Request-level conditions
Request-level conditions let you restrict a rule based on attributes of the request itself: the IP address it comes from, its user agent, or the time it is made.
Request-level conditions are built using CEL expressions. See Understanding policy conditions for the general concepts, operators, and logical operators shared by all condition types.
Variables
| Name | Type | Description |
|---|---|---|
request.ip | String | The IP address of the request. |
request.time | google.protobuf.Timestamp | The time of the request. Represented as a Protobuf object, allowing usage with associated functions. |
request.user_agent | String | The user-agent of the request. Truncated at 255 characters max. |
Functions
In addition to the standard CEL functions, the following custom Scaleway IAM function is available for request-level conditions:
| Function | Description | Parameters |
|---|---|---|
inIpRange(IP: string, Subnet: string) | Checks if the IP address is included in the IP subnet. | IP: (String) The IP address to check. Subnet: (String) The IP subnet to check against. |
Expression examples
User-agent conditions
In the example below we check if the user-agent contains the term "Terraform":
request.user_agent.contains("terraform/")Time conditions
To only allow actions within a specific time slot, you can use the following expression:
request.time.getDayOfWeek() != 0 && request.time.getDayOfWeek() != 6
&& request.time.getHours("Europe/Paris") < 17
&& request.time.getHours("Europe/Paris") > 8In this example, we use weekdays from 8 AM to 5 PM as a timestamp.
To only allow requests that were performed over the weekend, you can use the following expression:
request.time.getDayOfWeek() != 0 && request.time.getDayOfWeek() != 6