Connecting Scaleway read-only access

Factor Fifty connects a Scaleway Project as an environment using an IAM application's API key. This operational connection supports resource inventory, security evidence and inventory-based documentation. Scaleway onboarding is a private preview managed by Factor Fifty platform administrators.

Use two applications: FactorFifty-reader for operational access, and a separate Billing application for costs. A new personal Scaleway login is not needed for either connection.

Before you begin

You need the customer Organization ID, the Projects to connect, and a Scaleway operator who can create IAM applications, API keys and policies. The operator performs setup; Factor Fifty stores the application key, not the operator's login. See Scaleway's application guide.

Organization and Project IDs are different values, even when an Organization's initial Project happens to have the same ID. Record each from the appropriate Organization or Project in the Scaleway console.

Grant the read-only permissions

Create a policy with FactorFifty-reader as its application principal. Configure the following rules using the indicated scope.

Scope	Permission set	Purpose
Organization	ProjectReadOnly	Required: discover Projects and validate the connection
Organization	IAMReadOnly, AuditTrailReadOnly	Security evidence for IAM configuration and audit events
Each approved Project	InstancesReadOnly	Instance, IP and security-group configuration
Each approved Project	BlockStorageReadOnly	Block storage inventory
Each approved Project	VPCReadOnly, PrivateNetworksReadOnly	Network inventory
Each approved Project	KubernetesReadOnly, RelationalDatabasesReadOnly	Cluster and database security evidence
Each approved Project	KeyManagerReadOnly, SecretManagerReadOnly	Security evidence for key and secret configuration

ProjectReadOnly must be granted at Organization scope even when product access is limited to selected Projects. It discovers Project metadata; it does not grant access to resources inside those Projects. Product permissions alone do not provide discovery. These permission-set names and scopes follow Scaleway's reference.

For an inventory-only connection, grant the inventory rows plus ProjectReadOnly. Add the security rows when enabling security scans. Limit Project-scoped rules to the customer-approved Projects. Review the capabilities of each permission set before granting it; read-only permission can still expose sensitive configuration.

The reader application does not need billing permissions or management roles. See how to create a policy for the console procedure.

Create the application key

1. In the customer Organization, open IAM & API keys and create the FactorFifty-reader application.
2. Attach the policy above to that application.
3. Create an API key with the application as its bearer.
4. Save the Access Key and Secret Key securely, and record the key's expiry.

The secret is displayed when the key is created. Its permissions come from the application's policies. A preferred Project on the key does not replace the policy's scope. Follow Scaleway's API-key guide.

Connect in Factor Fifty

1. Open the customer, create or open a project whose provider is Scaleway, then open Manage credentials to reach Scaleway Connections.
2. Select + Add Scaleway Connection.
3. Enter the Organization ID, Access Key and Secret Key.
4. Select Test and discover Projects.
5. Choose the Scaleway Project, set the Factor Fifty environment name and environment type, and select Save connection.

For several Projects, select Import Projects. Enter the same reader credentials, select Discover Projects, choose Projects and environment types, then select Import Selected. Connected Projects are skipped, and each import receives its own result. A Factor Fifty Scaleway project uses one Organization.

A healthy connection test confirms Project discovery. It does not confirm that every service's inventory or security evidence is readable. Run collection for the environment and review its status and coverage. Missing permissions can produce partial inventory or unassessed security checks.

Rotate or disconnect

Create a replacement application key and use Rotate key on the connection. Test and save it before revoking the previous key in Scaleway. Update every operational connection that used the old key. Billing has its own credential and rotation procedure.

Removing the connection from Factor Fifty does not revoke the application key in Scaleway. Revoke unused keys or remove the application's policies when access is no longer required.

Troubleshooting

Symptom	Check
Project discovery returns 403	Organization-scoped ProjectReadOnly, the key's bearer and expiry, and the Organization ID
Discovery succeeds but inventory is partial	Product read-only rules on the selected Project
Security checks are unassessed	Security-specific Organization and Project permissions, plus supported evidence coverage
A Project is absent	The key's Organization and discovery policy; confirm the Project belongs to that Organization
New grants do not work immediately	Allow policy propagation, then test again

Resource names and inventory coverage depend on the provider data available to Factor Fifty. Rightsizing may require separate regional Cockpit query tokens; the reader key alone does not configure metrics access.