---
title: CEL conditions guide
description: Examples of functions and CEL expressions that you can use to set up conditions
tags: iam policy conditions cel
dates:
  posted: 2026-10-21
  validation: 2026-10-21
---

At Scaleway, IAM [conditions](/iam/policies-permissions/understanding-policy-conditions/) are defined using Common Expression Language (CEL) expressions.

This page is here to help you with CEL expressions, providing examples, guidance, and additional resources. 

As a reminder, you can refer to the [How to create a policy](/iam/policies-permissions/create-policy/) and [How to manage policies](/iam/policies-permissions/manage-policies/) documentation pages to learn where and how to specify a condition.

## General functions

| Function | Description | Example |
| :--- | :--- | :--- |
| `size` | Returns the size of a string (characters), bytes, a list, or a map. | `size("hello")` // `5` |
| `contains` | Returns whether a string contains a substring. | `"hello".contains("ell")` // `true` |
| `startsWith` | Returns whether a string starts with a prefix. | `"hello".startsWith("he")` // `true` |
| `endsWith` | Returns whether a string ends with a suffix. | `"hello".endsWith("lo")` // `true` |
| `matches` | Returns whether a string matches a RE2 regular expression. | `"123".matches(r"^\d+$")` // `true` |

## Time functions

| Function | Description | Example |
| :--- | :--- | :--- |
| `getDayOfMonth` | Returns the day of the month (1-31). | `timestamp("2026-07-23T00:00:00Z").getDayOfMonth()` // `23` |
| `getHours` | Returns the hours (0-23). | `duration("1h30m").getHours()` // `1` |
| `getMinutes` | Returns the minutes (0-59). | `duration("1h30m").getMinutes()` // `30` |

<Message type="note">
  You can pass a timezone as a parameter, such as `"America/New_York"` or `"Europe/Paris"`.
  
  Example: `resource.getHours("Europe/Paris")`.
  
  By default, the time returned is in UTC (e.g., `resource.getHours()`).
</Message>

## Network functions

| Function | Description | Example |
| :--- | :--- | :--- |
| `ip` | Parses a string into an IP address, or extracts the IP from a CIDR. | `ip("192.168.0.1")` or `cidr("192.168.0.0/24").ip()` |
| `isIP` | Checks if a string is a valid IP address. | `isIP("192.168.0.1")` // `true` |
| `cidr` | Parses a string into a CIDR block. | `cidr("192.168.0.0/24")` |
| `containsIP` | Checks if a CIDR block contains an IP address. | `cidr("192.168.0.0/24").containsIP(ip("192.168.0.1"))` // `true` |
| `family` | Returns the IP family (`4` for IPv4, `6` for IPv6). | `ip("192.168.0.1").family()` // `4` |
| `isUnspecified` | Checks if the IP is an unspecified address (e.g., `0.0.0.0`). | `ip("0.0.0.0").isUnspecified()` // `true` |

## Examples of CEL expressions

| Request | Description |
| :--- | :--- |
| `request.ip == "192.168.1.0" && request.time.getDayOfWeek() == 5 && resource.name.matches("prod")` | A certain IP requested on a Friday and has a resource name of `prod`. |
| `resource.name.startsWith("staging") && resource.locality.startsWith("fr-par")` | Check a resource name that starts with `staging` and is in the `fr-par` locality. |
| `(cidr('45.23.0.1/16').containsIP(request.ip) \|\| request.user_agent.contains("Test"))` | Check if the IP is within `45.23.0.0/16` or if the user agent contains `Test`. |

## Additional CEL resources

You can test and experiment with CEL functions interactively using the [CEL Playground](https://playcel.undistro.io/).

You can check the whole CEL official function reference list in [section "Core functions" of the CEL Function reference guide](https://cel.dev/reference/api-reference#3_core_functions).