feat(object): add support for IAM Access Key syntax (#4543)

remyleone · kindermoumoute · estellesoulard · web-flow · commit 2d7cecfb9dc1 · 2026-04-03T08:07:49.000Z
Co-authored-by: Olivier Cano &lt;kindermoumoute@users.noreply.github.com&gt;
Co-authored-by: Estelle Soulard &lt;esoulard@scaleway.com&gt;
diff --git a/cmd/scw/testdata/test-all-usage-object-config-get-usage.golden b/cmd/scw/testdata/test-all-usage-object-config-get-usage.golden
@@ -18,6 +18,7 @@ EXAMPLES:
 ARGS:
   type              Type of S3 tool you want to generate a config for (rclone | s3cmd | mc)
   [name=scaleway]   Name of the s3 remote you want to generate
+  [project-id]      Scaleway project ID to use with IAM Access Key syntax
   [region=fr-par]   Region to target. If none is passed will use default region from the config (fr-par | nl-ams)
 
 FLAGS:
diff --git a/cmd/scw/testdata/test-all-usage-object-config-install-usage.golden b/cmd/scw/testdata/test-all-usage-object-config-install-usage.golden
@@ -18,6 +18,7 @@ EXAMPLES:
 ARGS:
   type              Type of S3 tool you want to generate a config for (rclone | s3cmd | mc)
   [name=scaleway]   Name of the s3 remote you want to generate
+  [project-id]      Scaleway project ID to use with IAM Access Key syntax
   [region=fr-par]   Region to target. If none is passed will use default region from the config (fr-par | nl-ams)
 
 FLAGS:
diff --git a/docs/commands/object.md b/docs/commands/object.md
@@ -146,6 +146,7 @@ scw object config get [arg=value ...]
 |------|---|-------------|
 | type | Required<br />One of: `rclone`, `s3cmd`, `mc` | Type of S3 tool you want to generate a config for |
 | name | Default: `scaleway` | Name of the s3 remote you want to generate |
+| project-id |  | Scaleway project ID to use with IAM Access Key syntax |
 | region | Default: `fr-par`<br />One of: `fr-par`, `nl-ams` | Region to target. If none is passed will use default region from the config |
 
 
@@ -187,6 +188,7 @@ scw object config install [arg=value ...]
 |------|---|-------------|
 | type | Required<br />One of: `rclone`, `s3cmd`, `mc` | Type of S3 tool you want to generate a config for |
 | name | Default: `scaleway` | Name of the s3 remote you want to generate |
+| project-id |  | Scaleway project ID to use with IAM Access Key syntax |
 | region | Default: `fr-par`<br />One of: `fr-par`, `nl-ams` | Region to target. If none is passed will use default region from the config |
 
 
diff --git a/internal/namespaces/config/testdata/test-config-get-command-profile.cassette.yaml b/internal/namespaces/config/testdata/test-config-get-command-profile.cassette.yaml
@@ -0,0 +1,35 @@
+---
+version: 1
+interactions:
+- request:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    form: {}
+    headers:
+      User-Agent:
+      - scaleway-sdk-go/v1.0.0-beta.7+dev (go1.26.1; linux; amd64) cli-e2e-test
+    url: https://api.scaleway.com/iam/v1alpha1/api-keys/SCW2RRD4GEWP546QJ71C
+    method: GET
+  response:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    headers:
+      Content-Length:
+      - "390"
+      Content-Security-Policy:
+      - default-src 'none'; frame-ancestors 'none'
+      Content-Type:
+      - application/json
+      Date:
+      - Thu, 02 Apr 2026 14:31:23 GMT
+      Server:
+      - Scaleway API Gateway (fr-par-1;edge02)
+      Strict-Transport-Security:
+      - max-age=63072000
+      X-Content-Type-Options:
+      - nosniff
+      X-Frame-Options:
+      - DENY
+      X-Request-Id:
+      - c6a06de4-d669-4faf-92de-9ae304c7228d
+    status: 200 OK
+    code: 200
+    duration: ""
diff --git a/internal/namespaces/config/testdata/test-config-get-command-simple.cassette.yaml b/internal/namespaces/config/testdata/test-config-get-command-simple.cassette.yaml
@@ -0,0 +1,35 @@
+---
+version: 1
+interactions:
+- request:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    form: {}
+    headers:
+      User-Agent:
+      - scaleway-sdk-go/v1.0.0-beta.7+dev (go1.26.1; linux; amd64) cli-e2e-test
+    url: https://api.scaleway.com/iam/v1alpha1/api-keys/SCW2RRD4GEWP546QJ71C
+    method: GET
+  response:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    headers:
+      Content-Length:
+      - "390"
+      Content-Security-Policy:
+      - default-src 'none'; frame-ancestors 'none'
+      Content-Type:
+      - application/json
+      Date:
+      - Thu, 02 Apr 2026 14:31:23 GMT
+      Server:
+      - Scaleway API Gateway (fr-par-1;edge02)
+      Strict-Transport-Security:
+      - max-age=63072000
+      X-Content-Type-Options:
+      - nosniff
+      X-Frame-Options:
+      - DENY
+      X-Request-Id:
+      - 57113c83-37d3-443c-ae55-df2a61401fce
+    status: 200 OK
+    code: 200
+    duration: ""
diff --git a/internal/namespaces/config/testdata/test-config-get-command-telemetry.cassette.yaml b/internal/namespaces/config/testdata/test-config-get-command-telemetry.cassette.yaml
@@ -0,0 +1,35 @@
+---
+version: 1
+interactions:
+- request:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    form: {}
+    headers:
+      User-Agent:
+      - scaleway-sdk-go/v1.0.0-beta.7+dev (go1.26.1; linux; amd64) cli-e2e-test
+    url: https://api.scaleway.com/iam/v1alpha1/api-keys/SCW2RRD4GEWP546QJ71C
+    method: GET
+  response:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    headers:
+      Content-Length:
+      - "390"
+      Content-Security-Policy:
+      - default-src 'none'; frame-ancestors 'none'
+      Content-Type:
+      - application/json
+      Date:
+      - Thu, 02 Apr 2026 14:31:23 GMT
+      Server:
+      - Scaleway API Gateway (fr-par-1;edge02)
+      Strict-Transport-Security:
+      - max-age=63072000
+      X-Content-Type-Options:
+      - nosniff
+      X-Frame-Options:
+      - DENY
+      X-Request-Id:
+      - 37aaafb3-027a-4deb-9fce-52f668750686
+    status: 200 OK
+    code: 200
+    duration: ""
diff --git a/internal/namespaces/config/testdata/test-config-get-command-unknown-profile.cassette.yaml b/internal/namespaces/config/testdata/test-config-get-command-unknown-profile.cassette.yaml
@@ -0,0 +1,35 @@
+---
+version: 1
+interactions:
+- request:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    form: {}
+    headers:
+      User-Agent:
+      - scaleway-sdk-go/v1.0.0-beta.7+dev (go1.26.1; linux; amd64) cli-e2e-test
+    url: https://api.scaleway.com/iam/v1alpha1/api-keys/SCW2RRD4GEWP546QJ71C
+    method: GET
+  response:
+    body: '{"access_key":"SCW2RRD4GEWP546QJ71C","secret_key":null,"description":"my-key","created_at":"2026-04-02T14:31:06.008718Z","updated_at":"2026-04-02T14:31:06.008718Z","expires_at":"2026-04-02T15:31:05.899Z","default_project_id":"5ebc0159-7cb7-406c-9521-9347d1987fb2","editable":true,"deletable":true,"managed":false,"creation_ip":"51.159.73.9","user_id":"fe7ad43d-91bc-4206-a4b9-f9d4150eafef"}'
+    headers:
+      Content-Length:
+      - "390"
+      Content-Security-Policy:
+      - default-src 'none'; frame-ancestors 'none'
+      Content-Type:
+      - application/json
+      Date:
+      - Thu, 02 Apr 2026 14:31:23 GMT
+      Server:
+      - Scaleway API Gateway (fr-par-1;edge02)
+      Strict-Transport-Security:
+      - max-age=63072000
+      X-Content-Type-Options:
+      - nosniff
+      X-Frame-Options:
+      - DENY
+      X-Request-Id:
+      - 6a824b28-e70e-4df3-a171-2b264bc8c9d7
+    status: 200 OK
+    code: 200
+    duration: ""
diff --git a/internal/namespaces/object/v1/custom_config_get.go b/internal/namespaces/object/v1/custom_config_get.go
@@ -12,9 +12,10 @@ import (
 
 func configGetCommand() *core.Command {
 	type getArgs struct {
-		Region scw.Region
-		Type   s3tool
-		Name   string
+		Region    scw.Region
+		Type      s3tool
+		Name      string
+		ProjectID string
 	}
 
 	return &core.Command{
@@ -37,6 +38,12 @@ func configGetCommand() *core.Command {
 				Required: false,
 				Default:  core.DefaultValueSetter("scaleway"),
 			},
+			{
+				Name:         "project-id",
+				Short:        "Scaleway project ID to use with IAM Access Key syntax",
+				Required:     false,
+				ValidateFunc: core.ValidateProjectID(),
+			},
 			core.RegionArgSpec(scw.RegionFrPar, scw.RegionNlAms),
 		},
 		Examples: []*core.Example{
@@ -62,7 +69,7 @@ func configGetCommand() *core.Command {
 		Run: func(ctx context.Context, argsI any) (any, error) {
 			args := argsI.(*getArgs)
 
-			config, err := newS3Config(ctx, args.Region, args.Name)
+			config, err := newS3Config(ctx, args.Region, args.Name, args.ProjectID)
 			if err != nil {
 				return "", err
 			}
diff --git a/internal/namespaces/object/v1/custom_config_get_test.go b/internal/namespaces/object/v1/custom_config_get_test.go
@@ -16,6 +16,7 @@ func Test_ConfigGet(t *testing.T) {
 			"11111111-1111-1111-1111-111111111111",
 		),
 		scw.WithDefaultOrganizationID("11111111-1111-1111-1111-111111111111"),
+		scw.WithDefaultProjectID("11111111-1111-1111-1111-111111111111"),
 		scw.WithDefaultZone(scw.ZoneFrPar1),
 		scw.WithDefaultRegion(scw.RegionFrPar),
 	)
diff --git a/internal/namespaces/object/v1/custom_config_install.go b/internal/namespaces/object/v1/custom_config_install.go
@@ -16,9 +16,10 @@ import (
 
 func configInstallCommand() *core.Command {
 	type installArgs struct {
-		Region scw.Region
-		Type   s3tool
-		Name   string
+		Region    scw.Region
+		Type      s3tool
+		Name      string
+		ProjectID string
 	}
 
 	return &core.Command{
@@ -41,6 +42,12 @@ func configInstallCommand() *core.Command {
 				Required: false,
 				Default:  core.DefaultValueSetter("scaleway"),
 			},
+			{
+				Name:         "project-id",
+				Short:        "Scaleway project ID to use with IAM Access Key syntax",
+				Required:     false,
+				ValidateFunc: core.ValidateProjectID(),
+			},
 			core.RegionArgSpec(scw.RegionFrPar, scw.RegionNlAms),
 		},
 		Examples: []*core.Example{
@@ -67,7 +74,7 @@ func configInstallCommand() *core.Command {
 		Run: func(ctx context.Context, argsI any) (any, error) {
 			args := argsI.(*installArgs)
 
-			config, err := newS3Config(ctx, args.Region, args.Name)
+			config, err := newS3Config(ctx, args.Region, args.Name, args.ProjectID)
 			if err != nil {
 				return "", err
 			}
diff --git a/internal/namespaces/object/v1/custom_config_install_test.go b/internal/namespaces/object/v1/custom_config_install_test.go
@@ -18,6 +18,7 @@ func Test_ConfigInstall(t *testing.T) {
 			"11111111-1111-1111-1111-111111111111",
 		),
 		scw.WithDefaultOrganizationID("11111111-1111-1111-1111-111111111111"),
+		scw.WithDefaultProjectID("11111111-1111-1111-1111-111111111111"),
 		scw.WithDefaultZone(scw.ZoneFrPar1),
 		scw.WithDefaultRegion(scw.RegionFrPar),
 	)
diff --git a/internal/namespaces/object/v1/s3configfile.go b/internal/namespaces/object/v1/s3configfile.go
@@ -37,6 +37,7 @@ type s3config struct {
 	Region    scw.Region
 	Name      string
 	ctx       context.Context
+	ProjectID string
 }
 
 const (
@@ -81,22 +82,39 @@ server_side_encryption =
 storage_class =
 `
 
-func newS3Config(ctx context.Context, region scw.Region, name string) (s3config, error) {
+func newS3Config(
+	ctx context.Context,
+	region scw.Region,
+	name string,
+	projectID string,
+) (s3config, error) {
 	client := core.ExtractClient(ctx)
 	accessKey, accessExists := client.GetAccessKey()
 	if !accessExists {
 		return s3config{}, errors.New("no access key found")
 	}
+
 	secretKey, secretExists := client.GetSecretKey()
 	if !secretExists {
 		return s3config{}, errors.New("no secret key found")
 	}
+
+	// Use provided projectID if available, otherwise fall back to client's default project ID
+	if projectID == "" {
+		projectID, _ = client.GetDefaultProjectID()
+	}
+
+	if projectID != "" {
+		accessKey += "@" + projectID
+	}
+
 	config := s3config{
 		AccessKey: accessKey,
 		SecretKey: secretKey,
 		Region:    region,
 		Name:      name,
 		ctx:       ctx,
+		ProjectID: projectID,
 	}
 
 	return config, nil
@@ -144,6 +162,7 @@ func (c s3config) getConfigFile(tool s3tool) (core.RawResult, error) {
 			AccessKey string `json:"accessKey"`
 			SecretKey string `json:"secretKey"`
 			API       string `json:"api"`
+			ProjectID string `json:"projectID"`
 		}
 		m := struct {
 			Version string                `json:"version"`
diff --git a/internal/namespaces/object/v1/testdata/test-config-get-default-mc.golden b/internal/namespaces/object/v1/testdata/test-config-get-default-mc.golden
@@ -1,5 +1,5 @@
 🎲🎲🎲 EXIT CODE: 0 🎲🎲🎲
 🟩🟩🟩 STDOUT️ 🟩🟩🟩️
-{"version":"9","hosts":{"scaleway":{"url":"https://s3.fr-par.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4"}}}
+{"version":"9","hosts":{"scaleway":{"url":"https://s3.fr-par.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4","projectID":""}}}
 🟩🟩🟩 JSON STDOUT 🟩🟩🟩
-{"version":"9","hosts":{"scaleway":{"url":"https://s3.fr-par.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4"}}}
+{"version":"9","hosts":{"scaleway":{"url":"https://s3.fr-par.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4","projectID":""}}}
diff --git a/internal/namespaces/object/v1/testdata/test-config-get-default-rclone.golden b/internal/namespaces/object/v1/testdata/test-config-get-default-rclone.golden
@@ -8,7 +8,7 @@ type = s3
 provider = Scaleway
 env_auth = false
 endpoint = s3.fr-par.scw.cloud
-access_key_id = SCWXXXXXXXXXXXXXXXXX
+access_key_id = SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111
 secret_access_key = 11111111-1111-1111-1111-111111111111
 region = fr-par
 location_constraint =
@@ -25,7 +25,7 @@ type = s3
 provider = Scaleway
 env_auth = false
 endpoint = s3.fr-par.scw.cloud
-access_key_id = SCWXXXXXXXXXXXXXXXXX
+access_key_id = SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111
 secret_access_key = 11111111-1111-1111-1111-111111111111
 region = fr-par
 location_constraint =
diff --git a/internal/namespaces/object/v1/testdata/test-config-get-default-s3cmd.golden b/internal/namespaces/object/v1/testdata/test-config-get-default-s3cmd.golden
@@ -4,7 +4,7 @@
 # Configuration file for s3cmd https://s3tools.org/s3cmd
 # Default location: $HOME/.s3cfg
 [default]
-access_key = SCWXXXXXXXXXXXXXXXXX
+access_key = SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111
 bucket_location = fr-par
 host_base = s3.fr-par.scw.cloud
 host_bucket = %(bucket)s.s3.fr-par.scw.cloud
@@ -15,7 +15,7 @@ use_https = True
 # Configuration file for s3cmd https://s3tools.org/s3cmd
 # Default location: $HOME/.s3cfg
 [default]
-access_key = SCWXXXXXXXXXXXXXXXXX
+access_key = SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111
 bucket_location = fr-par
 host_base = s3.fr-par.scw.cloud
 host_bucket = %(bucket)s.s3.fr-par.scw.cloud
diff --git a/internal/namespaces/object/v1/testdata/test-config-get-with-region-mc.golden b/internal/namespaces/object/v1/testdata/test-config-get-with-region-mc.golden
@@ -1,5 +1,5 @@
 🎲🎲🎲 EXIT CODE: 0 🎲🎲🎲
 🟩🟩🟩 STDOUT️ 🟩🟩🟩️
-{"version":"9","hosts":{"scaleway":{"url":"https://s3.nl-ams.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4"}}}
+{"version":"9","hosts":{"scaleway":{"url":"https://s3.nl-ams.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4","projectID":""}}}
 🟩🟩🟩 JSON STDOUT 🟩🟩🟩
-{"version":"9","hosts":{"scaleway":{"url":"https://s3.nl-ams.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4"}}}
+{"version":"9","hosts":{"scaleway":{"url":"https://s3.nl-ams.scw.cloud","accessKey":"SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111","secretKey":"11111111-1111-1111-1111-111111111111","api":"S3v4","projectID":""}}}
diff --git a/internal/namespaces/object/v1/testdata/test-config-get-with-region-rclone.golden b/internal/namespaces/object/v1/testdata/test-config-get-with-region-rclone.golden
@@ -8,7 +8,7 @@ type = s3
 provider = Scaleway
 env_auth = false
 endpoint = s3.nl-ams.scw.cloud
-access_key_id = SCWXXXXXXXXXXXXXXXXX
+access_key_id = SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111
 secret_access_key = 11111111-1111-1111-1111-111111111111
 region = nl-ams
 location_constraint =
@@ -25,7 +25,7 @@ type = s3
 provider = Scaleway
 env_auth = false
 endpoint = s3.nl-ams.scw.cloud
-access_key_id = SCWXXXXXXXXXXXXXXXXX
+access_key_id = SCWXXXXXXXXXXXXXXXXX@11111111-1111-1111-1111-111111111111
 secret_access_key = 11111111-1111-1111-1111-111111111111
 region = nl-ams
 location_constraint =
diff --git a/internal/namespaces/object/v1/testdata/test-config-get-with-region-s3cmd.golden b/internal/namespaces/object/v1/testdata/test-config-get-with-region-s3cmd.golden

Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,7 @@ func Test_ConfigGet(t *testing.T) {`
`16`	`16`	`"11111111-1111-1111-1111-111111111111",`
`17`	`17`	`),`
`18`	`18`	`scw.WithDefaultOrganizationID("11111111-1111-1111-1111-111111111111"),`
	`19`	`+ scw.WithDefaultProjectID("11111111-1111-1111-1111-111111111111"),`
`19`	`20`	`scw.WithDefaultZone(scw.ZoneFrPar1),`
`20`	`21`	`scw.WithDefaultRegion(scw.RegionFrPar),`
`21`	`22`	`)`