Skip to content

feat(jobs): permissions precisions #5657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat(jobs): permissions precisions #5657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
97c70d4
feat(jobs): permissions precisions
thomas-tacquet Oct 14, 2025
cfca112
Apply suggestions from code review
thomas-tacquet Oct 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pages/iam/reference-content/permission-sets.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ Below is a list of the permission sets available at Scaleway.
| FunctionsFullAccess | Full access to create, read, list, edit and delete Functions |
| MessagingAndQueuingReadOnly | List and read access to Messaging |
| MessagingAndQueuingFullAccess | Full access to create, read, list, edit and delete Messaging |
| ServerlessJobsFullAccess | Full access to create, read, list, edit and delete job definition/run |
| ServerlessJobsFullAccess | Full access to create, read, list, edit and delete job definition/run. To start a job, in some conditions, permissions for Registry and Secret Manager may be required. |
| ServerlessJobsReadOnly | List and read access to job definition/run |
| ServerlessSQLDatabaseReadOnly| List and read access to Serverless SQL Database |
| ServerlessSQLDatabaseReadWrite| List, read and write access to Serverless SQL Database. Includes data and table structure edition. Does not include permissions to create databases or edit settings |
Expand Down
8 changes: 4 additions & 4 deletions pages/serverless-jobs/how-to/create-job.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,13 +49,13 @@ Scaleway's Serverless Jobs allows you to create jobs from several container [reg
<Tabs>
<TabsTab label="Data">
1. Declare [environment variables](/serverless-jobs/concepts/#environment-variables) you want to inject into your job. For each environment variable, click **+Add variable** and enter the key/value pair.
2. Add [secrets references](/serverless-functions/concepts/#secrets) for your Job. Secret references are environment variables fetched from [Scaleway Secret Manager](/secret-manager/) that are injected into your job, but the values are not retained or displayed by Scaleway after initial validation.
2. Add [secrets references](/serverless-functions/concepts/#secrets) for your Job. Secret references are environment variables fetched from [Scaleway Secret Manager](/secret-manager/) that are injected into your job, but the values are not retained or displayed by Scaleway after initial validation.
<Message type="note">
Encode your environment variables and secrets to `base64` if they are too large, and contain carriage returns.
</Message>
</TabsTab>
<TabsTab label="Storage">
- Customize the ephemeral storage for your job according to your requirements. The data stored in your job is not retained once it is finished.
- Customize the ephemeral storage for your job according to your requirements. The data stored in your job is not retained once it is finished.
</TabsTab>
<TabsTab label="Execution">
1. Add a **startup command** to your job. It will be executed every time your job is run.
Expand Down Expand Up @@ -114,13 +114,13 @@ Private external container registries are currently not supported.
<Tabs>
<TabsTab label="Data">
1. Declare [environment variables](/serverless-jobs/concepts/#environment-variables) you want to inject into your job. For each environment variable, click **+Add variable** and enter the key/value pair.
2. Add [secrets references](/serverless-functions/concepts/#secrets) for your Job. Secret references are environment variables fetched from [Scaleway Secret Manager](/secret-manager/) that are injected into your job, but the values are not retained or displayed by Scaleway after initial validation.
2. Add [secrets references](/serverless-functions/concepts/#secrets) for your Job. Secret references are environment variables fetched from [Scaleway Secret Manager](/secret-manager/) that are injected into your job, but the values are not retained or displayed by Scaleway after initial validation.
<Message type="note">
Encode your environment variables and secrets to `base64` if they are too large, and contain carriage returns.
</Message>
</TabsTab>
<TabsTab label="Storage">
- Customize the ephemeral storage for your job according to your requirements. The data stored in your job is not retained once it is finished.
- Customize the ephemeral storage for your job according to your requirements. The data stored in your job is not retained once it is finished.
</TabsTab>
<TabsTab label="Execution">
1. Add a **startup command** to your job. It will be executed every time your job is run.
Expand Down
14 changes: 12 additions & 2 deletions pages/serverless-jobs/how-to/run-job.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,18 @@ The **Job runs** section contains basic monitoring information for your jobs:
- A start date and an end date
- The duration of the job execution

## Permissions and product dependencies

Depending on various settings, Serverless Jobs can have dependencies on other products, for example:
- **Secret Manager**: to securly inject data into Jobs
- **Container Registry**: to store images of Jobs

Starting a Job Definition with product dependencies using IAM policies can fail if some permissions are not definied properly.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure definition should have a capital here? @SamyOubouaziz


If the Job Definition uses an image from **Container Registry**, add `ContainerRegistryReadOnly` permission.

If the Job Definition consumes data from **Secret Manager**; add `SecretManagerSecretAccess` permission.

<Message type="tip">
Use [Cockpit](/cockpit/quickstart/) for in-depth monitoring of the activity of your serverless jobs.
</Message>


4 changes: 3 additions & 1 deletion pages/serverless-jobs/troubleshooting/job-in-error-state.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,4 +15,6 @@ My job run is in an error state.

- Make sure that you have built your image for an `amd64` architecture, as `arm64` is not supported. See the [Architecture](/serverless-jobs/reference-content/jobs-limitations/#architecture) documentation for more information.

- Make sure that your deployment does not exceed the limitations of [Serverless Jobs](/serverless-jobs/reference-content/jobs-limitations/).
- Make sure that your deployment does not exceed the limitations of [Serverless Jobs](/serverless-jobs/reference-content/jobs-limitations/).

- Make sure to use the correct permissions when other products are involved - see the [permissions and product dependencies documentation](/serverless-jobs/how-to/run-job/#permissions-and-product-dependencies).
Loading