Your first GCP IAM snapshot
in under 10 minutes.

CYBBACK offers two ways to get started. Both unlock the full Google Cloud IAM feature set.

Option A — Free trial

1. Open cybback.com/essai-gratuit.
2. Fill in your work email, company and a password. Click Start free trial.
3. Confirm via the verification email.
4. On the trial selection screen, pick Google Cloud IAM. Your trial workspace is provisioned instantly.

Option B — Paid licence (Stripe checkout)

1. Go to cybback.com/tarifs and pick the Google Cloud IAM plan that matches the number of GCP projects to protect.
2. Click Subscribe. Stripe Checkout supports cards, SEPA and invoicing on annual plans.
3. Your licence is active immediately — visible under Account → Subscription.

CYBBACK reads your project IAM through a Google service account. The service account needs read-only roles for backup, and additional admin roles only if you plan to use the restore feature.

1. Create the service account

1. Open console.cloud.google.com and select the project to protect.
2. Enable these APIs: Identity and Access Management (IAM) API, Cloud Resource Manager API, Service Usage API, Org Policy API.
3. Go to IAM & Admin → Service Accounts → + Create service account. Name it cybback-iam-backup.
4. Open the new service account → Keys → Add key → JSON. Save the file safely.

2. Grant the required roles

On the project (IAM & Admin → IAM → + Grant access), assign to the service account:

3. Paste credentials into CYBBACK

1. Open app.cybback.com/dashboard/giam-backup → Settings.
2. Paste the entire JSON service account key.
3. Specify the Project ID to protect. Click Save credentials.
4. CYBBACK runs an authentication test and lists your project metadata on success.

Backup files are stored on CYBBACK's secure EU infrastructure by default. Add a second layer with client-side encryption: each file is encrypted before it leaves the worker.

1. On the Settings tab of the Google Cloud IAM page, scroll to Security options.
2. Toggle AES-256 Encryption ON.
3. Click Save. Applies to new backups; previous backups remain readable.

Want full data sovereignty? Point CYBBACK at your S3-compatible bucket — AWS S3, GCS, Scaleway, OVH, Wasabi, MinIO. Your data, your provider, your region.

Provision the bucket

1. In your S3 provider, create a private bucket (no public access, versioning recommended).
2. Create an access key / secret key with permissions limited to that bucket.
3. Note your endpoint URL and region.

Configure CYBBACK

1. Open Dashboard → Storage.
2. Select My own S3 storage.
3. Fill the form, click Test connection, then Save.

• Required IAM actions: PutObject, GetObject, DeleteObject, ListBucket.
• Resilience: CYBBACK stores an encrypted snapshot of S3 credentials with each backup. Old backups remain restorable even after you switch providers.

You're now fully configured. Time to run your first IAM snapshot — manually for instant peace of mind, then schedule recurring runs.

Manual backup

1. Go back to the Dashboard tab.
2. Click Run backup now. The job appears with status pending, then running.
3. Progress is streamed live: IAM policies fetched, service accounts listed, custom roles enumerated, org policies captured.

Schedule automatic backups

1. From Dashboard → Schedules, click New schedule.
2. Service: Google Cloud IAM. Frequency: Daily / Weekly / Custom (cron).
3. Pick a window and click Save.

Track your backups

• Real-time: the Events page streams every operation across all services via SSE.
• Notifications: success / failure / drift alerts via email, Slack and webhooks.
• Drift detection: alerts on suspicious permission changes, role permission expansions, or sudden binding count changes between runs.

CYBBACK restores from any previous IAM snapshot. Pick a single binding, a deleted service account, an obsolete role definition — or roll back the entire project IAM state to a known-good moment.

The 3-step restore flow

1. Selection. Open the snapshot, browse the 4 categories (IAM Policies, Service Accounts, Custom Roles, Org Policies), tick what you want to recover. Search by principal email or role name.
2. Options. Choose your safety net:
   • Dry-run — simulate, no IAM API write.
   • Merge — add missing bindings without removing live ones (recommended).
   • Overwrite — replace the live IAM policy with the snapshot (full rollback).
3. Execution. The API applies the restore in real-time and reports per-resource results. A summary shows what was added, updated or skipped.

Best practices

• Always start with a dry-run — IAM mistakes can lock you out of your own project.
• Prefer merge mode for incremental remediation. Reserve overwrite for true disaster recovery.
• Watch the etag. CYBBACK uses optimistic concurrency: if the live policy has changed since the snapshot, you'll get a clean error rather than a silent overwrite.
• Native exports: ZIP archives of JSON-formatted IAM bindings are also available from the Export tab if you need an offline copy.