The official documentation for this is at https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam:
Four different resources help you manage your IAM policy for a project. Each of these resources serves a different use case:
google_project_iam_policy
: Authoritative. Sets the IAM policy for the project and replaces any existing policy already attached.google_project_iam_binding
: Authoritative for a given role. Updates the IAM policy to grant a role to a list of members. Other roles within the IAM policy for the project are preserved.google_project_iam_member
: Non-authoritative. Updates the IAM policy to grant a role to a new member. Other members for the role for the project are preserved.google_project_iam_audit_config
: Authoritative for a given service. Updates the IAM policy to enable audit logging for the given service.
In short, binding
revokes any other members from the role to which it applies, whereas member
just adds a member alongside existing members.