This message was deleted.

You need to do this using Project IAM policies and conditions. There's a Terraform example in the docs: https://cloud.google.com/sql/docs/postgres/iam-conditions#terraform The example can be used as reference for how to use the pulumi IAMMember resource: https://www.pulumi.com/registry/packages/gcp/api-docs/projects/iammember/

Ah thank you!

If you do end up creating a Pulumi sample for this, could you post it here? My team might be interested in it in a couple of weeks.

I haven't tested it yet, but it should look roughly like this:

new gcp.projects.IAMBinding("...", {
    members: [...],
    role: "roles/cloudsql.client",
    condition: {
        expression: pulumi.interpolate`resource.name == 'projects/${gcp.config.project}/instances/${instance.name}' && resource.type == 'sqladmin.googleapis.com/Instance'`,
        title: "...",
        description: "...",
    }
});