Skip to main content
Glama
logic-arts-official

scaleway-ops-mcp-server

Create Scaleway IAM Policy

scaleway_iam_create_policy

Create an IAM Policy that grants permission sets to an Application, User, or Group, scoped to specific Projects or the entire Organization. For Object Storage access, combine with a Bucket Policy.

Instructions

Create an IAM Policy granting permission sets to an Application/User/Group, scoped to specific Project(s) or the whole Organization. This is the PROJECT-WIDE half of access control - for Object Storage specifically, it grants access to every bucket in the Project(s); narrow to one bucket with a Bucket Policy (scaleway_s3_put_bucket_policy) as well. A Bucket Policy alone is NOT sufficient on Scaleway - both are required together for an Application to actually read/write a specific bucket. Call scaleway_iam_list_permission_sets first to get exact names and scope_types.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameYesPolicy name (max 64 chars, Scaleway API limit). Convention in this org: match the principal Application's own name 1:1 (e.g. Application 'dev-payments-files-rw' -> Policy 'dev-payments-files-rw'). When one Application genuinely needs two policies (Scaleway's rule scope_type restriction - see scaleway_iam_list_permission_sets), suffix the second with what it specifically adds, not a restatement of the app name.
rulesYesOne rule per scope_type needed. E.g. one rule with organization_id + ['IAMPolicyManager'], a second with project_ids + ['ObjectStorageFullAccess'].
user_idNo
group_idNo
descriptionNo
application_idNoAttach this policy to an Application. Omit application_id/user_id/group_id to create a policy with no principal yet.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate mutation (readOnlyHint=false) and non-idempotency (idempotentHint=false). The description adds context about the interplay with S3 bucket policies and the necessity to pre-fetch permission sets. It does not detail response format, error conditions, or required IAM permissions, but the annotations cover the basic behavior adequately.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with no fluff. Front-loaded with the core purpose, then branching into specific usage guidance and relationship to sibling tools. Each sentence adds distinct value, and the structure is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description does not explain return values or error handling. It does cover prerequisites (call list_permission_sets), inter-tool dependencies (S3 bucket policy), and parameter conventions. For a create operation with clear annotations, this is mostly complete but missing the output shape slightly reduces the score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (3/6 parameters lack schema descriptions). The description compensates by explaining the naming convention for `name`, the rule structure for `rules` (one rule per scope_type, mutual exclusivity of project_ids/organization_id), and mentions the principal parameters (user_id, group_id, application_id). However, the `description` parameter is not addressed, and schema descriptions for `user_id`/`group_id` are absent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create an IAM Policy' and specifies the resource, action, and scope. It distinguishes itself from the bucket-level sibling scaleway_s3_put_bucket_policy by explaining the project-wide vs. bucket-specific split. This is a specific verb-resource pairing that differentiates well among the many sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly guides when to use this tool ('project-wide half') vs. Bucket Policy for object storage, and warns that both are required. It instructs to call scaleway_iam_list_permission_sets first to obtain exact names and scope types. This provides clear context and exclusions for proper tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/logic-arts-official/scaleway-ops-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server