feat(scaleway): add new provider#11166
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
github-actions
Bot
added
documentation
output/html
|
✅ Conflict Markers Resolved All conflict markers have been successfully resolved in this pull request. |
|
Please add an entry to the corresponding |
Compliance Mapping ReviewThis PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements. New checks not mapped to any compliance framework in this PR
Use the |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
🔒 Container Security ScanImage: 📊 Vulnerability Summary
3 package(s) affected
|
🔒 Container Security ScanImage: 📊 Vulnerability Summary
5 package(s) affected
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #11166 +/- ##
===========================================
+ Coverage 20.84% 87.19% +66.35%
===========================================
Files 854 1642 +788
Lines 24848 49927 +25079
===========================================
+ Hits 5180 43536 +38356
+ Misses 19668 6391 -13277
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Please use 15000 codes. 14000 are currently used by okta.
There was a problem hiding this comment.
Please divide authentication into a separate doc page, like for other providers.
| "AdditionalURLs": [ | ||
| "https://www.scaleway.com/en/docs/identity-and-access-management/iam/concepts/#root-account", | ||
| "https://www.scaleway.com/en/docs/identity-and-access-management/iam/how-to/create-api-keys/", | ||
| "https://www.scaleway.com/en/docs/identity-and-access-management/iam/reference-content/users-and-applications/" |
There was a problem hiding this comment.
Please remove this url since it does not exist.
| @@ -0,0 +1,38 @@ | |||
| { | |||
| "Provider": "scaleway", | |||
| "CheckID": "iam_no_root_api_keys", | |||
There was a problem hiding this comment.
I suggest you this checkID to match with the best practices:
| "CheckID": "iam_no_root_api_keys", | |
| "CheckID": "iam_api_keys_no_root_owned", |
There was a problem hiding this comment.
This, or something similar, is just to propose an alternative.
| "Terraform": "" | ||
| }, | ||
| "Recommendation": { | ||
| "Text": "Never use API keys owned by the account root user for automation. Create scoped IAM users or applications, attach the least-privilege policies, and rotate any existing root API keys to that new bearer.", |
| class _IAMDataUnavailableResource: | ||
| """Minimal stand-in resource used when the IAM service failed to load. | ||
|
|
||
| ``CheckReportScaleway`` derives ``resource_name``/``resource_id``/ | ||
| ``region``/``organization_id`` from the resource via ``getattr`` with | ||
| defaults, so this lightweight object is enough to materialize a | ||
| MANUAL finding without polluting the real domain models. | ||
| """ | ||
|
|
||
| def __init__(self, organization_id: str): | ||
| self.name = "iam-data-unavailable" | ||
| self.id = "iam-data-unavailable" | ||
| self.organization_id = organization_id | ||
| self.region = "global" |
There was a problem hiding this comment.
I personally wouldn't add this here. Please let me know what you think.
| type_: Optional[str] = None | ||
| status: Optional[str] = None | ||
| # Provide name/id for CheckReportScaleway | ||
| name: str = "" |
There was a problem hiding this comment.
Should we use username or name for that? Which difference is there between those 2?
|
|
||
| # All users in the same org share the same account_root_user_id. | ||
| if self.users and self.users[0].account_root_user_id: | ||
| self.account_root_user_id = self.users[0].account_root_user_id |
There was a problem hiding this comment.
Please pull account_root_user_id from provider.identity instead of self.users[0]. If the user list comes back empty the check would silently PASS on root keys.
| return "global" | ||
|
|
||
|
|
||
| class CheckReportScaleway(Check_Report): |
There was a problem hiding this comment.
Please add the @dataclass decorator here to match CheckReportOkta, CheckReportVercel and CheckReportCloudflare.
|
|
||
| return Connection(is_connected=True) | ||
|
|
||
| except ( |
There was a problem hiding this comment.
Please add ScalewayIdentityError to this except tuple. Otherwise the provider_id mismatch path gets re-wrapped as a generic auth error.
3 participants
Description
This PR adds the new Scaleway provider with the IAM service and the check
iam_no_root_api_keysSteps to review
Please add a detailed description of how to review this PR.
Checklist
Community Checklist
SDK/CLI
UI
API
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.