---
title: Auto-generated IAM resources
description: This page explains how and why Scaleway auto-generates some IAM resources.
tags: iam
dates:
  validation: 2025-08-05
---
import image from './assets/scaleway-iam-logs-k8s-example.webp'


Sometimes Scaleway might automatically generate IAM resources, such as applications, groups and policies.

This allows policies to be set up with specific product resources as principals. These policies are created by Scaleway and can be managed by users to ensure more access management of resource permissions.

Any time Scaleway automatically creates or deletes an IAM resource, you will see it on your IAM logs.

<Lightbox image={image} alt="Image showing IAM logs in the Scaleway console. The first two lines show a policy and group that were automatically created for a Kubernetes Kapsule cluster, respectively. The third and fourth line show a group and a policy that were deleted. In all cases, the logs indicate that the actions were performed by Scaleway." />

## Kubernetes Kapsule

Currently, auto-generated IAM resources only occur in Kubernetes Kapsule when a [cluster is created](/kubernetes/how-to/connect-cluster-kubectl).

Whenever a cluster is created, automatically so are:
    - An IAM group containing all the nodes in the cluster as IAM applications
      <Message type="note">
        The node IAM applications are not visible to users.
      </Message>
    - An IAM policy with default permission sets and the cluster group as a principal

The default policy cannot be edited by authorized users, only deleted by them.