Connect Your GCP Account
to SynCloud in Minutes
SynCloud.ai is the autonomous infrastructure intelligence layer that understands your cloud environments and continuously optimizes them for cost, performance, security, and reliability.
The Understanding Tier — Zero Risk, Immediate Value
We get deep visibility into your infrastructure using exact read permissions.
No changes, no service-account keys — just actionable insights from day one.
Complete Visibility
Architecture, configuration, dependencies, IAM, metrics, and recommendations across GCP.
Actionable Insights
Find opportunities across cost, security, compliance, performance, and reliability.
100% Secure
Customer-owned identity. No keys. No infrastructure or IAM modification permissions.
Full Control
Choose organization or project scope and revoke every binding at any time.
Why Customers Choose SynCloud
- ✓Autonomous Infrastructure Intelligence that works 24/7 for you
- ✓Built for multi-cloud, hybrid, and complex enterprise environments
- ✓Deep context + continuous analysis = better decisions, faster
- ✓Start with zero risk and expand as trust grows
How to Connect Your GCP Account
The connection takes approximately five minutes and creates one customer-owned, keyless scanner identity. The script shows the full plan and requires APPLY before making changes.
Sign in with a Google Cloud administrator, then open Google Cloud Shell:
Open Google Cloud ShellCopy and run this command:
curl -fsSLo /tmp/syncloud-gcp-onboarding.sh \ https://connect.syncloud.ai/gcp/v1/syncloud-gcp-onboarding.sh && \ bash /tmp/syncloud-gcp-onboarding.sh
Choose entire organization or specific projects from the numbered lists. Optional private logs and billing-export access remain off unless you approve them.
Review the plan, enter APPLY, then copy the displayed JSON connection manifest and paste it into your onboarding email to SynCloud. Keep the saved file for revocation.
Use the same command from a terminal with gcloud, jq, and Bash 4+ installed. Confirm the correct administrator first:
gcloud auth list --filter=status:ACTIVE curl -fsSLo /tmp/syncloud-gcp-onboarding.sh \ https://connect.syncloud.ai/gcp/v1/syncloud-gcp-onboarding.sh && \ bash /tmp/syncloud-gcp-onboarding.sh
Security teams can review the complete script before running it.
What SynCloud Can Read
- ✓Configuration & topology
- ✓IAM policies & metadata
- ✓Metrics & recommendations
- ✓Logs when approved
- ✓Billing export when configured
What SynCloud Cannot Access
(Not Granted)
- ×Cloud Storage object contents
- ×Secret Manager secret payloads
- ×KMS decryptable data
- ×BigQuery query jobs
- ×Any ability to make changes
Security by Design
- ✓Exact custom read role
- ✓No service-account keys
- ✓Short-lived tokens, up to one hour
- ✓Customer-selected scan scope
- ✓Review script before running
Use the saved manifest to remove all scanner IAM bindings and disable the customer scanner account. Existing short-lived tokens can remain valid until they expire.
bash /tmp/syncloud-gcp-onboarding.sh --revoke \ syncloud-gcp-onboarding-SCANNER_HOST_PROJECT.json