Connect a Scaleway organization

Create a read-only Scaleway API key to inventory cloud resources and report security posture findings.

Access: organization administrator. Beta feature; the connector must be enabled on your platform.

Prerequisites

• Be an organization administrator in CISAPP.
• Be able to create an application, a policy and an API key in the IAM of the target Scaleway organization (owner or equivalent rights).
• A Scaleway organization can only be connected to one CISAPP organization.

Create the access in Scaleway

CISAPP never uses your personal account: create a dedicated, read-only IAM application.

1. In the Scaleway console, IAM → Applications: create an application (for example cisapp-readonly).
2. IAM → Policies: create a policy for this application with exactly the permission sets below.
3. IAM → API keys: create an API key for the application, with an expiration date (recommended). Note the access key and the secret key.

Permission sets to grant

Scope	Permission sets
Projects to analyze	InstancesReadOnly, ObjectStorageBucketsRead, RelationalDatabasesReadOnly, LoadBalancersReadOnly, VPCReadOnly, KubernetesReadOnly, FunctionsReadOnly, ContainersReadOnly, ContainerRegistryReadOnly, BlockStorageReadOnly
Organization	IAMReadOnly, ProjectReadOnly

If a product is not granted, CISAPP reports it as "not granted" in the synchronization and analyzes the rest. Grant the permission sets on every project of the organization, or restrict the connection to the granted projects with the Projects field: otherwise projects without these permissions are reported as not collected at every synchronization.

Never grant SecretManagerSecretAccess, any *FullAccess or *Manager set, BillingReadOnly or AllProductsReadOnly: CISAPP does not need them.

Scaleway shows the secret key only once. CISAPP stores it encrypted and never displays it again.

The CISAPP wizard also offers a collapsible guide with a command-line example (scw iam …). It is an example to adapt: check the arguments with scw iam --help before running it.

Connect in CISAPP

1. Open My company → Connectors, then Connect on the Scaleway card.
2. Paste the access key (it starts with SCW) and the secret key.
3. Optionally list the projects (UUID identifiers) and the regions to analyze. Empty: every project the key can access and every region.
4. Verify the key: CISAPP tests access with Scaleway before saving anything.
5. Check the displayed Scaleway organization, then Connect. The first synchronization starts.

If you close the wizard before confirmation, the connection stays Pending: use Confirm the account from its record.

What CISAPP collects

CISAPP only reads configuration, never content:

• instances and their security groups, volumes;
• object storage buckets (configuration, not the objects), managed databases;
• load balancers, Kapsule clusters, Functions and Containers, container registries, private networks;
• IAM users and API keys (MFA status, expiration dates).

CISAPP never reads secrets (Secret Manager), environment variables, instance user data or the kubeconfig access file, and changes nothing in your organization. Resources appear in the Operational Safety → Cloud inventory menu entry and its Map view.

Posture findings

Findings appear in security findings with the Scaleway posture source. A rule only triggers when the information is certain: an unknown state (missing permission, product not granted) neither creates nor resolves a finding.

• Network: security group reachable from the whole Internet (0.0.0.0/0 or ::/0) on remote administration (SSH 22, RDP 3389) or on a common database port (3306, 5432, 6379, 27017…); inbound default policy set to "accept" on a group attached to a server; server with a public IP behind a permissive group.
• Databases: public access whose ACL allows 0.0.0.0/0, encryption at rest disabled, automatic backups disabled or no ready backup (a new database is flagged until its first backup), no high availability.
• Object storage: bucket whose ACL opens access to everyone (AllUsers) or to any authenticated user, versioning disabled or suspended.
• Load balancers: HTTP frontend (port 80) without a certificate, TLS level "old" on a load balancer that terminates TLS.
• Kubernetes: cluster to upgrade without automatic upgrade, open API (cluster ACL that explicitly allows 0.0.0.0/0 or ::/0; an empty ACL is not reported, and a private network does not make the API private).
• Functions, Containers and registries: public function or container (invocable without a token), public container registry.
• IAM: user without multi-factor authentication, API key without an expiration date or created more than 365 days ago.

The connection's own key is excluded from these rules and handled separately: without an expiration date it shows a warning on the record; less than 30 days before expiry, a Credentials expiring soon badge.

Replace the key (rotation)

1. Create a new API key for the same application, with an expiration date.
2. On the connection record, Update credentials and paste the new access key and secret key.
3. The new key must belong to the same Scaleway organization; otherwise it is refused and the current key is kept.
4. Then revoke the old key in the Scaleway console.

Projects and regions can be changed from the record (Edit), without re-entering the key. Removing a project or region from the connection removes its resources from the inventory at the next sync.

Common issues

Message	What to do
The Scaleway connector is unavailable on this instance	The connector is not configured on your platform yet: contact support.
Scaleway refused this API key	Check that the key is neither revoked nor expired and that the policy grants at least IAMReadOnly and ProjectReadOnly on the organization, in addition to the per-product read sets.
This Scaleway organization is already connected by another CISAPP organization	A Scaleway organization has a single connection: disconnect it from the other CISAPP organization first.
This API key belongs to another Scaleway organization	When rotating, use a key from the same Scaleway organization.
Expired or refused credentials	Create a new key and rotate it from the record.
Product "not granted"	Add the matching permission set to the application's policy.

Disconnect

Disconnect deletes the connection and its cloud inventory, and marks its posture findings as resolved. Then revoke the API key (and the application if it is no longer used) in IAM in the Scaleway console.

Expected result

The connection is active, the cloud inventory is populated and Scaleway posture findings appear in CISAPP.

See also: Configure connectors.