# Connect a Scaleway organization

Create a read-only Scaleway API key to inventory cloud resources and report security posture findings.

> **Access:** organization administrator. **Beta** feature; the connector must be enabled on your platform.

## Prerequisites

- Be an organization administrator in CISAPP.
- Be able to create an application, a policy and an API key in the **IAM** of the target Scaleway organization (owner or equivalent rights).
- A Scaleway organization can only be connected to **one** CISAPP organization.

## Create the access in Scaleway

CISAPP never uses your personal account: create a dedicated, read-only **IAM application**.

1. In the Scaleway console, **IAM → Applications**: create an application (for example `cisapp-readonly`).
2. **IAM → Policies**: create a policy for this application with exactly the permission sets below.
3. **IAM → API keys**: create an API key for the application, with an **expiration date** (recommended). Note the **access key** and the **secret key**.

### Permission sets to grant

| Scope | Permission sets |
| --- | --- |
| Projects to analyze | `InstancesReadOnly`, `ObjectStorageBucketsRead`, `RelationalDatabasesReadOnly`, `LoadBalancersReadOnly`, `VPCReadOnly`, `KubernetesReadOnly`, `FunctionsReadOnly`, `ContainersReadOnly`, `ContainerRegistryReadOnly`, `BlockStorageReadOnly` |
| Organization | `IAMReadOnly`, `ProjectReadOnly` |

If a product is not granted, CISAPP reports it as "not granted" in the synchronization and analyzes the rest. Grant the permission sets on **every project** of the organization, or restrict the connection to the granted projects with the **Projects** field: otherwise projects without these permissions are reported as not collected at every synchronization.

**Never grant** `SecretManagerSecretAccess`, any `*FullAccess` or `*Manager` set, `BillingReadOnly` or `AllProductsReadOnly`: CISAPP does not need them.

> Scaleway shows the secret key only **once**. CISAPP stores it encrypted and never displays it again.

The CISAPP wizard also offers a collapsible guide with a command-line example (`scw iam …`). It is an example to adapt: check the arguments with `scw iam --help` before running it.

## Connect in CISAPP

1. Open **My company → Connectors**, then **Connect** on the Scaleway card.
2. Paste the **access key** (it starts with `SCW`) and the **secret key**.
3. Optionally list the **projects** (UUID identifiers) and the **regions** to analyze. Empty: every project the key can access and every region.
4. **Verify the key**: CISAPP tests access with Scaleway before saving anything.
5. Check the displayed **Scaleway organization**, then **Connect**. The first synchronization starts.

If you close the wizard before confirmation, the connection stays **Pending**: use **Confirm the account** from its record.

## What CISAPP collects

CISAPP only reads **configuration**, never content:

- instances and their security groups, volumes;
- object storage buckets (configuration, not the objects), managed databases;
- load balancers, Kapsule clusters, Functions and Containers, container registries, private networks;
- IAM users and API keys (MFA status, expiration dates).

CISAPP never reads secrets (Secret Manager), environment variables, instance user data or the `kubeconfig` access file, and changes nothing in your organization. Resources appear in the **Operational Safety → Cloud inventory** menu entry and its **Map** view.

## Posture findings

Findings appear in security findings with the **Scaleway posture** source. A rule only triggers when the information is certain: an unknown state (missing permission, product not granted) neither creates nor resolves a finding.

- **Network**: security group reachable from the whole Internet (0.0.0.0/0 or ::/0) on remote administration (SSH 22, RDP 3389) or on a common database port (3306, 5432, 6379, 27017…); inbound default policy set to "accept" on a group attached to a server; server with a public IP behind a permissive group.
- **Databases**: public access whose ACL allows 0.0.0.0/0, encryption at rest disabled, automatic backups disabled or no ready backup (a new database is flagged until its first backup), no high availability.
- **Object storage**: bucket whose ACL opens access to everyone (`AllUsers`) or to any authenticated user, versioning disabled or suspended.
- **Load balancers**: HTTP frontend (port 80) without a certificate, TLS level "old" on a load balancer that terminates TLS.
- **Kubernetes**: cluster to upgrade without automatic upgrade, open API (cluster ACL that explicitly allows 0.0.0.0/0 or ::/0; an empty ACL is not reported, and a private network does not make the API private).
- **Functions, Containers and registries**: public function or container (invocable without a token), public container registry.
- **IAM**: user without multi-factor authentication, API key without an expiration date or created more than 365 days ago.

The connection's own key is excluded from these rules and handled separately: without an expiration date it shows a warning on the record; less than 30 days before expiry, a **Credentials expiring soon** badge.

## Replace the key (rotation)

1. Create a new API key for the same application, with an expiration date.
2. On the connection record, **Update credentials** and paste the new access key and secret key.
3. The new key must belong to the **same Scaleway organization**; otherwise it is refused and the current key is kept.
4. Then revoke the old key in the Scaleway console.

Projects and regions can be changed from the record (**Edit**), without re-entering the key. Removing a project or region from the connection removes its resources from the inventory at the next sync.

## Common issues

| Message | What to do |
| --- | --- |
| The Scaleway connector is unavailable on this instance | The connector is not configured on your platform yet: contact support. |
| Scaleway refused this API key | Check that the key is neither revoked nor expired and that the policy grants at least `IAMReadOnly` and `ProjectReadOnly` on the organization, in addition to the per-product read sets. |
| This Scaleway organization is already connected by another CISAPP organization | A Scaleway organization has a single connection: disconnect it from the other CISAPP organization first. |
| This API key belongs to another Scaleway organization | When rotating, use a key from the same Scaleway organization. |
| Expired or refused credentials | Create a new key and rotate it from the record. |
| Product "not granted" | Add the matching permission set to the application's policy. |

## Disconnect

**Disconnect** deletes the connection and its cloud inventory, and marks its posture findings as resolved. Then revoke the API key (and the application if it is no longer used) in **IAM** in the Scaleway console.

## Expected result

The connection is active, the cloud inventory is populated and Scaleway posture findings appear in CISAPP.

See also: [Configure connectors](https://docs.cisapp.eu/en/organization/connectors).