Skip to content

feat(iam): remove guests #5022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions macros/iam/login-member.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,10 @@
macro: login-member
---

<Message type="important">
Login via [Single Sign-On (SSO)](/account/concepts/#single-sign-on-sso) is currently not available for Members.
</Message>

1. Open your web browser and go to the [Scaleway console](https://console.scaleway.com).
2. Click [Log in as an IAM Member](https://account.scaleway.com/member-login?redirectToUrl=https://console.scaleway.com/).
<Message type="important">
Logging into an Organization as a Member is different from logging in as a Guest or as an Owner. To perform a non-Member login, you can follow the classic [How to log into the console](/account/how-to/log-in-to-the-console) procedure.
Logging into an Organization as a Member is different from logging in as an Owner. To perform a non-Member login, you can follow the classic [How to log into the console](/account/how-to/log-in-to-the-console) procedure.
</Message>
3. Enter the Organization ID and click **Continue**.
<Message type="important">
Expand Down
8 changes: 0 additions & 8 deletions menu/navigation.json
Original file line number Diff line number Diff line change
Expand Up @@ -324,10 +324,6 @@
"label": "Invite a Guest to an Organization",
"slug": "invite-user-to-orga"
},
{
"label": "Accept an invitation to an Organization",
"slug": "accept-invitation-to-orga"
},
{
"label": "Log in as a Member",
"slug": "log-in-as-a-member"
Expand All @@ -344,10 +340,6 @@
"label": "Manage API keys",
"slug": "manage-api-keys"
},
{
"label": "Manage users",
"slug": "manage-users"
},
{
"label": "Manage Members",
"slug": "manage-members"
Expand Down
5 changes: 0 additions & 5 deletions pages/account/faq.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,6 @@ productIcon: AccountExperienceProductIcon
### My account is locked. What do I do?
If your account is locked, [contact our support team](https://console.scaleway.com/support/tickets/create) to learn the reason for the blockage and discover how to regain access.

### I've been invited to an Organization, but can’t see any resources
When you create a Scaleway account after being invited to join a specific Organization as a [Guest](/iam/concepts/#guest), a personal Organization is automatically created for you.

If you only want to work on the Project you have been invited to, you can switch Organizations and Projects using the drop-down menu on the console dashboard.

### I cannot access my account but I am still being billed

First you must contact the support to help you [unlock your account](/account/troubleshooting/cannot-log-into-my-account/). Once you have regained access, identify what resources are still running and delete them. You can also [close your account](/account/how-to/close-account), and have all your remaining resources automatically shutdown.
Expand Down
4 changes: 4 additions & 0 deletions pages/account/how-to/change-console-appearance.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,10 @@ categories:

You can choose the color scheme of the [Scaleway console](/account/concepts/#console) according to your preferences. We offer a light, dark, darker, or system-based color scheme.

<Message type="note">
This feature is currently not available for [IAM Members](/iam/concepts/#member).
</Message>

<Macro id="requirements" />

- A Scaleway account logged into the [console](https://console.scaleway.com)
Expand Down
2 changes: 1 addition & 1 deletion pages/account/quickstart.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ Once you have validated your payment method, you can start ordering resources li

Every account has an associated Organization, which in turn has an Owner. When you create your account, you are designated as the Owner of the Organization associated with your account.

When you [close your account](/account/how-to/close-account/), you delete your Organization and all its resources and backups. All the Members you created will cease to exist along with the Organzation. Any Guests who joined the Organization will lose access to it.
When you [close your account](/account/how-to/close-account/), you delete your Organization and all its resources and backups. All the Members you created will cease to exist along with the Organzation.

<Message type="important">
There is a delay of up to 10 days between the time your account is closed and the time the system deletes your resources. It is recommended to manually delete all your Organization's resources before closing your account. To reopen your account, [contact support](https://console.scaleway.com/support).
Expand Down
2 changes: 1 addition & 1 deletion pages/contribute.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ Join the Scaleway **Write for the Community** program, an initiative for making
If you write a tutorial that gets published on our website, you will receive a voucher of **up to €200 cloud credits** in your Scaleway account.

Note that for receiving a reward, you must have:
- Submitted your tutorial idea via a [documentation request issue](https://github.com/scaleway/docs-content/issues/new?assignees=&labels=Documentation+Request&template=doc_request.yaml&title=%5B%F0%9F%91%A9%E2%80%8D%F0%9F%92%BB+Documentation+Request%5D%3A+), which included your [Organization ID](/iam/how-to/accept-invitation-to-orga/) and was approved by our team.
- Submitted your tutorial idea via a [documentation request issue](https://github.com/scaleway/docs-content/issues/new?assignees=&labels=Documentation+Request&template=doc_request.yaml&title=%5B%F0%9F%91%A9%E2%80%8D%F0%9F%92%BB+Documentation+Request%5D%3A+), which included your [Organization ID](/iam/concepts/#organization-id) and was approved by our team.
- Written the content yourself and followed our [contribution process](https://github.com/scaleway/docs-content/blob/main/docs/CONTRIBUTING.md).
- Had your content merged and published by our team.

Expand Down
19 changes: 12 additions & 7 deletions pages/iam/concepts.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -54,27 +54,29 @@ You are the [Owner](#owner) of the Organization that is created with your Scalew

Similarly, you can invite other users to be Guests in your Organization. Whereas Owners have full rights and access to all resources and features in their Organization, Guests have only the rights and permissions given to them via [policies](#policy).

<Lightbox src="scaleway-iam-owners-guests.webp" alt="" />
<Message type="important">
Guests will be deprecated by July 2025. From then on, only Members can be created as users of your Organizations.
</Message>

## IAM

**I**dentity and **A**ccess **M**anagement allows you to share access to the management of your Scaleway [resources](#resource) in a controlled and secure manner.

This is achieved by inviting users to be Guests in your account's [Organization](#organization), and creating [policies](#policy) that define in a very fine-grained way exactly what permissions they should have for which [resources](#resource) in which of your [Projects](#project) or across your whole Organization.
This is achieved by adding members to your [Organization](#organization), and creating [policies](#policy) that define in a very fine-grained way exactly what permissions they should have for which [resources](#resource) in which of your [Projects](#project) or across your whole Organization.

Similarly, you may participate as a Guest in someone else's Organization, where you will have the precise rights that they accord to you using policies.
Similarly, you may be added as a Member in someone else's Organization, where you will have the precise rights that they accord to you using policies.

You can also create non-human users in your Organization, called [IAM applications](#application), in order to give applications programmatic access to your Scaleway resources.

## Member

You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created. This is one of the methods employed at Scaleway to allow Organizations to have multi-users. Members fulfill the same purpose as Guest, while ensuring the security of the Organization.
You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created. This is one of the methods employed at Scaleway to allow Organizations to have multi-users.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is one of the methods employed at Scaleway to allow Organizations to have multiple users.
-> this is the only way so maybe we can remove this sentence


As a Member you are subject to [complying with the security requirements](/iam/how-to/comply-with-sec-requirements-member) in effect in your Organization. [Logging into an Organization as a Member](/iam/how-to/log-in-as-a-member) is also different from [logging in as a Guest or as an Owner](/account/how-to/log-in-to-the-console).
As a Member you are subject to [complying with the security requirements](/iam/how-to/comply-with-sec-requirements-member) in effect in your Organization. [Logging into an Organization as a Member](/iam/how-to/log-in-as-a-member) is also different from [logging in as an Owner](/account/how-to/log-in-to-the-console).

## Organization

An Organization is made of one or several [Projects](#project). When you create your Scaleway account, an Organization is automatically created, of which you are the Owner. You can also be added to an existing Organization as a [Guest](#guest) or as a [Member](#member).
An Organization is made of one or several [Projects](#project). When you create your Scaleway account, an Organization is automatically created, of which you are the Owner. You can also be added to an existing Organization as a [Member](#member).

When you create [IAM rules](#rule), you can set their scope at Organization level. This means you can give access to features managed at Organization level, like billing and IAM, to users, applications, and groups in your Organization.

Expand All @@ -86,7 +88,7 @@ The Organization ID identifies the [Organization](#organization) created with yo

## Owner

You are the [Owner](#owner) of the Organization that is created with your Scaleway account. Owners have full rights and access to all resources and features in their Organization. See also [Guest](#guest) and [Member](#member).
You are the [Owner](#owner) of the Organization that is created with your Scaleway account. Owners have full rights and access to all resources and features in their Organization. See also [Member](#member).

## Permission

Expand Down Expand Up @@ -158,6 +160,9 @@ Keep in mind that:
A user (also known as an IAM user) is a human user in an Organization. They can be of two types:
- **Owner**: You are the Owner of the [Organization](#organization) that was created with your account.
- **Guest**: You are a Guest when invited to another Organization of which you are not the Owner. Similarly, you can invite other users to be Guests in your Organization.
<Message type="important">
Guests will be deprecated by July 2025. From then on, only Members can be created as users of your Organizations.
</Message>
- **Member**: You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created.

Within each Organization, different IAM users can have different rights (defined through [policies](#policy)) to perform actions on resources.
71 changes: 0 additions & 71 deletions pages/iam/how-to/accept-invitation-to-orga.mdx

This file was deleted.

41 changes: 29 additions & 12 deletions pages/iam/how-to/manage-members.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -18,28 +18,45 @@ dates:
## How to create a Member

1. Click **IAM & API keys** on the top-right drop-down menu of the Scaleway console. The **Users** tab of the [Identity and Access Management dashboard](https://console.scaleway.com/iam/users) displays.
2. Click **+ Add user**. A pop-up displays prompting you to choose between creating a **Member** or adding a **Guest**.
3. Select **Member** and click **Continue**.
4. Enter the username of the Member you want to add to your Organization.
2. Click **+ Add user**. A pop-up displays.
3. Enter the username of the Member you want to add to your Organization.
<Message type="important">
When you create a Member, a Scaleway account is created for them. They exist only within your Organization. If you delete the Member, their account is also deleted. Make sure you inform your Members that [logging into an Organization as a Member](/iam/how-to/log-in-as-a-member) is different from [logging in as a Guest or as an Owner](/account/how-to/log-in-to-the-console).
When you create a Member, a Scaleway account is created for them. They exist only within your Organization. If you delete the Member, their account is also deleted. Make sure you inform your Members that [logging into an Organization as a Member](/iam/how-to/log-in-as-a-member) is different from [logging in as an Owner](/account/how-to/log-in-to-the-console).
</Message>
5. (Optional) Add a password.
4. (Optional) Add a password.
<Message type="note">
If you set a password, make sure you keep note of it to share it with the Member later. The password will only be shown once. If password renewal is enforced in the Organization, from their first login, the Member must update their password. They must comply with this security requirement within the [grace period](/iam/concepts#grace-period) defined for your Organization.
</Message>
6. (Optional) Check the box if you want to send the password to the Member via email.
7. Click **Next**.
8. Enter the Member's email address.
9. (Optional) Check the box if you want to send a welcome email to the Member.
10. (Optional) Enter the first and last name of the member.
11. (Optional) Assign the member to an existing [IAM group](/iam/concepts/#group)
12. Click **Create Member**.
5. (Optional) Check the box if you want to send the password to the Member via email.
6. Click **Next**.
7. Enter the Member's email address.
8. (Optional) Check the box if you want to send a welcome email to the Member.
9. (Optional) Enter the first and last name of the member.
10. (Optional) Assign the member to an existing [IAM group](/iam/concepts/#group)
11. Click **Create Member**.

<Message type="important">
If you did not send a welcome email to the Member, make sure you give them their login information.
</Message>

## How to access the Member overview

1. Click **IAM & API keys** on the top-right drop-down menu of the Scaleway console. The **Users** tab of the [Identity and Access Management dashboard](https://console.scaleway.com/iam/users) displays.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feels like we're missing a step here, because to find the IAM & API keys menu they have to click their avatar. A new user wouldn't know there's a drop-down menu there, I guess.

<Lightbox src="scaleway-iam-users-dashboard.webp" alt="" />
2. Click the name of the user you want to manage. Alternatively, click <Icon name="more" /> next to the user, and select **Overview**. Either way, you are taken to the user's **Overview** tab.
Follow the steps below depending on the management action you wish to take.

## How to view Member information

From the user's [Overview tab](#how-to-access-the-user-overview), you can view information such as:

- **User details** - The user's type (Owner or Member), status, **created on** date, whether they have [MFA](/account/concepts/#multifactor-authentication-mfa) enabled, and the date of their last login.
- **User profile** - The user's username, first and last names, email address, telephone number, preferred language, and their Scaleway ID number.

<Lightbox src="scaleway-user-info.webp" alt="" />

In the Overview tab, you can also find an extensive list of the user's permission sets, the name of their associated policies and the scope they apply to.

## How to lock a Member

As an Owner or user with IAM Manager permissions, you can lock a Member anytime.
Expand Down
Loading
Loading