Scaleway

Scaleway Object Storage runs in European regions only: Paris (fr-par), Amsterdam (nl-ams), Warsaw (pl-waw) and Milan (it-mil).

Before you start

• A Scaleway organization and permission to manage IAM applications and policies.
• A project for the bucket. Scaleway grants Object Storage permissions per project, so we recommend a dedicated project that holds only the buckets you use with CloudFile.

1. Create the bucket

1. In the Scaleway console, switch to the project and go to Object Storage.
2. Create a bucket, pick its region, and keep its visibility private.
3. Leave versioning off. With versioning on, deleted and overwritten files are kept and billed.

2. Create an access key

Create an IAM application for CloudFile, give it Object Storage access in the bucket’s project, and create an API key for it.

1. Go to IAM → Applications and create an application, for example cloudfile. Don’t attach a policy yet.
2. Go to IAM → Policies and create a policy with the application as its principal.
3. Add a rule with access to resources in the bucket’s project only (not all projects), and these permission sets:
   • ObjectStorageObjectsRead (list and read objects)
   • ObjectStorageObjectsWrite (upload, including multipart uploads)
   • ObjectStorageObjectsDelete (delete, and abort multipart uploads)
4. Open the application, go to its API keys and generate a key. When asked for the preferred Project for Object Storage, pick the bucket’s project.
5. Copy the access key and secret key. The secret is shown only once.

Scaleway can’t limit an application’s permissions to one bucket: the rule covers every bucket in the project. A bucket policy can add per-bucket rules, but it doesn’t take away the application’s access to other buckets. Keeping CloudFile’s buckets in their own project is the clean way to scope the key.

3. Connect it

In CloudFile, go to Storage → Add bucket and choose Scaleway:

Click Test connection, then Save. To use the bucket, open a server and pick it under Settings → Storage.

Troubleshooting

• Writing a test file failed with a NoSuchBucket error. The API key’s preferred project isn’t the bucket’s project, or the region doesn’t match the bucket. Edit the API key to change its preferred project. Changes can take up to 5 minutes to apply.
• Writing a test file failed: Access Denied. The policy rule is missing ObjectStorageObjectsWrite, or it covers a different project. Policy changes can also take a few minutes to apply.
• Writing a test file failed: Access Denied on a bucket that has a bucket policy. Once a bucket has a policy, every principal needs to be allowed in it explicitly. Add the CloudFile application to the bucket policy, or remove the policy.
• Listing the bucket failed or Reading it back failed. ObjectStorageObjectsRead is missing from the rule.
• Deleting the test file failed. ObjectStorageObjectsDelete is missing from the rule.

See Your own bucket for how files are laid out in the bucket.