No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Hi folks :wave: , I'm new to pulumi and trying to create a GCP artifact registry with an IAMBinding. Something like:
```read_sa = serviceaccount.Account(
    "read-sa",
    account_id="read-sa",
    display_name="Read Service Account"
)
py_repo = artifactregistry.Repository(
    "pypi-repo",
    location="us-west1",
    repository_id="pypi-repo",
    description="python pacakges.",
    format="PYTHON",
)
read_binding = artifactregistry.RepositoryIamBinding(
    "read-binding",
    project=py_repo.project,
    location=py_repo.location,
    repository=py_repo.name,
    role="roles/artifactregistry.reader",
    members=[
        f"serviceAccount:{read_sa.email}",
    ],
)```
But I am getting errors:
```  gcp:artifactregistry:RepositoryIamBinding (read-binding):
    error: 1 error occurred:
        * Error applying IAM policy for artifactregistry repository "projects/test-project/locations/us-west1/repositories/pypi-repo": Error setting IAM policy for artifactregistry repository "projects/test-project/locations/us-west1/repositories/pypi-repo": googleapi: Error 400: Invalid service account (&lt;pulumi.output.Output object at 0x7f7f53ff7f10&gt;).```
Am I defining the `members` arg properly, or correct in using the service account email in an f-string? Mostly following <https://github.com/pulumi/examples/blob/master/gcp-ts-gke-serviceaccount/index.ts#L15-L23|this ts example>.

yeah, members are not constructed properly

If `read_sa.email` was a normal `str` that would work (f-string interpolation) but it’s actually `pulumi.Output[str]` . Try to see the details while trying to apply these changes, you should see “maltformed” `members` array.

In order to manipulate `Output` types, you have to either use `apply`:
```members = [
  read_sa.email.apply(lambda email: f"serviceAccount:{email}"),
]```
or `concat`:
```members = [
  pulumi.Output.concat("serviceAccount:", read_sa.email),
]```

Why? Reason is quite simple. This value is lazy evaluated and comes from a resource previously created so you have to have some kind of synchronization within the code. If you use the value directly (like you did with `py_repo.name`), there’s no need for additional “magic” - pulumi handles that automatically. However, it will break, if you do some string concatenation (using f-string or even plus sign).

<https://www.pulumi.com/docs/intro/concepts/inputs-outputs/#outputs-and-strings>