  database    = "your-database-name"
  policy_data = data.gcp_organizations_getiampolicy.admin.policy_data
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingArgs;
import com.pulumi.gcp.spanner.DatabaseIAMPolicy;
import com.pulumi.gcp.spanner.DatabaseIAMPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:[e-mail]")
                .build())
            .build());

        var database = new DatabaseIAMPolicy("database", DatabaseIAMPolicyArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMPolicy
    properties:
      instance: your-instance-name
      database: your-database-name
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:[e-mail]

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const admin = gcp.organizations.getIAMPolicy({
    bindings: [{
        role: "roles/editor",
        members: ["user:[e-mail]"],
        condition: {
            title: "My Role",
            description: "Grant permissions on my_role",
            expression: "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
        },
    }],
});
const database = new gcp.spanner.DatabaseIAMPolicy("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    policyData: admin.then(admin => admin.policyData),
});

import pulumi
import pulumi_gcp as gcp

admin = gcp.organizations.get_iam_policy(bindings=[{
    "role": "roles/editor",
    "members": ["user:[e-mail]"],
    "condition": {
        "title": "My Role",
        "description": "Grant permissions on my_role",
        "expression": "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    },
}])
database = gcp.spanner.DatabaseIAMPolicy("database",
    instance="your-instance-name",
    database="your-database-name",
    policy_data=admin.policy_data)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var admin = Gcp.Organizations.GetIAMPolicy.Invoke(new()
    {
        Bindings = new[]
        {
            new Gcp.Organizations.Inputs.GetIAMPolicyBindingInputArgs
            {
                Role = "roles/editor",
                Members = new[]
                {
                    "user:[e-mail]",
                },
                Condition = new Gcp.Organizations.Inputs.GetIAMPolicyBindingConditionInputArgs
                {
                    Title = "My Role",
                    Description = "Grant permissions on my_role",
                    Expression = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
                },
            },
        },
    });

    var database = new Gcp.Spanner.DatabaseIAMPolicy("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        PolicyData = admin.Apply(getIAMPolicyResult => getIAMPolicyResult.PolicyData),
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/organizations"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		admin, err := organizations.LookupIAMPolicy(ctx, &organizations.LookupIAMPolicyArgs{
			Bindings: []organizations.GetIAMPolicyBinding{
				{
					Role: "roles/editor",
					Members: []string{
						"user:[e-mail]",
					},
					Condition: {
						Title:       "My Role",
						Description: pulumi.StringRef("Grant permissions on my_role"),
						Expression:  "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
					},
				},
			},
		}, nil)
		if err != nil {
			return err
		}
		_, err = spanner.NewDatabaseIAMPolicy(ctx, "database", &spanner.DatabaseIAMPolicyArgs{
			Instance:   pulumi.String("your-instance-name"),
			Database:   pulumi.String("your-database-name"),
			PolicyData: pulumi.String(admin.PolicyData),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

data "gcp_organizations_getiampolicy" "admin" {
  bindings {
    role    = "roles/editor"
    members = ["user:[e-mail]"]
    condition = {
      title       = "My Role"
      description = "Grant permissions on my_role"
      expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
    }
  }
}

resource "gcp_spanner_databaseiampolicy" "database" {
  instance    = "your-instance-name"
  database    = "your-database-name"
  policy_data = data.gcp_organizations_getiampolicy.admin.policy_data
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.organizations.OrganizationsFunctions;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingArgs;
import com.pulumi.gcp.organizations.inputs.GetIAMPolicyBindingConditionArgs;
import com.pulumi.gcp.spanner.DatabaseIAMPolicy;
import com.pulumi.gcp.spanner.DatabaseIAMPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var admin = OrganizationsFunctions.getIAMPolicy(GetIAMPolicyArgs.builder()
            .bindings(GetIAMPolicyBindingArgs.builder()
                .role("roles/editor")
                .members("user:[e-mail]")
                .condition(GetIAMPolicyBindingConditionArgs.builder()
                    .title("My Role")
                    .description("Grant permissions on my_role")
                    .expression("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))")
                    .build())
                .build())
            .build());

        var database = new DatabaseIAMPolicy("database", DatabaseIAMPolicyArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .policyData(admin.policyData())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMPolicy
    properties:
      instance: your-instance-name
      database: your-database-name
      policyData: ${admin.policyData}
variables:
  admin:
    fn::invoke:
      function: gcp:organizations:getIAMPolicy
      arguments:
        bindings:
          - role: roles/editor
            members:
              - user:[e-mail]
            condition:
              title: My Role
              description: Grant permissions on my_role
              expression: (resource.type == "spanner.googleapis.com/DatabaseRole" && (resource.name.endsWith("/myrole")))

gcp.spanner.DatabaseIAMBinding

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMBinding("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    members: ["user:[e-mail]"],
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMBinding("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    members=["user:[e-mail]"])

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMBinding("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Members = new[]
        {
            "user:[e-mail]",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMBinding(ctx, "database", &spanner.DatabaseIAMBindingArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:[e-mail]"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiambinding" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  members  = ["user:[e-mail]"]
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMBinding;
import com.pulumi.gcp.spanner.DatabaseIAMBindingArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMBinding("database", DatabaseIAMBindingArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .members("user:[e-mail]")
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMBinding
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      members:
        - user:[e-mail]

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMBinding("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    members: ["user:[e-mail]"],
    condition: {
        title: "My Role",
        description: "Grant permissions on my_role",
        expression: "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    },
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMBinding("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    members=["user:[e-mail]"],
    condition={
        "title": "My Role",
        "description": "Grant permissions on my_role",
        "expression": "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMBinding("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Members = new[]
        {
            "user:[e-mail]",
        },
        Condition = new Gcp.Spanner.Inputs.DatabaseIAMBindingConditionArgs
        {
            Title = "My Role",
            Description = "Grant permissions on my_role",
            Expression = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMBinding(ctx, "database", &spanner.DatabaseIAMBindingArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Members: pulumi.StringArray{
				pulumi.String("user:[e-mail]"),
			},
			Condition: &spanner.DatabaseIAMBindingConditionArgs{
				Title:       pulumi.String("My Role"),
				Description: pulumi.String("Grant permissions on my_role"),
				Expression:  pulumi.String("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiambinding" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  members  = ["user:[e-mail]"]
  condition = {
    title       = "My Role"
    description = "Grant permissions on my_role"
    expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMBinding;
import com.pulumi.gcp.spanner.DatabaseIAMBindingArgs;
import com.pulumi.gcp.spanner.inputs.DatabaseIAMBindingConditionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMBinding("database", DatabaseIAMBindingArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .members("user:[e-mail]")
            .condition(DatabaseIAMBindingConditionArgs.builder()
                .title("My Role")
                .description("Grant permissions on my_role")
                .expression("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))")
                .build())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMBinding
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      members:
        - user:[e-mail]
      condition:
        title: My Role
        description: Grant permissions on my_role
        expression: (resource.type == "spanner.googleapis.com/DatabaseRole" && (resource.name.endsWith("/myrole")))

gcp.spanner.DatabaseIAMMember

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMMember("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    member: "user:[e-mail]",
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMMember("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    member="user:[e-mail]")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMMember("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Member = "user:[e-mail]",
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMMember(ctx, "database", &spanner.DatabaseIAMMemberArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Member:   pulumi.String("user:[e-mail]"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiammember" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  member   = "user:[e-mail]"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMMember;
import com.pulumi.gcp.spanner.DatabaseIAMMemberArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMMember("database", DatabaseIAMMemberArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .member("user:[e-mail]")
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMMember
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      member: user:[e-mail]

With IAM Conditions:

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const database = new gcp.spanner.DatabaseIAMMember("database", {
    instance: "your-instance-name",
    database: "your-database-name",
    role: "roles/compute.networkUser",
    member: "user:[e-mail]",
    condition: {
        title: "My Role",
        description: "Grant permissions on my_role",
        expression: "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    },
});

import pulumi
import pulumi_gcp as gcp

database = gcp.spanner.DatabaseIAMMember("database",
    instance="your-instance-name",
    database="your-database-name",
    role="roles/compute.networkUser",
    member="user:[e-mail]",
    condition={
        "title": "My Role",
        "description": "Grant permissions on my_role",
        "expression": "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() =>
{
    var database = new Gcp.Spanner.DatabaseIAMMember("database", new()
    {
        Instance = "your-instance-name",
        Database = "your-database-name",
        Role = "roles/compute.networkUser",
        Member = "user:[e-mail]",
        Condition = new Gcp.Spanner.Inputs.DatabaseIAMMemberConditionArgs
        {
            Title = "My Role",
            Description = "Grant permissions on my_role",
            Expression = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))",
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/spanner"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := spanner.NewDatabaseIAMMember(ctx, "database", &spanner.DatabaseIAMMemberArgs{
			Instance: pulumi.String("your-instance-name"),
			Database: pulumi.String("your-database-name"),
			Role:     pulumi.String("roles/compute.networkUser"),
			Member:   pulumi.String("user:[e-mail]"),
			Condition: &spanner.DatabaseIAMMemberConditionArgs{
				Title:       pulumi.String("My Role"),
				Description: pulumi.String("Grant permissions on my_role"),
				Expression:  pulumi.String("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    gcp = {
      source = "pulumi/gcp"
    }
  }
}

resource "gcp_spanner_databaseiammember" "database" {
  instance = "your-instance-name"
  database = "your-database-name"
  role     = "roles/compute.networkUser"
  member   = "user:[e-mail]"
  condition = {
    title       = "My Role"
    description = "Grant permissions on my_role"
    expression  = "(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.spanner.DatabaseIAMMember;
import com.pulumi.gcp.spanner.DatabaseIAMMemberArgs;
import com.pulumi.gcp.spanner.inputs.DatabaseIAMMemberConditionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var database = new DatabaseIAMMember("database", DatabaseIAMMemberArgs.builder()
            .instance("your-instance-name")
            .database("your-database-name")
            .role("roles/compute.networkUser")
            .member("user:[e-mail]")
            .condition(DatabaseIAMMemberConditionArgs.builder()
                .title("My Role")
                .description("Grant permissions on my_role")
                .expression("(resource.type == \"spanner.googleapis.com/DatabaseRole\" && (resource.name.endsWith(\"/myrole\")))")
                .build())
            .build());

    }
}

resources:
  database:
    type: gcp:spanner:DatabaseIAMMember
    properties:
      instance: your-instance-name
      database: your-database-name
      role: roles/compute.networkUser
      member: user:[e-mail]
      condition:
        title: My Role
        description: Grant permissions on my_role
        expression: (resource.type == "spanner.googleapis.com/DatabaseRole" && (resource.name.endsWith("/myrole")))

Import

> Custom Roles: If you're importing a IAM resource with a custom role, make sure to use the full name of the custom role, e.g. [projects/my-project|organizations/my-org]/roles/my-custom-role.

For all import syntaxes, the "resource in question" can take any of the following forms:

• {{project}}/{{instance}}/{{database}}
• {{instance}}/{{database}} (project is taken from provider project)

Constructors

DatabaseIAMBinding(String name, {DatabaseIAMBindingArgs? args, CustomResourceOptions? options})

Creates a new DatabaseIAMBinding. name The Pulumi resource name. args Arguments used to configure this DatabaseIAMBinding. The set of arguments for DatabaseIAMBinding. options Resource options controlling this resource's behavior.

DatabaseIAMBinding.reference(String urn)

Creates a typed reference to an existing DatabaseIAMBinding resource.

Properties

childResources → Set<Resource>

final, inherited

completionSources ↔ Map<String, IOutputCompletionSource>

late, final, inherited

condition ↔ Output<DatabaseIAMBindingCondition?>

An IAM Condition for a given binding. Structure is documented below.

late, final

database ↔ Output<String>

The name of the Spanner database.

late, final

etag ↔ Output<String>

(Computed) The etag of the database's IAM policy.

late, final

hashCode → int

The hash code for this object.

no setter, inherited

id ↔ Output<String>

getter/setter pair, inherited

instance ↔ Output<String>

The name of the Spanner instance the database belongs to.

late, final

isCustom → bool

Returns whether this resource is provider-managed.

no setter, inherited

isProtected → bool

Returns whether this resource is protected from deletion.

no setter, inherited

isRemote → bool

Whether this resource is registered as remote.

no setter, inherited

isResourceReference → bool

Whether this instance represents a resource value returned over RPC.

final, inherited

members ↔ Output<List<String>>

Identities that will be granted the privilege in role. Each entry can have one of the following values:

late, final

project ↔ Output<String>

The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

late, final

resourceTransforms → List<ResourceTransform>

Inherited/explicit async transforms.

no setter, inherited

role ↔ Output<String>

The role that should be applied. Only one gcp.spanner.DatabaseIAMBinding can be used per role. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

late, final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

transformations → List<ResourceTransformation>

Inherited/explicit legacy transformations.

no setter, inherited

urn ↔ Output<String>

late, final, inherited

Methods

failId(Object error) → void

Completes this resource ID with an error when registration fails.

inherited

failOutputs(Object error) → void

Completes all output properties with error.

inherited

failUrn(Object error) → void

Completes this resource URN with an error when registration fails.

inherited

getProvider(String moduleMember) → ProviderResource?

Returns provider for moduleMember's package, if configured.

inherited

getResourceName() → String

Returns this resource's logical name.

inherited

getResourceType() → String

Returns this resource's Pulumi type token.

inherited

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>

Registers a dynamic output property for this resource.

inherited

resolveId(String? value, {required bool isKnown}) → void

Resolves the provider-assigned ID for this resource.

inherited

resolveOutputs(Struct outputs) → void

Resolves all output properties from a monitor response payload.

inherited

resolveUrn(String value) → void

Resolves this resource's URN once assigned by the engine.

inherited

serializeProperties(Map<String, dynamic> properties) → Future<Struct>

Serializes resource properties for RPC transmission.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

get(String name, Input<String> id, {DatabaseIAMBindingState? state, CustomResourceOptions? options}) → DatabaseIAMBinding

Gets an existing DatabaseIAMBinding resource's state with the given name and id.