Connect Scaleway

Reads your Scaleway resources live: instances, volumes, security groups, flexible IPs, Object Storage buckets, organization IAM, Managed Databases, Secret Manager and Key Manager. Instances, buckets and the other tables are read in Paris, Amsterdam and Warsaw.

For the general flow of adding a source, see Connect Data Sources.

Prerequisites

• Scaleway account with IAM access

• Project ID of your Scaleway project

• A dedicated IAM application holding a read-only policy (see step 2)

Setup

Step 1 — Retrieve the Project ID and Organization ID

Scaleway console → project selector at top → note the Project ID (UUID). The Organization ID is under Organization → Settings.

Step 2 — Create an application and its read-only policy

An API key has exactly the rights of its bearer: give it to a dedicated application rather than to your own user.

1. IAM → Applications → Create application, name it HARVEN

2. IAM → Policies → Create policy, principal: the HARVEN application

3. Rule on the organization: IAMReadOnly (iam_* tables)

4. Rule on your projects (or "all projects" to read the whole organization): InstancesReadOnly, BlockStorageReadOnly, ObjectStorageReadOnly, RelationalDatabasesReadOnly, SecretManagerReadOnly, KeyManagerReadOnly

5. Without one of these sets, only the table concerned fails; the others stay readable.

Step 3 — Create the API key

1. IAM → API Keys → Generate an API key

2. Bearer: the HARVEN application. Description: HARVEN

3. For Object Storage, set up a preferred Project and select the same project as in Step 1: HARVEN lists the buckets of that project

4. Immediately copy the Access Key and Secret Key

Fields to fill in HARVEN

Collected data

• instances — Scaleway compute instances: Identification (instance_name, instance_type, state, zone), Network (private_ip, public_ip, security_group_id)

• buckets — Object Storage buckets: Storage (bucket_name, region, versioning_enabled), Public exposure (is_public, acl_grants, policy_allows_public), Encryption and retention (encryption_enabled, object_lock_enabled, lifecycle_rules_count)

• volumes — Block Storage and Instance volumes: Volume and attachment (volume_id, type, size_gb, attached_server_id, snapshot_count)

• security_group_rules — Security group rules: Filtering rule (security_group_id, direction, action, protocol, ip_range, dest_port_from, dest_port_to)

• flexible_ips — Public flexible IPs: Exposure (address, type, attached_server_id)

• iam_users / iam_applications / iam_api_keys — Organization identities and keys: Access hygiene (mfa, last_login_at, expires_at, created_at)

• iam_policy_rules / iam_groups / iam_group_members / iam_permission_sets — Granted rights and their scope: Permissions (permission_set_names, permission_sets_scope_type, project_ids)

• database_instances — Managed Databases: Posture (public_endpoint, acl_open_to_world, encryption_at_rest, backup_schedule_disabled)

• secrets / keys — Secret Manager and Key Manager (metadata only): Rotation and expiry (version_count, has_ephemeral_policy, rotation_period_days, rotated_at)

Official documentation

• Scaleway IAM and API Keys

• Scaleway IAM permission sets

Need help? Contact [email protected].