Create a Scaleway Audit Trail custom alert rule
scaleway_audit_create_custom_alert_ruleCreate a custom Audit Trail alert rule using a CEL expression to define match conditions, firing when a specified number of matching events occur within a defined evaluation window.
Instructions
Create a custom Audit Trail alert rule: a CEL expression evaluated against incoming audit events, firing when at least occurrences matching events land within evaluation_window. Metadata-only edits later via scaleway_audit_update_custom_alert_rule; the query itself cannot be changed in place - to change the logic, create a new rule and delete the old one. Needs more than AuditTrailReadOnly on THIS server's own credential (read-only covers just the query tools) - if the call fails with permissions_denied, grant the Audit Trail write permission set via scaleway_iam_set_policy_rules. CAVEAT (live-verified 2026-08-18): Scaleway documents the custom-alert-rules endpoints, but the deployed API (fr-par) returns HTTP 501 'unknown method' for every custom-alert-rules method - this tool is kept for when Scaleway implements them and currently surfaces that error verbatim. Don't retry on 501; the preconfigured rules via scaleway_audit_list_alert_rules are the working alternative today.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Name of the custom alert rule. | |
| query | Yes | CEL (Common Expression Language) expression defining the match, evaluated against incoming audit events. Scaleway does not document the full field surface here - an invalid expression is rejected by the API with the reason in the error message. | |
| region | No | Defaults to the server's configured region (fr-par). | |
| severity | No | Severity assigned to the alert. Default info. | |
| description | No | What this rule alerts on and why it exists. | |
| occurrences | Yes | Minimum number of matching events within the evaluation window required to trigger the alert. | |
| evaluation_window | No | How far back to look for matching events, as a duration string, e.g. "300s". Omit for the API default. |