Deploy Scaleway with Terraform using Github Actions

Deploy Scaleway with Terraform using Github Actions

Summary: This wiki page shows how deploy a terraform app to scaleway using a GitHub Actions workflow. It is a followup of Private Kubernetes on Scaleway with Terraform which was a followup on Private Kubernetes on Scaleway.
Date: 2 July 2026

scaleway, terraform, githubactions

In my previous post I created a deployment for Scaleway resources using terraform. But when you're working with multiple people on the same environment, or just don't want the terraform statefile to live in your local computer, you want to be able to run the statefile and the deployment using a pipeline. In this post I've created a GitHub Actions workflow to manage the terraform statefile as well as manage the full lifecycle for the scaleway resources.

Repository Structure

To make sure the workflow works, we need to setup the repository where our code will live in the following way:

.
├── .github/
│   └── workflow/
│       └── scaleway.yml
└── terraform/
    ├── apps/
    │   └── scwPrivateK8s
    └── modules/
        ├── scw_instance_server
        ├── scw_private_kapsule
        ├── scw_private_network
        ├── scw_public_gateway
        └── scw_vpc

As you can see, the actual workflow scaleway.yml lives in the .github/workflow folder. Keeping to this default makes sure GitHub automatically picks up on the workflow without additional configuration. Next to the .github folder we have the terraform folder. Below it, I've created a apps/scwPrivateK8s folder. In here, I've added the files from the Private K8S application. In the modules folder I've added the modules from here. Note that the scaleway modules are prefixed with scw.

Github Action VSCode Extension

This step is optional, but I find it very useful to use the Github Actions extension for VSCode. To install it, search for the github.vscode-github-actions extension and follow the manual on connecting it to your GitHub repository.

I use it to add the secrets to the repository:

Use the Github Actions extension to add secrets to the repository

Also, when the workflow is functional you can also use it to start it and check the results. You can't check the logs from the extension, but it does provide you with a direct link to the logs, so that's convenient as well.

Secrets

Use the extension or the GitHub web interface to add the following secrets to your repository:

SCW_ACCESS_KEY: The name of the API key
SCW_SECRET_KEY: The secret value of the API key
SCW_DEFAULT_ORGANIZATION_ID: Your Scaleway organization ID
SCW_PROJECT_ID: The ID of the Scaleway project where you want to deploy the resources
SCW_PUBLIC_KEY: The public key you'll use to access the Scaleway resources like the Linux VM

Prepare Terraform Backend

The workflow will create a terraform backend based on Scaleway Object Storage. The Scaleway object storage is aws s3 compatible, so it will be configured using the aws cli (which explains why the workflow sets the AWS variables). As compared to the main.tf we used for local storage, we need to uncomment the backend. As we will also use the workflow to feed in the variables for the Scaleway Organization and Project so it can be reusable for multiple deployments we end up with the following main.tf file:

main.tf

terraform {
  required_version = ">= 0.14.9"
 
  required_providers {
    scaleway = {
      source  = "scaleway/scaleway"
      version = "2.75.0"
    }
  }
  backend "s3" {}
}
 
provider "scaleway" {
  region          = var.region
  zone            = var.zone
  project_id      = var.project_id
  organization_id = var.organization_id
}

Additionally, if you haven't done so yet, you need to set the default project for the API key. To do so, Go to API keys, edit the key you are using, and set the default project to the one you'll be using.
For more information see the documentation:

Preferred Projects for Object Storage - When creating and/or listing Object Storage buckets via the API, there is no available parameter to specify the Project in which you wish to list or create buckets. All buckets you create via the API will therefore be created in the preferred Project you choose when creating the API key. Similarly, when listing buckets, buckets from your preferred Project will be listed. Note that: This applies to all actions on Object Storage buckets, but it does not apply to other products or resources. You can still create and/or list buckets in your Project of choice via the Scaleway console. See our dedicated documentation for more information.

If you haven't done so you'll get the following error: make_bucket failed: s3://tf-state-ams An error occurred (AccessDenied) when calling the CreateBucket operation: Access Denied

The Workflow

The full workflow is available here: terraformScaleway.full.yaml

After setting up the folder structure, creating the secrets and pushing everything to the repository we can now use the Github Actions Extension to start the deployment. Hover over the workflow yuo want to start and a 'play' button appears. This will start the workflow, and ask you for the branch name and any required input:

Use the Github Actions extension to start the workflow

Some Caution

Note that the terraformScaleway.full.yaml also has a destroy option. I really recommend to remove that option in any environment. I only add when there really is no dependency on the resources I deployed at all. It's just too easy to accidentially click the destroy option.

This wiki has been made possible by:

Table of Contents