How to connect a Scaleway project to AuditBadger with a dedicated read-only IAM application API key. Takes about 10 minutes.

---

## **1. Create the IAM application**

1. In the Scaleway console, open **IAM → Applications**.

2. Create an application named `auditbadger-compliance-reader`.

Do not use a personal (user-owned) API key — application keys are not tied to a human account and survive offboarding.

## **2. Create the read-only policy**

Open **IAM → Policies**, create a policy named `auditbadger-compliance-read-only` attached to the application, with two rule groups:

* Organization scope:

  * `OrganizationReadOnly`

  * `ProjectReadOnly`

  * `IAMReadOnly` (lets AuditBadger verify the key stays read-only)

  * `AuditTrailReadOnly` (optional — only if you want Audit Trail evidence)

* Project scope, limited to the project(s) you want monitored:

  * `InstancesReadOnly`

  * `BlockStorageReadOnly`

  * `ObjectStorageBucketsRead`

  * `RelationalDatabasesReadOnly`

  * `SecretManagerReadOnly`

* Project scope, optional — grant only the products you actually use:

  * `KubernetesReadOnly` (cluster posture; AuditBadger never downloads kubeconfig files)

  * `LoadBalancersReadOnly` (TLS and certificate posture)

  * `ContainerRegistryReadOnly` (namespace visibility; images are never pulled)

  * `VPCReadOnly` and `PrivateNetworksReadOnly` (network segmentation inventory)

Never grant `FullAccess`, `Manager`, `Write`, or `Delete` permission sets — AuditBadger detects them and blocks automated collection until they are removed. `AllProductsReadOnly` works but grants more read access than needed; AuditBadger will show a warning.

## **3. Generate the API key**

1. Open **IAM → API keys → Generate API key**.

2. Select the `auditbadger-compliance-reader` application as the bearer.

3. Prefer **no expiration** so evidence collection is not interrupted; rotate the key manually instead. If you do set an expiration, AuditBadger shows the date and warns before the key expires.

4. Copy the access key and the secret key — Scaleway shows the secret key only once.

## **4. Connect in AuditBadger**

1. Go to **Account Settings → Integrations → Scaleway**.

2. Fill in: label (e.g. "production"), organization ID, project ID, access key, secret key, and default region.

3. Save. AuditBadger validates the connection in the background, checks each product API, and verifies the read-only permission posture.

4. Once healthy, install evidence sources on your compliance controls (individually from a control, or in bulk via "Install evidence sources").

## **Key rotation**

1. Generate a new API key for the same IAM application in Scaleway.

2. On the integration page, open **Configuration**, paste the new access key and secret key, and save. Evidence sources and collected evidence are kept.

3. After AuditBadger re-validates, delete the old API key in Scaleway.

## **Troubleshooting**

* **"Write-capable permissions detected"** - the key's policy grants a write/full-access permission set. Replace the policy with the read-only sets above; collection stays blocked until fixed.

* **"Unrecognized permission set"** - Scaleway added a permission set AuditBadger doesn't know yet. Collection is blocked as a precaution; contact support.

* **"Permission verification incomplete"** - the key lacks `IAMReadOnly`, so AuditBadger cannot verify the policy. Collection still works, but the read-only posture is unverified.

* **A product shows "Permission denied"** - the project-scope rule is missing that product's read-only permission set, or the policy is scoped to a different project.

* **Audit Trail source shows "setup required"** - enable "Collect Audit Trail evidence" in the integration settings and grant `AuditTrailReadOnly`.