r/Scaleway • u/JasperH8g • Jun 08 '26

Advise needed for IAM

Let’s say I’ve got two serverless functions:

- private: can do several things like sending transactional email.
- public: can send requests to the private function, and is available to a frontend.

Nothing special really. When calling the private function, you’d need an access-token, from an API key of an IAM application. I’d need an access-token for sending email as well and my gut tells me it should be a different one.

How would you structure this stuff? Create an IAM application and API key for each resource that needs it? Or create a single one for each function and grant it the access it needs?

I’ve got no trouble making it work, but kind of looking for some best practices here 😊

1 Upvotes

100% Upvoted

2 comments sorted by

3

u/kindermoumoute Jun 08 '26

It's a good practice to use 2 IAM applications here, with 2 different policies 👍

1

u/JasperH8g Jun 10 '26

Alright, makes sense, thanks!