CEL conditions guide
At Scaleway, IAM conditions are defined using Common Expression Language (CEL) expressions.
This page is here to help you with CEL expressions, providing examples, guidance, and additional resources.
As a reminder, you can refer to the How to create a policy and How to manage policies documentation pages to learn where and how to specify a condition.
General functions
| Function | Description | Example |
|---|---|---|
size | Returns the size of a string (characters), bytes, a list, or a map. | size("hello") // 5 |
contains | Returns whether a string contains a substring. | "hello".contains("ell") // true |
startsWith | Returns whether a string starts with a prefix. | "hello".startsWith("he") // true |
endsWith | Returns whether a string ends with a suffix. | "hello".endsWith("lo") // true |
matches | Returns whether a string matches a RE2 regular expression. | "123".matches(r"^\d+$") // true |
Time functions
| Function | Description | Example |
|---|---|---|
getDayOfMonth | Returns the day of the month (1-31). | timestamp("2026-07-23T00:00:00Z").getDayOfMonth() // 23 |
getHours | Returns the hours (0-23). | duration("1h30m").getHours() // 1 |
getMinutes | Returns the minutes (0-59). | duration("1h30m").getMinutes() // 30 |
Network functions
| Function | Description | Example |
|---|---|---|
ip | Parses a string into an IP address, or extracts the IP from a CIDR. | ip("192.168.0.1") or cidr("192.168.0.0/24").ip() |
isIP | Checks if a string is a valid IP address. | isIP("192.168.0.1") // true |
cidr | Parses a string into a CIDR block. | cidr("192.168.0.0/24") |
containsIP | Checks if a CIDR block contains an IP address. | cidr("192.168.0.0/24").containsIP(ip("192.168.0.1")) // true |
family | Returns the IP family (4 for IPv4, 6 for IPv6). | ip("192.168.0.1").family() // 4 |
isUnspecified | Checks if the IP is an unspecified address (e.g., 0.0.0.0). | ip("0.0.0.0").isUnspecified() // true |
Examples of CEL expressions
| Request | Description |
|---|---|
request.ip == "192.168.1.0" && request.time.getDayOfWeek() == 5 && resource.name.matches("prod") | A certain IP requested on a Friday and has a resource name of prod. |
resource.name.startsWith("staging") && resource.locality.startsWith("fr-par") | Check a resource name that starts with staging and is in the fr-par locality. |
(cidr('45.23.0.1/16').containsIP(request.ip) || request.user_agent.contains("Test")) | Check if the IP is within 45.23.0.0/16 or if the user agent contains Test. |
Additional CEL resources
You can test and experiment with CEL functions interactively using the CEL Playground (External link).
You can check the whole CEL official function reference list in section "Core functions" of the CEL Function reference guide (External link).
Still need help?Create a support ticket