ibm-research/WatsonxDocsQARetrieval huggingface dataset:
# Managing all projects in the account #

If you have the required permission, you can view and manage all projects in your IBM Cloud account\. You can add yourself to a project so that you can delete it or change its collaborators\.

## Requirements ##

To manage all projects in the account, you must:

<!-- <ul> -->

 *  Restrict resources to the current account\. See steps to [set the scope for resources](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/account-settings.html#set-the-scope-for-resources)\.
 *  Have the **Manage projects** permission that is provided by the IAM **Manager** role for the IBM Cloud Pak for Data service\.

<!-- </ul> -->

## Assigning the Manage projects permission ##

To grant the **Manage projects** permission to a user who is already in your IBM Cloud account:

<!-- <ol> -->

1.  From the navigation menu, choose **Administration > Access (IAM)** to open the **Manage access and users** page in your IBM Cloud account\.
2.  Select the user on the **Users** page\.
3.  Click the **Access** tab and then choose **Assign access\+**\.
4.  Select **Access policy**\.
5.  For **Service**, choose **IBM Cloud Pak for Data**\.
6.  For **Service access**, select the **Manager** role\.
7.  For **Platform access**, assign the **Editor** role\.
8.  Click **Add** and **Assign** to assign the policy to the user\.

<!-- </ol> -->

## Managing projects ##

You can add yourself to a project when you need to delete the project, delete collaborators, or assign the **Admin** role to a collaborator in the project\. To manage projects:

<!-- <ul> -->

 *  View all active projects on the **Projects** page in IBM watsonx by clicking the drop\-down menu next to the search field and selecting **All active projects**\.
 *  Join any project as **Admin** by clicking **Join as admin** in the **Your role** column\.
 *  Filter projects to identify which projects you are not a collaborator in, by clicking the filter icon ![Filter icon](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/images/filter.svg) and selecting **Your role > No membership**\.

<!-- </ul> -->

For more details on managing projects, see [Administering projects](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/admin-project.html)\.

## Learn more ##

<!-- <ul> -->

 *  [Administering projects](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/admin-project.html)

<!-- </ul> -->

**Parent topic:**[Managing IBM watsonx](https://dataplatform.cloud.ibm.com/docs/content/wsj/console/wdp_admin_console.html)

<!-- </article "role="article" "> -->
# Removing users from the account or from the workspace #

The IBM Cloud account administrator or owner can remove users from the IBM Cloud account\. Any use with the **Admin** role can remove users from a workspace\.

## Removing users from the IBM Cloud account ##

You can remove a user from an IBM Cloud account, so that the user can no longer log in to the console, switch to your account, or access account resources\.

### Required roles ###

: To remove a user from an IBM Cloud account, you must have one of the following roles for your IBM Cloud account: : \- **Owner** : \- **Administrator** : \- **Editor**

To remove a user from the IBM Cloud account:

<!-- <ol> -->

1.  From the IBM watsonx navigation menu, click **Administration > Access (IAM)**\.
2.  Click **Users** and find the name of the user that you want to remove\.
3.  Choose **Remove user** from the action menu and confirm the removal\.

<!-- </ol> -->

Removing a user from an account doesn't delete the IBMid for the user\. Any resources such as projects or catalogs that were created by the user remain in the account, but the user no longer has access to work with those resources\. The account owner, or an administrator for the service instance, can assign other users to work with the projects and catalogs or delete them entirely\.

For more information, see [IBM Cloud docs: Removing users from an account](https://cloud.ibm.com/docs/account?topic=account-remove)\.

## Removing users from a workspace ##

You can remove collaborators from a workspace, such as a project or space, so that the user can no longer access the workspace or any of its contents\.

**Required role** : To remove a user from a workspace, you must have the **Admin** collaborator role for the workspace that you are editing\.

To remove a collaborator, select one or more users (or user groups) on the **Access control** page of the workspace and click **Remove**\.

The user is still a member of the IBM Cloud account and can be added as a collaborator to other workspaces as needed\.

## Learn more ##

<!-- <ul> -->

 *  [Stop using IBM watsonx](https://dataplatform.cloud.ibm.com/docs/content/wsj/console/stopapps.html)
 *  [Project collaborators](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/collaborate.html)
 *  [IBM Cloud docs: Removing users from an account](https://cloud.ibm.com/docs/account?topic=account-remove)

<!-- </ul> -->

**Parent topic:**[Managing the platform](https://dataplatform.cloud.ibm.com/docs/content/wsj/console/wdp_admin_console.html)

<!-- </article "role="article" "> -->
# Administering your accounts and services #

For most administration tasks, you must be the IBM Cloud account owner or administrator\. If you log in to your own account, you are the account owner\. If you log in to someone else's account or an enterprise account, you might not be the account owner or administrator\.

Tasks for all users:

<!-- <ul> -->

 *  [Managing your personal settings](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/personal-settings.html)
 *  [Determining your roles](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/your-roles.html)
 *  [Understanding accessibility features](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/accessibility.html)

<!-- </ul> -->

Tasks for IBM Cloud account owners or administrators in IBM watsonx and in IBM Cloud:

<!-- <ul> -->

 *  [Managing IBM watsonx services](https://dataplatform.cloud.ibm.com/docs/content/wsj/console/wdp_admin_console.html)
 *  [Securing IBM watsonx](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-overview.html)
 *  [Managing your IBM Cloud account](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/manage-account.html)
 *  [Adding and managing IBM Cloud services](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/create-services.html)
 *  [Reading notices](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/notices.html)

<!-- </ul> -->

<!-- </article "role="article" "> -->
# Creating and managing IBM Cloud services #

You can create IBM Cloud service instances within IBM watsonx from the Services catalog\.

**Prerequisite** : You must be [signed up for watsonx](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/signup-wx.html)\.

**Required permissions** : For creating or managing a service instance, you must have **Administrator** or **Editor** platform access roles in the IBM Cloud account for IBM watsonx\. If you signed up for IBM watsonx with your own IBM Cloud account, you are the owner of the account\. Otherwise, you can [check your IBM Cloud account roles and permissions](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/your-roles.html)\.

## Creating a service ##

To view the Services catalog, select **Administration > Services > Services catalog** from the main menu\. For a description of each service, see [Services](https://dataplatform.cloud.ibm.com/docs/content/svc-welcome/cloud-services.html)\.

To check which service instances you have, select **Administration > Services > Service instances** from the main menu\. You can filter which services you see by resource group, organization, and region\.

To create a service:

<!-- <ol> -->

1.  Log in to IBM watsonx\.
2.  Select **Administration > Services > Services catalog** from the main menu\.
3.  Click the service you want to create\.
4.  Specify the IBM Cloud service region\.
5.  Select a plan\.
6.  If necessary, select the resource group or organization\.
7.  Click **Create**\.

<!-- </ol> -->

## Managing services ##

To manage a service:

<!-- <ol> -->

1.  Select **Administration > Services > Services instances** from the main menu\.
2.  Click the Action menu next to the service name and select **Manage in IBM Cloud**\. The service page in IBM Cloud opens in a separate browser tab\.
3.  To change pricing plans, select **Plan** and choose the desired plan\.

<!-- </ol> -->

## Learn more ##

<!-- <ul> -->

 *  [Associate a service with a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/assoc-services.html)
 *  [Managing the platform](https://dataplatform.cloud.ibm.com/docs/content/wsj/console/wdp_admin_console.html)

<!-- </ul> -->

**Parent topic:**[IBM Cloud services](https://dataplatform.cloud.ibm.com/docs/content/svc-welcome/cloud-services.html)

<!-- </article "role="article" "> -->
# Securing connections to services with private service endpoints #

You can configure isolated connectivity to your cloud\-based services for production workloads with IBM Cloud service endpoints\. When you enable IBM Cloud service endpoints in your account, you can expose a private network endpoint when you create a resource\. You then connect directly to this endpoint over the IBM Cloud private network rather than the public network\. Because resources that use private network endpoints don't have an internet\-routable IP address, connections to these resources are more secure\.

To use service endpoints:

<!-- <ol> -->

1.  Enable virtual routing and forwarding (VRF) in your account, if necessary, and enable the use of service endpoints\.
2.  Create services that support VRF and service endpoints\.

<!-- </ol> -->

See [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint)\.

## Learn more ##

<!-- <ul> -->

 *  [Secure access to services using service endpoints](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview)
 *  [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint)
 *  [List of services that support service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint#use-service-endpoint)

<!-- </ul> -->

**Parent topic:**[Security](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/security-overview.html)

<!-- </article "role="article" "> -->
# Firewall access for Cloud Object Storage #

Private IP addresses are required when IBM watsonx and Cloud Object Storage are located on the same network\. When creating a connection to a Cloud Object Storage bucket that is protected by a firewall on the same network as IBM watsonx, the connector automatically maps to private IP addresses for IBM watsonx\. The private IP addresses must be added to a **Bucket access policy** to allow inbound connections from IBM watsonx\.

Follow these steps to search the private IP addresses for the IBM watsonx cluster and add them to the **Bucket access policy**:

<!-- <ol> -->

1.  Go to the **Administration > Cloud integrations** page\.
2.  Click the **Firewall configuration** link to view the list of IP ranges used by IBM watsonx\.
3.  Choose **Include private IPs** to view the private IP addresses for the IBM watsonx cluster\. ![A list of private IP addresses for the IBM watsonx cluster](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/images/ip-ranges-private.png)
4.  From your IBM Cloud Object Storage instance on IBM Cloud, open the **Buckets** list and choose the Bucket for the connection\.
5.  Copy each of the private IP ranges listed and paste them into the **Buckets > Permissions > IP address** field on IBM Cloud\. ![A list of permitted private IP addresses for the IBM watsonx cluster](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/images/bucket-ips.png)

<!-- </ol> -->

## Learn more ##

<!-- <ul> -->

 *  [IBM Cloud Object Storage connection](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/conn-cos.html)
 *  [IBM Cloud docs: Setting a firewall](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewall#firewall)

<!-- </ul> -->

**Parent topic:**[Configuring firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_ovrvw.html)

<!-- </article "role="article" "> -->
# Firewall access for Watson Studio #

Inbound firewall access is granted to the Watson Studio service by allowing the IP addresses for IBM watsonx on IBM Cloud\.

If Watson Studio is installed behind a firewall, you must add the WebSocket connection for your region to the firewall settings\. Enabling the WebSocket connection is required for notebooks and RStudio\.

Following are the WebSocket settings for each region:

<!-- <table> -->

Table 1\. Regional WebSockets

| Location                | Region    | WebSocket                                    |
| ----------------------- | --------- | -------------------------------------------- |
| United States (Dallas)  | us\-south | wss://dataplatform\.cloud\.ibm\.com          |
| Europe (Frankfurt)      | eu\-de    | wss://eu\-de\.dataplatform\.cloud\.ibm\.com  |
| United Kingdom (London) | eu\-gb    | wss://eu\-gb\.dataplatform\.cloud\.ibm\.com  |
| Asia Pacific (Tokyo)    | jp\-tok   | wss://jp\-tok\.dataplatform\.cloud\.ibm\.com |

<!-- </table ""> -->

Follow these steps to look up the IP addresses for IBM watsonx and allow them on IBM Cloud:

<!-- <ol> -->

1.  From the main menu, choose **Administration > Cloud integrations**\.
2.  Click **Firewall configuration** to display the IP addresses for the current region\. Use CIDR notation\.
3.  Copy each CIDR range into the **IP address restrictions** for either a user or an account\. You must also enter the allowed individual client IP addresses\. Enter the IP addresses as a comma\-separated list\. Then, click **Apply**\.
4.  Repeat for each region to allow access for Watson Studio\.

<!-- </ol> -->

When you configure the allowed IP addresses for Watson Studio, you include the CIDR ranges for the Watson Studio cluster\. You can also allow individual client system IP addresses\.

For step\-by\-step instructions for both user and account restrictions, see [IBM Cloud docs: Allowing specific IP addresses](https://cloud.ibm.com/docs/account?topic=account-ips)

**Parent topic:**[Configuring firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_ovrvw.html)

<!-- </article "role="article" "> -->
# Firewall access for AWS Redshift #

Inbound firewall access allows IBM watsonx to connect to Redshift on AWS through the firewall\. You need inbound firewall access to work with your data stored in Redshift\.

To connect to Redshift from IBM watsonx, you configure inbound access through the Redshift firewall by entering the IP ranges for IBM watsonx into the inbound firewall rules (also called ingress rules)\. Inbound access through the firewall is configurable if Redshift resides on a public subnet\. If Redshift resides on a private subnet, then no access is possible\.

Follow these steps to configure inbound firewall access to AWS Redshift:

<!-- <ol> -->

1.  Go to your provisioned Amazon Redshift cluster\.
2.  Select **Properties** and then scroll down to **Network and security settings**\.
3.  Click the **VPC security group**\.
    
    ![AWS VPC security group](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/images/int-aws-active.png)
4.  Edit the active/default security group\.
    
    ![AWS active security group](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/images/int-aws-vpc.png)
5.  Under **Inbound rules**, change the port range to 5439 to specify the Redshift port\. Then select **Edit inbound rules > Add rule**\.
    
    ![Edit inbound rules](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/images/int-aws-IPs.png)
6.  From IBM watsonx, go to the **Administration > Cloud integrations** page\.
7.  Click the **Firewall configuration** link to view the list of IP ranges used by IBM watsonx\. IP addresses can be viewed in either CIDR notation or as Start and End addresses\.
8.  Copy each of the IP ranges listed and paste them into the **Source** field for inbound firewall rules\.

<!-- </ol> -->

## Learn more ##

<!-- <ul> -->

 *  [Working with Redshift\-managed VPC endpoints in Amazon Redshift](https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-cross-vpc.html)

<!-- </ul> -->

<!-- </article "role="article" "> -->
# Firewall access for Spark #

To allow Spark to access data that is located behind a firewall, you add the appropriate IP addresses for your region to the inbound rules for your firewall\.

## Dallas (us\-south) ##

<!-- <ul> -->

 *  dal12 \- 169\.61\.173\.96/27, 169\.63\.15\.128/26, 150\.239\.143\.0/25, 169\.61\.133\.240/28, 169\.63\.56\.0/24
 *  dal13 \- 169\.61\.57\.48/28, 169\.62\.200\.96/27, 169\.62\.235\.64/26
 *  dal10 \- 169\.60\.246\.160/27, 169\.61\.194\.0/26, 169\.46\.22\.128/26, 52\.118\.59\.0/25

<!-- </ul> -->

**Parent topic:**[Configuring firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_ovrvw.html)

<!-- </article "role="article" "> -->
# Firewall access for Watson Machine Learning #

To allow Watson Machine Learning to access data that is located behind a firewall, you add the appropriate IP addresses for your region to the inbound rules for your firewall\.

## Dallas (us\-south) ##

<!-- <ul> -->

 *  dal10 \- 169\.60\.39\.152/29
 *  dal12 \- 169\.48\.198\.96/29
 *  dal13 \- 169\.61\.47\.128/29,169\.62\.162\.88/29

<!-- </ul> -->

**Parent topic:**[Configuring firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_ovrvw.html)

<!-- </article "role="article" "> -->
# Firewall access for the platform #

If a data source resides behind a firewall, then IBM watsonx requires inbound access through the firewall in order to make a connection\. Inbound firewall access is required whether the data source resides on a third\-party cloud provider or in an data center\. The method for configuring inbound access varies for different vendor's firewalls\. In general, you configure inbound access rules by entering the IP addresses for the IBM watsonx cluster to allow for access by IBM watsonx\.

You can enter the IP addresses using the starting and ending addresses for a range or by using CIDR notation\. Classless Inter\-Domain Routing (CIDR) notation is a compact representation of an IP address and its associated network mask\. For start and end addresses, copy each address and enter them in the inbound rules for your firewall\. Alternately, copy the addresses in CIDR notation\.

The IBM watsonx IP addresses vary by region\. The user interface lists the IP addresses for the current region\. The IP addresses apply to the base infrastructure for IBM watsonx\.

Follow these steps to look up the IP addresses for IBM watsonx cluster:

<!-- <ol> -->

1.  Go to the **Administration > Cloud integrations** page\.
2.  Click the **Firewall configuration** link to view the list of IP ranges used by IBM watsonx in your region\.
3.  View the IP ranges for the IBM watsonx cluster in either CIDR notation or as Start and End addresses\.
4.  Choose **Include private IPs** to view the private IP addresses\. The private IP addresses allow connections to IBM Cloud Object Storage buckets that are behind a firewall\. See [Firewall access for Cloud Object Storage](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-cfg-private-cos.html)\.
5.  Copy each of the IP ranges listed and paste them into the appropriate security configuration or inbound firewall rules area for your cloud provider\.

<!-- </ol> -->

For example, if your data source resides on AWS, open the **Create Security Group** dialog for your AWS Management Console\. Paste the IP ranges into the **Inbound** section for the security group rules\.

**Parent topic:**[Configuring firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_ovrvw.html)

<!-- </article "role="article" "> -->
# Configuring firewall access #

Firewalls protect valuable data from public access\. If your data sources reside behind a firewall for protection, and you are not using a Satellite Connector or Satellite location, then you must configure the firewall to allow the IP addresses for IBM watsonx and also for individual services\. Otherwise, IBM watsonx is denied access to the data sources\.

To allow IBM watsonx access to private data sources, you configure inbound firewall rules using the security mechanisms for your firewall\. Inbound firewall rules are not required for connections that use a Satellite Connector or Satellite location, which establishes a link by performing an outbound connection\. For more information, see [Connecting to data behind a firewall](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html)\.

All services in IBM watsonx actively use WebSockets for the proper functioning of the user interface and APIs\. Any firewall between the user and the IBM watsonx domain must allow **HTTPUpgrade**\. If IBM watsonx is installed behind a firewall, traffic for the **wss://** protocol must be enabled\.

## Configuring inbound access rules for firewalls ##

If data sources reside behind a firewall, then inbound access rules are required for IBM watsonx\. Inbound firewall rules protect the network against incoming traffic from the internet\. The following scenarios require inbound access rules through a firewall:

<!-- <ul> -->

 *  [Firewall access for IBM watsonx](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall_cfg.html)
 *  [Firewall access for Cloud Object Storage](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-cfg-private-cos.html)
 *  [Firewall access for AWS Redshift](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-redshift.html)
 *  [Firewall access for Watson Studio](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-dsx.html)
 *  [Firewall access for Watson Machine Learning](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-wml.html)
 *  [Firewall access for Spark](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-spark.html)

<!-- </ul> -->

## Learn more ##

<!-- <ul> -->

 *  [Connecting to data behind a firewall](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html)

<!-- </ul> -->

**Parent topic:**[Setting up the platform for administrators](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/setup-platform.html)

<!-- </article "role="article" "> -->
# Integrating with AWS #

You can configure an integration with the Amazon Web Services (AWS) platform to allow IBM watsonx users access to data sources from AWS\. Before proceeding, make sure you have proper permissions\. For example, you'll need to be able to create services and credentials in the AWS account\.

After you configure an integration, you'll see it under **Service instances**\. You'll see a new **AWS** tab that lists your instances of Redshift and S3\.

To configure an integration with AWS:

<!-- <ol> -->

1.  Log on to the [AWS Console](https://aws.amazon.com/console/)\.
2.  From the account drop\-down at the upper right, select **My Security Credentials**\.
3.  Under **Access keys (access key ID and secret access key)**, click **Create New Access Key**\.
4.  Copy the key ID and secret\.
    
    Important: Write down your key ID and secret and store them in a safe place.
5.  In IBM watsonx, under **Administration > Cloud integrations**, go to the **AWS** tab, enable integration, and then paste the access key ID and access key secret into the appropriate fields\.
6.  If you need to access Redshift, [configure firewall access](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/firewall-redshift.html)\.
7.  Confirm that you can see your AWS services\. From the main menu, choose **Administration > Services > Services instances**\. Click the **AWS** tab to see those services\.

<!-- </ol> -->

Now users who have credentials to your AWS services can [create connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html) to them by selecting them on the **Add connection** page\. Then they can access data from those connections by [creating connected data assets](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/connected-data.html)\.

## Next steps ##

<!-- <ul> -->

 *  [Set up a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/projects.html)
 *  [Create connections in a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html)

<!-- </ul> -->

**Parent topic:**[Integrations with other cloud platforms](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/int-cloud.html)

<!-- </article "role="article" "> -->
# Integrations with other cloud platforms #

You can integrate IBM watsonx with other cloud platforms to configure access to the data source services on that platform\. Then, users can easily create connections to those data source services and access the data in those data sources\.

You need to be the Account Owner or Administrator for the IBM Cloud account to configure integrations with other cloud platforms\.

You must have the proper permissions in your cloud platform subscription before you can configure an integration\. If you are using Amazon Web Services (AWS) Redshift (or other AWS data sources) or Microsoft Azure, you must also configure firewall access to allow IBM watsonx to access data\.

After you configure integration and firewall access with another cloud platform, you can access and connect to the services on that platform:

<!-- <ul> -->

 *  The service instances for that platform are shown on the **Service instances** page\. From the main menu, choose **Administration > Services > Services instances**\. Each cloud platform that you integrate with has its own page\.
 *  The data source services in that platform are shown when you create a connection\. Start adding a connection in a project, catalog, or other workspace\. When the **Add connection** page appears, click the **To service** tab\. The services are listed by cloud platform\.

<!-- </ul> -->

You can configure integrations with these cloud platforms:

<!-- <ul> -->

 *  [Amazon Web Services (AWS)](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/int-aws.html)
 *  [Microsoft Azure](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/int-azure.html)
 *  [Google Cloud Platform (GCP)](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/int-google.html)

<!-- </ul> -->

**Parent topic:**[Services and integrations](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/svc-int.html)

<!-- </article "role="article" "> -->
# Integrating with Google Cloud Platform #

You can configure an integration with the Google Cloud Platform (GCP) to allow IBM watsonx users to access data sources from GCP\. Before proceeding, make sure you have proper permissions\.

After you configure an integration, you'll see it under **Service instances**\. For example, you'll see a new **GCP** tab that lists your BigQuery data sets and Storage buckets\.

To configure an integration with GCP:

<!-- <ol> -->

1.  Log on to the Google Cloud Platform at [https://console\.cloud\.google\.com](https://console.cloud.google.com)\.
2.  Go to **IAM & Admin > Service Accounts**\.
3.  Open your project and then click **CREATE SERVICE ACCOUNT**\.1\. Specify a name and description for the new service account and click **CREATE**\. Specify other options as desired and click **DONE**\.1\. Click the actions menu next to the service instance and select **Create key**\. For key type, select **JSON** and then click **CREATE**\. The JSON key file will be downloaded to your machine\.
    
    Important: Write down your key ID and secret and store them in a sStore the key file in a secure location.
4.  In IBM watsonx, under **Administrator > Cloud integrations**, go to the **GCP** tab, enable integration, and then paste the contents from the JSON key file into the text field\. Only certain properties from the JSON will be stored, and the `private_key` property will be encrypted\.
5.  Go back to Google Cloud Platform and edit the service account you created previously\. Add the following roles:
6.  Confirm that you can see your GCP services\. From the main menu, choose **Administration > Services > Services instances**\. Click the **GCP** tab to see those services, for example, BigQuery data sets and Storage buckets\.

<!-- </ol> -->

Now users who have credentials to your GCP services can can [create connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html) to them by selecting them on the **Add connection** page\. Then they can access data from those connections by [creating connected data assets](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/connected-data.html)\.

## Next steps ##

<!-- <ul> -->

 *  [Set up a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/projects.html)
 *  [Create connections in a project](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/create-conn.html)

<!-- </ul> -->

**Parent topic:**

<!-- </article "role="article" "> -->
# Managing your IBM Cloud account #

You can manage your IBM Cloud account to view billing and usage, manage account users, and manage services\.

**Required permissions** : You must be the IBM Cloud account owner or administrator\.

To manage your IBM Cloud account, choose **Administration > Account and billing > Account > Manage in IBM Cloud** from IBM watsonx\. Then from the IBM Cloud console, choose an option from the **Manage** menu\.

<!-- <ul> -->

 *  Account: See [Adding orgs and spaces](https://cloud.ibm.com/docs/account?topic=account-orgsspacesusers#orgsspacesusers) and [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs)\.
 *  Billing and Usage: See [How you're charged](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-charges#charges)\.
 *  Access (IAM): See [Inviting users](https://cloud.ibm.com/docs/account?topic=account-access-getstarted)\.

<!-- </ul> -->

## Learn more ##

<!-- <ul> -->

 *  [Activity Tracker events](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/at-events.html)
 *  [Manage your settings](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/personal-settings.html)
 *  [Set up IBM watsonx for your organization](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/setup-platform.html)
 *  [Manage users and access](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/setup-access.html)
 *  [IBM Cloud SAML Federation Guide](https://www.ibm.com/cloud/blog/ibm-cloud-saml-federation-guide)
 *  [Delete your IBM Cloud account](https://dataplatform.cloud.ibm.com/docs/content/wsj/console/wdp_admin_console.html#deletecloud)
 *  [Check the status of IBM Cloud services](https://dataplatform.cloud.ibm.com/docs/content/wsj/troubleshoot/service-status.html)
 *  [Configure private service endpoints](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/endpoints-vrf.html)

<!-- </ul> -->

**Parent topic:**[Administration](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/administer-accounts.html)

<!-- </article "role="article" "> -->
# Services and integrations #

You can extend the functionality of the platform by provisioning other services and components, and integrating with other cloud platforms\.

<!-- <ul> -->

 *  [Provision instances of services and components from the Services catalog](https://dataplatform.cloud.ibm.com/docs/content/svc-welcome/cloud-services.html)\. Add service instances and components to the IBM Cloud account to add functionality to the platform\. You must be the owner or be assigned the **Administrator** or **Editor** role in the IBM Cloud account for IBM watsonx to provision service instances\.
 *  [Integrate with other cloud platforms](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/int-cloud.html)\. Allow users to easily create connections to data sources on those cloud platforms\. You must have the required roles or permissions on the other cloud platform accounts\.
 *  [View regional availability and limitations](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/regional-datactr.html)\. Get information about where services are available by region\.
 *  To integrate with data sources, you can [create many types of connections](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/conn_types.html) to work with a broad array of data sources\. Refer to [Connecting to data behind a firewall](https://dataplatform.cloud.ibm.com/docs/content/wsj/manage-data/securingconn.html) to create secure connections for data sources that are not externalized to the internet\.

<!-- </ul> -->

<!-- </article "role="article" "> -->
# Determining your roles and permissions #

You have multiple roles within IBM Cloud and IBM watsonx that provide permissions\. You can determine what each of your roles are, and, when necessary, who can change your roles\.

## Projects and catalogs roles ##

To determine your role in a project or deployment space, look at the **Access Control** page on the **Manage** tab\. Your role is listed next to your name or the service ID you use to log in\.

The permissions that are associated with each role are specific to the type of workspace:

<!-- <ul> -->

 *  [Project collaborator permissions](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/collaborator-permissions.html)
 *  [Deployment space collaborator permissions](https://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/collaborator-permissions-wml.html)

<!-- </ul> -->

If you want a different role, ask someone who has the **Admin** role on the **Access Control** page to change your role\.

## IBM Cloud IAM account and service access roles ##

You can see your IAM account and service access roles in IBM Cloud\.

To see your IAM account and service access roles in IBM Cloud:

<!-- <ol> -->

1.  From the IBM watsonx main menu, click **Administration > Access (IAM)**\.
2.  Click **Users**, then click your name\.
3.  Click the **Access policies** tab\. You might have multiple entries:
    
    <!-- <ul> -->
    
     *  The **All resources in account (including future IAM enabled services)** entry shows your general roles for all services in the account.
     *  Other entries might show your roles for individual services.
    
    <!-- </ul> -->
    
<!-- </ol> -->

If you want the IBM Cloud account administrator role or another role, ask an IBM Cloud account owner or administrator to assign it to you\. You can [find your account administrators](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/faq.html#accountadmin) on your **Access (IAM) > Users** page in IBM Cloud\.

## Learn more ##

<!-- <ul> -->

 *  [Roles in IBM watsonx](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/roles.html)
 *  [Find your IBM Cloud account owner or administrator](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/faq.html#accountadmin)

<!-- </ul> -->

**Parent topic:**[Administration](https://dataplatform.cloud.ibm.com/docs/content/wsj/admin/administer-accounts.html)

<!-- </article "role="article" "> -->
# Attribute inference attack #

![icon for privacy risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-privacy.svg)Risks associated with inputInferencePrivacyAmplified

### Description ###

An attribute inference attack is used to detect whether certain sensitive features can be inferred about individuals who participated in training a model\. These attacks occur when an adversary has some prior knowledge about the training data and uses that knowledge to infer the sensitive data\.

### Why is attribute inference attack a concern for foundation models? ###

With a successful attack, the attacker can gain valuable information such as sensitive personal information or intellectual property\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Benign advice #

![icon for value alignment risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-value-alignment.svg)Risks associated with outputValue alignmentNew

### Description ###

When a model generates information that is factually correct but not specific enough for the current context, the benign advice can be potentially harmful\. For example, a model might provide medical, financial, and legal advice or recommendations for a specific problem that the end user may act on even when they should not\.

### Why is benign advice a concern for foundation models? ###

A person might act on incomplete advice or worry about a situation that is not applicable to them due to the overgeneralized nature of the content generated\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Data bias #

![icon for fairness risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-fairness.svg)Risks associated with inputTraining and tuning phaseFairnessAmplified

### Description ###

Historical, representational, and societal biases present in the data used to train and fine tune the model can adversely affect model behavior\.

### Why is data bias a concern for foundation models? ###

Training an AI system on data with bias, such as historical or representational bias, could lead to biased or skewed outputs that may unfairly represent or otherwise discriminate against certain groups or individuals\. In addition to negative societal impacts, business entities could face legal consequences or reputational harms from biased model outcomes\.

Example

#### Healthcare Bias ####

Research on reinforcing disparities in medicine highlights that using data and AI to transform how people receive healthcare is only as strong as the data behind it, meaning use of training data with poor minority representation can lead to growing health inequalities\.

Sources:

[Science, September 2022](https://www.science.org/doi/10.1126/science.abo2788)

[Forbes, December 2022](https://www.forbes.com/sites/adigaskell/2022/12/02/minority-patients-often-left-behind-by-health-ai/?sh=31d28a225b41)

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Confidential data disclosure #

![icon for intellectual property risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-intellectual-property.svg)Risks associated with inputTraining and tuning phaseIntellectual propertyTraditional

### Description ###

Models might be trained or fine\-tuned using confidential data or the company’s intellectual property, which could result in unwanted disclosure of that information\.

### Why is confidential data disclosure a concern for foundation models? ###

If not developed in accordance with data protection rules and regulations, the model might expose confidential information or IP in the generated output or through an adversarial attack\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Confidential data in prompt #

![icon for intellectual property risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-intellectual-property.svg)Risks associated with inputInferenceIntellectual propertyNew

### Description ###

Inclusion of confidential data as a part of a generative model's prompt, either through the system prompt design or through the inclusion of end user input, might later result in unintended reuse or disclosure of that information\.

### Why is confidential data in prompt a concern for foundation models? ###

If not properly developed to secure confidential data, the model might expose confidential information or IP in the generated output\. Additionally, end users' confidential information might be unintentionally collected and stored\.

Example

#### Disclosure of Confidential Information ####

As per the source article, employees of Samsung disclosed confidential information to OpenAI through their use of ChatGPT\. In one instance, an employee pasted confidential source code to check for errors\. In another, an employee shared code with ChatGPT and "requested code optimization\." A third shared a recording of a meeting to convert into notes for a presentation\. Samsung has limited internal ChatGPT usage in response to these incidents, but it is unlikely that they will be able to recall any of their data\. Additionally, that article highlighted that in response to the risk of leaking confidential information and other sensitive information, companies like Apple, JPMorgan Chase\. Deutsche Bank, Verizon, Walmart, Samsung, Amazon, and Accenture have placed several restrictions on the usage of ChatGPT\.

Sources:

[Business Insider, February 2023](https://www.businessinsider.com/walmart-warns-workers-dont-share-sensitive-information-chatgpt-generative-ai-2023-2)

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Copyright infringement #

![icon for intellectual property risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-intellectual-property.svg)Risks associated with outputIntellectual propertyNew

### Description ###

Generative AI output that is too similar or identical to existing work risks claims of copyright infringement\. Uncertainty and variability around the ownership, copyrightability, and patentability of output generated by AI increases the risk of copyright infringement problems\.

### Why is copyright infringement a concern for foundation models? ###

Laws and regulations concerning the use of content that looks the same or closely similar to other copyrighted data are largely unsettled and can vary from country to country, providing challenges in determining and implementing compliance\. Business entities could face fines, reputational harms, and other legal consequences\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Dangerous use #

![icon for misuse risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-misuse.svg)Risks associated with outputMisuseNew

### Description ###

The possibility that a model could be misused for dangerous purposes such as creating plans to develop weapons, malware, or causing harm to others is the risk of dangerous use\.

### Why is dangerous use a concern for foundation models? ###

Enabling people to harm others is unethical and can be illegal\. A model that has this potential must be properly governed\. Otherwise, business entities could face fines, reputational harms, and other legal consequences\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Data aquisition #

![icon for data laws risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-data-laws.svg)Risks associated with inputTraining and tuning phaseData lawsTraditional

### Description ###

Laws and other regulations might limit the collection of certain types of data for specific AI use cases\.

### Why is data aquisition a concern for foundation models? ###

Failing to comply with data usage laws might result in fines and other legal consequences\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Data curation #

![icon for value alignment risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-value-alignment.svg)Risks associated with inputTraining and tuning phaseValue alignmentAmplified

### Description ###

When training or tuning data is improperly collected or prepared, the result can be a misalignment of a model's desired values or intent and the actual outcome\.

### Why is data curation a concern for foundation models? ###

Improper data curation can adversely affect how a model is trained, resulting in a model that does not behave in accordance with the intended values\. Correcting problems after the model is trained and deployed might be insufficient for guaranteeing proper behavior\. Improper model behavior can result in business entities facing legal consequences or reputational harms\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Data poisoning #

![icon for robustness risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-robustness.svg)Risks associated with inputTraining and tuning phaseRobustnessTraditional

### Description ###

Data poisoning is a type of adversarial attack where an adversary or malicious insider injects intentionally corrupted, false, misleading, or incorrect samples into the training or fine\-tuning dataset\.

### Why is data poisoning a concern for foundation models? ###

Poisoning data can make the model sensitive to a malicious data pattern and produce the adversary’s desired output\. It can create a security risk where adversaries can force model behavior for their own benefit\. In addition to producing unintended and potentially malicious results, a model misalignment from data poisoning can result in business entities facing legal consequences or reputational harms\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->
# Data provenance #

![icon for transparency risk](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/images/risk-transparency.svg)Risks associated with inputTraining and tuning phaseTransparencyAmplified

### Description ###

Without standardized and established methods for verifying where data came from, there are no guarantees that available data is what it claims to be\.

### Why is data provenance a concern for foundation models? ###

Not all data sources are trustworthy\. Data might have been unethically collected, manipulated, or falsified\. Using such data can result in undesirable behaviors in the model\. Business entities could face fines, reputational harms, and other legal consequences\.

**Parent topic:**[AI risk atlas](https://dataplatform.cloud.ibm.com/docs/content/wsj/ai-risk-atlas/ai-risk-atlas.html)

<!-- </article "role="article" "> -->