> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.detectant.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.detectant.com/_mcp/server.

# Connect Scaleway Object Storage

Detectant connects to private Scaleway Object Storage buckets with a dedicated
IAM application and read-only API key. Supported regions are `fr-par`,
`nl-ams`, `pl-waw` and `it-mil`.

## Before you connect

1. Keep the bucket in a dedicated Scaleway Project. Object Storage IAM
   permissions apply across a Project, so this isolates the scanned storage
   from unrelated buckets.
2. Create a dedicated IAM application for Detectant.
3. Attach a policy granting `ObjectStorageObjectsRead` on that Project.
4. Generate an API key for the application and select the same Project as its
   **preferred Project for Object Storage**.
5. Save the access key and secret key when shown.

The preferred Project determines which Project the S3-compatible API key uses;
it does not grant permission by itself. New IAM policies can take up to five
minutes to apply.

As defense in depth, you can add a bucket policy that limits the application to
the selected bucket. Replace each placeholder and merge this statement into any
existing policy.

```json
{
  "Version": "2023-04-17",
  "Id": "DetectantReadOnly",
  "Statement": [
    {
      "Sid": "DetectantReadOnly",
      "Effect": "Allow",
      "Principal": {
        "SCW": "application_id:<APPLICATION_ID>"
      },
      "Action": ["s3:ListBucket", "s3:GetObject"],
      "Resource": ["<BUCKET>", "<BUCKET>/*"]
    }
  ]
}
```

Scaleway allows only one bucket policy per bucket; applying a new policy
overwrites the current one. For a prefix, replace the object resource with
`<BUCKET>/<PREFIX>/*` and ensure the application can list that prefix.

## Connect the bucket

In **Dashboard → Integrations**, choose **Add integration**, select
**Scaleway**, then enter the region, bucket, optional prefix, access key ID and
secret access key.

Choose **New files only** to inventory existing objects without scanning them.
Choose **Existing and new files** to preview the eligible existing-object count
and remaining monthly allowance. Existing objects are not released for scanning
until you confirm the preview.

Setup verifies listing access and, for a non-empty scope, object metadata and
content reads. Credentials are encrypted and never returned. Replacing
credentials verifies the new key before storing it and schedules an immediate
check.

## Monitoring behavior

Detectant checks the configured bucket or prefix every five minutes. New or
changed objects are scanned once; unchanged objects are not rescanned.
Directory-marker objects are ignored, and only the current object revision is
scanned.

* **Baselining:** Detectant is building the initial inventory.
* **Healthy:** The latest check completed. The dashboard shows the last and next
  check.
* **Temporary failure:** Detectant keeps the last successful check visible and
  retries with bounded backoff.
* **Credentials rejected:** Replace revoked, incorrect or insufficient
  credentials.
* **Object limit exceeded:** The scope exceeds 100,000 listed entries. Use a
  narrower prefix or bucket.
* **Allowance paused:** Queued scans resume at the next billing-period boundary
  without downloading object content first.

## Object size, storage classes and encryption

Storage objects can be up to **500 MB on Free** and **2 GB on paid plans**.
Larger objects are recorded as too large without being scanned. Detectant keeps
a temporary copy only for the duration of the scan.

Standard and provider-encrypted objects are read normally. SSE-KMS objects also
require `KeyManagerKeyDecrypt` for the dedicated application. SSE-C objects are
unsupported because Detectant does not accept customer-provided encryption
keys.

Glacier objects must be restored before they can be scanned. Detectant never
starts a restore or changes an object's storage class automatically.

## Rotate credentials

Generate a new API key for the same IAM application and preferred Project, then
use **Manage → Replace credentials** in Detectant. Revoke the old key only after
the replacement test succeeds.

## Troubleshooting

* Confirm the selected region matches the bucket.
* Confirm the API key's preferred Project contains the bucket.
* Confirm the IAM application has `ObjectStorageObjectsRead` on that Project.
* If a bucket policy exists, confirm it allows the application to list the
  bucket and read the configured object scope.
* Wait up to five minutes after changing an IAM policy.
* Add `KeyManagerKeyDecrypt` if listing works but SSE-KMS objects cannot be
  read.
* Restore Glacier objects before expecting them to scan.
* Check the plan's object-size limit, monthly allowance and **Last checked**
  status when an object is missing.

See Scaleway's guides for [Object Storage API keys](https://www.scaleway.com/en/docs/iam/api-cli/using-api-key-object-storage/),
[bucket policies](https://www.scaleway.com/en/docs/object-storage/api-cli/bucket-policy/)
and [SSE-KMS](https://www.scaleway.com/en/docs/object-storage/how-to/enable-sse-kms/).