Integration guides

Connect Scaleway Object Storage

Detectant connects to private Scaleway Object Storage buckets with a dedicated IAM application and read-only API key. Supported regions are fr-par, nl-ams, pl-waw and it-mil.

Before you connect

  1. Keep the bucket in a dedicated Scaleway Project. Object Storage IAM permissions apply across a Project, so this isolates the scanned storage from unrelated buckets.
  2. Create a dedicated IAM application for Detectant.
  3. Attach a policy granting ObjectStorageObjectsRead on that Project.
  4. Generate an API key for the application and select the same Project as its preferred Project for Object Storage.
  5. Save the access key and secret key when shown.

The preferred Project determines which Project the S3-compatible API key uses; it does not grant permission by itself. New IAM policies can take up to five minutes to apply.

As defense in depth, you can add a bucket policy that limits the application to the selected bucket. Replace each placeholder and merge this statement into any existing policy.

1{
2  "Version": "2023-04-17",
3  "Id": "DetectantReadOnly",
4  "Statement": [
5    {
6      "Sid": "DetectantReadOnly",
7      "Effect": "Allow",
8      "Principal": {
9        "SCW": "application_id:<APPLICATION_ID>"
10      },
11      "Action": ["s3:ListBucket", "s3:GetObject"],
12      "Resource": ["<BUCKET>", "<BUCKET>/*"]
13    }
14  ]
15}

Scaleway allows only one bucket policy per bucket; applying a new policy overwrites the current one. For a prefix, replace the object resource with <BUCKET>/<PREFIX>/* and ensure the application can list that prefix.

Connect the bucket

In Dashboard → Integrations, choose Add integration, select Scaleway, then enter the region, bucket, optional prefix, access key ID and secret access key.

Choose New files only to inventory existing objects without scanning them. Choose Existing and new files to preview the eligible existing-object count and remaining monthly allowance. Existing objects are not released for scanning until you confirm the preview.

Setup verifies listing access and, for a non-empty scope, object metadata and content reads. Credentials are encrypted and never returned. Replacing credentials verifies the new key before storing it and schedules an immediate check.

Monitoring behavior

Detectant checks the configured bucket or prefix every five minutes. New or changed objects are scanned once; unchanged objects are not rescanned. Directory-marker objects are ignored, and only the current object revision is scanned.

  • Baselining: Detectant is building the initial inventory.
  • Healthy: The latest check completed. The dashboard shows the last and next check.
  • Temporary failure: Detectant keeps the last successful check visible and retries with bounded backoff.
  • Credentials rejected: Replace revoked, incorrect or insufficient credentials.
  • Object limit exceeded: The scope exceeds 100,000 listed entries. Use a narrower prefix or bucket.
  • Allowance paused: Queued scans resume at the next billing-period boundary without downloading object content first.

Object size, storage classes and encryption

Storage objects can be up to 500 MB on Free and 2 GB on paid plans. Larger objects are recorded as too large without being scanned. Detectant keeps a temporary copy only for the duration of the scan.

Standard and provider-encrypted objects are read normally. SSE-KMS objects also require KeyManagerKeyDecrypt for the dedicated application. SSE-C objects are unsupported because Detectant does not accept customer-provided encryption keys.

Glacier objects must be restored before they can be scanned. Detectant never starts a restore or changes an object’s storage class automatically.

Rotate credentials

Generate a new API key for the same IAM application and preferred Project, then use Manage → Replace credentials in Detectant. Revoke the old key only after the replacement test succeeds.

Troubleshooting

  • Confirm the selected region matches the bucket.
  • Confirm the API key’s preferred Project contains the bucket.
  • Confirm the IAM application has ObjectStorageObjectsRead on that Project.
  • If a bucket policy exists, confirm it allows the application to list the bucket and read the configured object scope.
  • Wait up to five minutes after changing an IAM policy.
  • Add KeyManagerKeyDecrypt if listing works but SSE-KMS objects cannot be read.
  • Restore Glacier objects before expecting them to scan.
  • Check the plan’s object-size limit, monthly allowance and Last checked status when an object is missing.

See Scaleway’s guides for Object Storage API keys, bucket policies and SSE-KMS.