Understanding policy conditions
A condition is an additional layer of restrictions for your rule. Conditions let you allow access based on the IP address, user agent, or time of a request, or based on attributes of the resource being accessed.
At Scaleway, IAM conditions are defined using Common Expression Language (CEL) expressions.
Types of conditions
Scaleway IAM supports two types of conditions:
- Request-level conditions that control access based on the IP address, user agent, or time of the request.
- Resource-level conditions that control access based on attributes of the resource being accessed, such as its name, ID, or locality. These are only available for a limited set of products — see Products supporting resource-level conditions for details.
This page covers the concepts and Common Expression Language (CEL) syntax common to both types of conditions. For the variables, functions, and examples specific to each type, refer to the dedicated pages.
Condition expressions
An expression can be compared to a conditional statement in programming. It is a logical statement that evaluates to either true or false. The result determines whether the permission set defined in the rule is applied or not.
Condition expressions are composed of one or several statements that declare a rule based on attributes. An attribute is a property of the request, the resource being accessed, or the user making the request — for example, the time of the request, an IP address, or a resource's name.
Expressions at Scaleway are defined in CEL, which provides a human-readable and flexible method of creating conditions.
Common Expression Language
Common Expression Language is used to specify a IAM condition expression.
Expressions consist of one or more statements that declare an attribute-based control rule, and determine whether a permission applies.
IAM conditions use the following CEL features:
- Variables
- Operators and Logical Operators
- Functions
Variables
Conditions use variables to express attributes. Variables are populated with values based on the context at runtime. Which variables are available depends on the type of condition:
- Request-level variables (
request.ip,request.time,request.user_agent) are documented in Request-level conditions. - Resource-level variables (
resource.name,resource.id,resource.locality) are documented in Resource-level conditions.
Operators
Every data type, such as timestamp or string, supports a set of operators that can be used to create a logic expression.
Most commonly, operators are used to compare the value contained in a variable with a literal value.
For example, == is the operator in the following statement:
request.time == "2025-03-03T14:30:00.000Z"Refer to the official CEL syntax specification for the list of supported operators.
Logical operators
Conditions support three logical operators that can be used to build complex logic expressions from basic expression statements:
| Logical operator | Description | Example |
|---|---|---|
&& (AND) | Evaluates to true if both expressions are true. | request.time.getFullYear() < 2020 && request.ip == '10.154.3.1' |
|| (OR) | Evaluates to true if either expression is true. If the first expression is true, the second expression may not be evaluated. | request.time.getFullYear() < 2020 || request.ip == '10.154.3.1' |
! (NOT) | Evaluates to true if the expression is false, and false if the expression is true. | !(request.time.getFullYear() < 2020) |
Functions
A function is a compound operator for data types, that supports more complex operations. In condition expressions, predefined functions can be used with a given data type.
All standard CEL functions are supported. Some condition types also support custom Scaleway IAM functions — see the request-level conditions and resource-level conditions pages for details.
Important considerations
Multiple policies
If multiple policies with different conditions apply to the same principal, the presence of a single policy with met conditions (or no conditions) will override any denying rules from other policies, allowing the action to be taken.
For example, if you set up a policy that grants access to a resource only on Monday while another policy grants access only on Tuesday, the action will still be allowed on Monday. The access will be granted on both days.
Timezones
We recommend that you specify timezones when creating time-based conditions.
Refer to the official CEL specification for the correct syntax to express timezones in conditions.
Timestamps
Conditions based on timestamps might take up to a minute to be applied.
For example, if a user has permission to perform an action until 11am, they may be able to perform it until 11:01am.
IAM condition limitations
Currently, it is only possible to edit conditions in the console using the Code editor.
When creating a policy, you can define a simple condition expression with the help of the Visual builder. When editing, you must define the changes by writing them in CEL in the Code editor.