Connect a Scaleway project

This page describes the API key to create so that a Scaleway project is inventoried, the IAM policies to attach to it, and what the collector reads.

What you need

An IAM application in your Scaleway organisation, an API key generated for that application ("Access Key" and "Secret Key"), and the id of the project to analyse. One Ctadel account corresponds to one project; the same key may serve several accounts if its policy covers several projects.

IAM policies are read at organisation level; at the start of each scan, the collector finds the key's organisation through the IAM API or, failing that, through the project.

IAM policies to grant

Attach to the application a policy made of the following permission sets:

Permission set	What it gives
AllProductsReadOnly	Read access to every product: instances, Elastic Metal servers, Object Storage, databases, Kapsule, containers and functions, networks, load balancers, registries, Key Manager, Secret Manager, domains.
IAMReadOnly	The organisation's users, applications, groups and API keys.
OrganizationReadOnly	The list of IAM policies, which is read at organisation level.

Content analyses

Each needs write permissions on top of read access; without them, that analysis is absent and the rest works.

Analysis	Permissions to grant	What Ctadel does
Instance disks	InstancesFullAccess on the project.	A snapshot of the volume is mounted on a temporary scanner server created in the project, tagged ctadel-scanner and ephemeral, with a security group that accepts only port 22 from the egress address of your Ctadel instance. Without that known address, the scan fails rather than opening the port. The server, its security group and the snapshot are deleted afterwards.
Managed databases	Clone, user creation and deletion rights on Database instances.	The instance is cloned as ctadel-dspm-clone-<timestamp>, a user is created on the clone, the data is read, then the clone is deleted. The original instance is not modified.
Object Storage buckets	Covered by AllProductsReadOnly.	Objects are read through the S3 interface with the same API key.
Kapsule clusters	Covered by AllProductsReadOnly.	The cluster's kubeconfig is fetched through the Kapsule API, then the cluster objects are read.

Declaring the project in Ctadel

1. Open "Settings", tab "Integrations", sub-tab "Cloud Providers", then "Add account" on the Scaleway row.
2. Enter a "Label", the "Access Key" and the "Secret Key".
3. Click "Discover": Ctadel lists the organisation's projects with the entered key. A refused key returns the API's error.
4. Pick the project, or click "Add the N accounts" to create one account per discovered project.
5. Click "Create".

What the collector reads

The inventory covers every Scaleway region and zone. If reading one resource family fails, the others are inventoried; the resources of that family already known stay in the inventory and are not treated as deleted.

Family	Resources read
Identities	The organisation's users, applications, groups and API keys; IAM policies and their rules.
Compute	Instances and their private addresses (through the IPAM API), volumes, snapshots, security groups, Elastic Metal servers, Serverless containers and functions, container registries.
Network	Private VPCs, public gateways, flexible IPs, load balancers, DNS domains.
Data	Object Storage buckets and their posture (read through the S3 interface), Database instances and their access rules.
Kubernetes	Kapsule clusters, their pools and their access rules.
Secrets and keys	Secret Manager secrets, Key Manager keys.

Each resource is attached to its project, whose name, description and organisation are read through the Account API.

Limitations

• If the key can read neither its own IAM metadata nor the project through the Account API, the organisation stays unknown and IAM policies are not listed; the form does not let you enter the organisation id by hand.
• Instance private addresses come from the IPAM API; if that call fails in a zone, the instances of that zone have no private address.
• The algorithm of a Key Manager key is derived from its usage, as the API does not expose it directly.
• A bucket whose region cannot be determined, a Database instance whose access rules cannot be read, or a Kapsule cluster whose pools or access rules cannot be read, is skipped for the current scan.
• Access to a Kapsule cluster's objects goes through the kubeconfig the API delivers, not through a read-only identity.
• The scanner server is created in the analysed project, not in a separate one.
• Detection on Audit Trail is under internal validation, not available to customers.