---
title: Create an IAM policy
description: Guide to creating policies for access control in Scaleway IAM.
tags: policy
dates:
  validation: 2026-07-13
  posted: 2022-06-20
---
import Requirements from '@macros/iam/requirements.mdx'

import image from './assets/scaleway-iam-policy.webp'

An IAM [policy](/iam/policies-permissions/policy/) defines the permissions granted to users, groups, and applications within a given [Organization](/iam/concepts/glossary/#organization). Each policy consists of:
- a **principal**: the user, group, or application to which the policy applies
- one or more **IAM rules**: the rules that specify the permission sets granted to the principal and the scope to which they apply

<Lightbox image={image} alt="" />

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to perform actions in the intended Organization

1. In the side menu, click **IAM**. The **Users** tab of the [Identity and Access Management dashboard](https://console.scaleway.com/iam/users) opens.
2. In the **Policies** tab, click **Create policy**. The creation wizard opens.
3. Enter a **name** and a description for the policy.
4. Add a tag. Tags are key/value pairs that help you organize your policies.
    - You can assign up to 10 tags per user.
    - Tag values must be between 1 and 70 characters long, including `key` and `value`.
    - The same tag cannot be used twice.
5. Select a **principal** for your policy. The [principal](/iam/concepts/glossary/#principal) is the user, application, or group you want to grant permissions to.
    - Select **AllUsers** to grant the permissions to every user in your Organization.
    - Select **AllApps** to grant the permissions to every application in your Organization.
    <Message type="important">
      You can create a policy without a principal and attach one later, but the policy will have no effect until a principal is attached.<br/> A policy can only be attached to one principal at a time.
    </Message>
6. Create rules for the policy.<br/>
    Rules define what actions the attached principal can carry out within the Organization. When creating a rule, you first select the permission sets to apply, then set the scope within which they apply. You can also optionally add conditions to the rule. For more information, see [Understanding IAM policies](https://www.scaleway.com/en/docs/iam/policies-permissions/policy/).
7. Select the **permission sets** for the rule and click **Next**.<br/>
    You can select as many permission sets as you want. The principal will have the rights defined in these permission sets within the scope you select in the next step. See [Permission sets](/iam/policies-permissions/permission-sets/) for more information.
    - To give the principal permissions to view, create, edit, and/or delete [resources](/iam/concepts/glossary/#resource), select permission sets in **Resource management**.
    - To give the principal permissions to [Organization](/iam/concepts/glossary/#organization)-level features such as IAM, billing, support & abuse tickets, as well as project management, select permission sets in **Organization management**.
8. Select a **scope** for the rule and click **Next**.<br/>
    - Select **All projects** to grant the selected permissions on all projects.
    - Select **Specific projects** to grant the permissions on the specified projects only.
9. (Optional) Add one or more conditions to the rule. Refer to [Understanding policy conditions](/iam/policies-permissions/understanding-policy-conditions/) for details about how to write condition expressions, as well as examples of conditions.
    - **Resource-level conditions** let you scope the rule to specific resources, based on attributes such as the resource's name, ID, or locality. For more information, see [Resource-level conditions](/iam/policies-permissions/understanding-resource-level-conditions/).
    <Message type="note">
      Resource-level conditions are currently supported for a limited set of products only. Refer to [Products supporting resource-level conditions](/iam/policies-permissions/supported-products-resource-level/) to check availability before relying on this feature.
    </Message>
    - **Request-level conditions** let you give access to specific user agents or IP addresses, and allow actions to be performed only at certain dates and times. For more information, see [Request-level conditions](/iam/policies-permissions/understanding-request-level-conditions/).
10. Click **Confirm rule**. The rule, with its permission sets, scope, and any conditions, is added to the list of the policy's rules.<br/>
    You can edit <Icon name="edit" /> the rule by clicking the relevant button in the top right corner of the rule's summary.<br/>
    You can delete <Icon name="delete" /> the rule only if you have defined more than one rule.
11. Click **Add new rule** and repeat steps 7 to 10 as many times as required to add multiple rules to your policy.
12. Click **Create policy**.

    You are taken to the overview page of the newly-created policy.

    <Message type="note">
      The application of Object Storage permissions can take up to 5 minutes.
    </Message>