vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The instance must be in a Running state.
3. On the Instance details page, scroll to the list of Storage volumes and click Attach volumes. A side panel opens for you to define the volume attachment.
4. From the Attach data volume panel, expand the list of Block volumes, and select Create a data volume.
5. Select Import from snapshot. Expand the Snapshot list and select a backup snapshot.
6. Optionally, increase the size of the volume within the specified range.
7. Click Save. The side panel closes and messages indicate that the restored volume is being attached to the instance.



The new volume appears in the list of Storage volumes. Hover over the camera icon to see the name of the backup snapshot from which it was created.







 Restoring a volume from a snapshot from the CLI 

Use the CLI to create a boot or data volume from a backup snapshot. The commands are the same as the ones that are used to restore a volume from a manually created snapshot. For more information, see [Restore a volume from a snapshot with the CLI](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=clisnapshots-vpc-restore-CLI).

For more information about all backup service commands, see the [VPC CLI reference](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).





 Restoring a volume from a backup snapshot with the API 

You can restore boot and data volumes from a backup snapshot with the VPC API. To begin, make a GET /snapshots request to see a list of snapshots. You can filter by resource group and source volume ID in the request.



* To restore a boot volume from a bootable backup snapshot, specify the boot volume attachment and snapshot ID in the POST /instances request.
* To restore a data volume from a backup snapshot and attach it, specify the data volume attachment and snapshot ID in the POST /instances request.
* Added information on an approved variation of the VPC reference architecture to allow public internet access to the workload VPC. Added related tutorials on setting up a virtual network firewall in a new edge/transit VPC.







 14 October 2021 



* Revamped [Best practices for software as a service](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices). Added clarifications and detail. Also, added some new best practices derived from the Control Implementation Overview Template documents.







 07 April 2021 



* Initial release.
For more information, see [About IP spoofing](https://cloud.ibm.com/docs/vpc?topic=vpc-ip-spoofing-about).







 October 2020 



 30 October 2020 

Virtual private endpoint gateways (GA)
: IBM Cloud Virtual Private Endpoints (VPE) for VPC is now generally available. This service enables you to connect to supported IBM Cloud services from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe).





 1 October 2020 

Encrypted images (GA)
: Support for encrypting and importing a custom image is now generally available. For more information, see [Creating an encrypted custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-image).

UI enhancements
: Improved name validation when an existing resource name is specified for a new resource
: New way to view and select instance profiles in a side window when you provision an instance
: Enhanced security group details page to include attached network interfaces, with a link to manage the interfaces







 September 2020 



 24 September 2020 

New SDK
: The [Java SDK](https://cloud.ibm.com/apidocs/vpc?code=java) is now generally available.





 04 September 2020 

Network load balancer (GA)
: The IBM Cloud Network load balancer (NLB) for VPC is now generally available. Use the network load balancer to distribute traffic among multiple server instances within the same region of your VPC. For more information, see [About IBM Cloud Network Load Balancer for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-network-load-balancers).





 01 September 2020 

New region
* Encrypts data by using [IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-aboutservices-security-hpcs), which enables keep your own key (KYOK) functionality which provides technical assurance that IBM cannot access your keys.







 Variation with edge or transit VPC for public internet access 

The architecture in the previous section is the most secure way of enabling consumers to access the applications that are running in a workload VPC. However, there might be valid cases where it is desirable to allow consumers to access your service through the public internet. The same base architecture can be adapted to securely enable this type of access.

Zoom

![High-level VPC reference architecture with edge VPC for the IBM Cloud for Financial Services](https://cloud.ibm.com/docs-content/v1/content/9ac5c38b41e0aa1cb4ccc6cc7f547751ec805221/framework-financial-services/vpc/images/vpc-high-level/vpc-high-level-v2-with-edge.svg)

Figure 2. High-level VPC reference architecture with edge/transit VPC

The revised architecture adds:



* [IBM Cloud® Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-getting-started) (CIS) to provide global load balancing and layer 3/4 protection against distributed denial-of-service (DDoS) attacks.
* Virtual network firewall software in the workload VPC to provide web application firewall (WAF) protection and layer 7 protection against denial-of-service (DoS) attacks.



See [VPC architecture with virtual servers](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-detailed-vsiedge-vpc-architecture) for more details on this variation.





 Financial Services Validated services
* When the last data pull times out and fails, the file service determines that it is a disaster recovery situation. Then, the service breaks the replication relationship. The replica file share becomes read/write and operates as an independent file share.
* Replication relationship cannot be reestablished. However, you can set up a new replica on the original site if and when the site becomes operational again.



Due to the nature of the disaster recovery failover, you might find that the latest data set did not get copied over. In that case, you probably need to reconcile the state of your application manually when the source file share is available again. If the source file share zone becomes available again, data is available from the replica share to reconcile from the time of the incident to the recovery point.







 Restrictions 

These restrictions apply when you perform a failover.



* The default timeout for a successful failover is 5 minutes. You can modify this value when you [initiate the failover](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-failoverfs-failover-procedure-ui) options.
* A failover remains pending when other operations are being performed on the source file share, such as expanding the share size. When the operation completes, the failover resumes.







 Failover in the UI 



1. Navigate to the list of all file shares. In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > File Shares.
2. Click the name of a replica file share to open its details page.
3. From the Actions menu, select Perform failover. In the side panel, you can preview the changes. Before performing the failover, a final sync of the files is performed to ensure that the failover share has the latest content. When the failover completes, the replica file share becomes the new source file share. The former source share becomes the new read-only replica share.
4.
: When you migrate a classic virtual server instance from a dedicated host to IBM Cloud VPC, you now have the option to continue to migrate it as a single-tenant model (dedicated host) or change it to a shared-tenant model (public). For more information, see [Dedicated hosts](https://cloud.ibm.com/docs/wanclouds-vpc-plus?topic=wanclouds-vpc-plus-migration-considerationsdedicated-hosts).

Data migration for block and file storage
: You can now migrate classic block and file storage to IBM Cloud VPC with the VPC+ tool. For more information, see [Data storage considerations for attached, block, and file storage](https://cloud.ibm.com/docs/wanclouds-vpc-plus?topic=wanclouds-vpc-plus-migration-considerationsstorage).





 March 2021 

VMDK image conversion
: You can now migrate a VMDK-formatted image from IBM Cloud classic infrastructure to IBM Cloud VPC by using the VPC+ tool. For more information, see [VMDK image conversion](https://cloud.ibm.com/docs/docs/wanclouds-vpc-plus?topic=wanclouds-vpc-plus-migration-considerationsvmdk-image-conversion).





 December 2020 

Instance groups for auto scaling
: You can now discover virtual server instances that are associated with instance groups. For more information, see [Instance groups for auto scaling](https://cloud.ibm.com/docs/wanclouds-vpc-plus?topic=wanclouds-vpc-plus-migration-considerationsauto-scale).

Secondary attached storage
: Support is now available to migrate secondary attached storage for virtual server instances. For more information, see [Data storage considerations for attached, block, and file storage](https://cloud.ibm.com/docs/wanclouds-vpc-plus?topic=wanclouds-vpc-plus-migration-considerationsstorage).

Bug fix
This feature can be used in disaster recovery scenarios when you need to start your virtual server instance and data volumes in a different region. Or you can use the remote copy to create storage volumes in a new region to expand your VPC.

When you choose to create a cross-regional copy of a snapshot, you need to specify a single snapshot to be copied to the target region. The snapshot is created as normal, and stored in your regional Object Storage. A copy of the snapshot is created in an Object Storage bucket in the target region.

If the source snapshot is not encrypted with a customer key, the encryption of the copy remains provider-managed. If the source snapshot is protected by a customer-managed key, you must specify the customer-managed key that you want to use to encrypt the new copy.

Only one copy of the snapshot can exist in each region. You can't create a copy in the local (source) region.

The first time that you create a cross-regional copy, the snapshot is a full copy of the parent volume's data. Subsequent snapshots of the same volume contain only the changes that occurred since the previous snapshot was taken. The only exception to this rule is when you change the encryption type or the encryption key of the parent snapshot. When you change the encryption, the new remote copy needs to be a full copy of the parent snapshot, not an incremental copy.

You can use and manage the cross-regional snapshot in the target region independently from the parent volume or the original snapshot.

Creating a cross-regional copy affects billing. You're charged for the data transfer and the storage consumption in the target region separately.

You can create and manage cross-regional snapshot copies in the UI, from the CLI, with the API, or Terraform.





 Tags for Block Storage for VPC snapshots
You can also choose Customer Managed and use [your own encryption key](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption). 



4. When you're finished, click Create volume. You're returned to the Block Storage for VPC volumes page, where a message indicates that the volume is being created (volume status is pending). A second message displays when the volume is created (volume status is available).
5. To see details of the new volume, select the View resource link in the second message to go to the Volume details page.







 Creating a stand-alone Block Storage for VPC volume from a snapshot in the UI 

When you [create a Block Storage for VPC volume](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=clicreate-standalone-vol), you can select a snapshot and use its data to create the new volume. The snapshots that are presented are in a stable state. The data volume that is created from the snapshot is not attached to an instance and appears in the [list of Block Storage for VPC volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-viewing-block-storage&interface=uiviewvols-ui). You can later attach the volume to an instance.

You can restore a boot volume from a "bootable" snapshot. The boot volume is restored when you create a new virtual server instance.



1. [IBM Cloud console)](https://cloud.ibm.com/login), go to menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. Select Create.
3. Specify the volume name, optional resource group and tags, and specify the location. You're going to use the data from a snapshot to provision the volume.
4. Under Snapshot (optional), click Select snapshot.
You can enable secure end-to-end encryption of your data when you use file shares with security-group-based access control mode and mount targets with virtual network interfaces. When such a mount target is attached and the share is mounted on a virtual server instance, the virtual network interface performs security group policy check to ensure only authorized instances can communicate with the share. The traffic between the authorized virtual server instance and the file share can be IPsec encapsulated by the client. For more information, see [Encryption in transit - Securing mount connections between file share and host](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-eit).

Encryption in transit is not supported between File Storage for VPC and Bare Metal Servers for VPC.
* Why don't I see any IBM Cloud Object Storage buckets as options when I create a flow log collector?

The most likely reasons why you might not see your Object Storage buckets when you order a flow log collector:



* an IBM Cloud® Object Storage service instance isn't provisioned or a destination bucket to collect flow logs.
* An IAM authorization that grants the flow logs service permission to write flow logs to their bucket isn't configured. In this case, you receive prompts to create an Object Storage service instance and bucket, and add the required Identity and Access Management (IAM) authorization when you are creating a flow log collector. See [Creating flow log collectors](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-flow-log-collector) for information on how to remedy this issue.



* Why am I getting a 403 error when I provision a flow log collector?

Likely causes of this error include:



* Your user is not authorized to access the specified target of the flow log collector.
* Your IBM Cloud® Object Storage bucket is missing the Identity Authorization Management (IAM) authorization to allow the flow logs service to write flow logs to your bucket.



* Can I create multiple flow log collectors?

You can create multiple flow log collectors on the condition that they are on different targets. Keep in mind that flow log collectors with different target scopes might overlap.
Learn more 

[Architecture Center<br><br>Discover the architecture references available for this product.<br><br>![190-Application-Platform.svg](https://cloud.ibm.com/media/docs/images/homepage/190-Application-Platform.svg)](https://www.ibm.com/cloud/architecture/architectures/virtual-private-cloud)

 Latest updates 

[View more](https://cloud.ibm.com/docs/vpc?topic=vpc-release-notes)14 July 2023 | Very High Memory (vx2d) profile family now available in all regions

The vx2d profile is now available in the Sao Paolo region. Adding this region makes this profile family available in all regions.

11 July 2023 | Image lifecycle management for custom images (GA)

This image lifecycle management feature is now generally available. You can use the UI, CLI, and API to manage the lifecycle of your custom images with the following three statuses. You can move the image back and forth through all the statuses. You can also schedule status changes to manage the entire lifecycle of the image.

27 June 2023 | Snapshots for VPC Cross Regional Copy (GA)

Customers can now create a copy of a snapshot in a different region, and later use that copy to restore a volume in the new region. This feature can be beneficial in disaster recovery scenarios when the customer needs to start their virtual server instance and data volumes in a different region. Customers can also use the remote copy to create storage volumes in a new region and expand their VPC in new locations.
You can also choose Customer Managed and use [your own encryption key](https://cloud.ibm.com/docs/vpc?topic=vpc-block-storage-vpc-encryption). 



4. When you're finished, click Create volume. You're returned to the Block Storage for VPC volumes page, where a message indicates that the volume is being created (volume status is pending). A second message displays when the volume is created (volume status is available).
5. To see details of the new volume, select the View resource link in the second message to go to the Volume details page.







 Creating a stand-alone Block Storage for VPC volume from a snapshot in the UI 

When you [create a Block Storage for VPC volume](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage&interface=uicreate-standalone-vol), you can select a snapshot and use its data to create the new volume. The snapshots that are presented are in a stable state. The data volume that is created from the snapshot is not attached to an instance and appears in the [list of Block Storage for VPC volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-viewing-block-storage&interface=uiviewvols-ui). You can later attach the volume to an instance.

You can restore a boot volume from a "bootable" snapshot. The boot volume is restored when you create a new virtual server instance.



1. [IBM Cloud console)](https://cloud.ibm.com/login), go to menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. Select Create.
3. Specify the volume name, optional resource group and tags, and specify the location. You're going to use the data from a snapshot to provision the volume.
4. Under Snapshot (optional), click Select snapshot.
* Bastion server (jumphost) in mgmt subnet and generates an SSH Key
* DevOps provisions the virtual server web servers in subnet-1 and subnet-2 with security groups



3. DevOps deploys 2 IBM Cloud Load Balancer, 1 in each AZ and points to the virtual server web servers in their respective zones.
4. System admin enables HTTPS encryption by adding the domain SSL certificate to the certificate manager service.
5. DevOps deploys a CIS instance with associated domain and create a global load balancer that points to each load balancer in each zone.
6. Users can now make HTTP/HTTPS requests.







 Before you begin 



* Check the permissions for IBM Cloud VPC. Your account needs to have permissions to create resources.
* Generate SSH Keys from your workstation to connect bastion server







 Step 1: Create VPC, subnets, security groups, and virtual servers 

In the following section, you create your own VPC in region 1 with subnets that are created in two different zones of region 1. You then provision the virtual servers.

To create your own IBM Cloud VPC in region 1, complete the following steps:



1. From the [VPC overview page](https://cloud.ibm.com/vpc/overview), go to the VPCs page and click Create to begin.
2. Under New virtual private cloud section:



* Enter vpc-region1 as the name for your VPC.
* Select a Resource group.
* Optionally, add Tags to organize your resources.



3. Use the default access control list (Allow all).
4. Disable Allow SSH and Allow ping from the Default security group. Enable Enable access to classic resource.
5. Enable Create a default prefix for each zone.
6. Under New subnet for VPC:



* Type vpc1-region1-zone1-mgmt as your subnet's unique name.
* Select a Resource group.
* Select a Location and zone 1. For example, London and London 1.
* Select the number of IP addresses.



7.
[menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. On the Block Storage for VPC volume details page, select the Snapshots and Backups tab. A list of snapshots that were created manually or by backup policies is shown.
3. From the list, click the snapshot name to go to its details page.
4. From the Actions menu, click Create volume.
5. Define the new volume in the side panel. The information that you need to provide is the same as when you create a volume from the [list of snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restoresnapshots-vpc-restore-snaphot-list-ui). See Table 1 for the details.
6. When you're finished, click Save. The new volume is created.







 Creating a volume from a snapshot when you provision a virtual server instance in the UI 

Follow these steps to create a boot and a data volume from snapshots when you provision a new virtual server instance.



1. In the [IBM Cloud console](https://cloud.ibm.com/login), click the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Virtual server instances.
2. Click Create and provision your new instance. For more information about the required fields, see the table in [Creating virtual server instances in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).
3.
All backups are deleted if a virtual organization is deleted.





 Protecting your sensitive data in VMware Solutions 



 IBM Cloud Support access 

IBM Cloud Support has access to your VMware virtualization environment.



* For VMware Shared, IBM Cloud manages the virtualization environment and this access cannot be revoked.
* For vCenter Server, IBM maintains this access to enable automated Day 2 operations such as capacity expansion, and to enable support for problem resolution. For more information, see the following topics.



* [Policy for accessing clients' instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_compl_infovc_compl_info-policy-for-access-client-inst)
* [Consent to accessing client environments](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_compl_infovc_compl_info-consent-to-access-client-environment)





For vCenter Server, you can take steps to limit IBM Cloud access to your instance. These steps can include the following actions:



* You must create a functional IBM Cloud account to own the API key that you provide to VMware Solutions for provisioning. Ensure that you monitor the mailbox of this account for notices.
* You can regenerate this API key to revoke automation and support access to your API key. When you need to restore IBM Cloud access, for example, to deploy a new host, you must reenter the API key in the VMware Solutions Settings page.
* IBM Cloud retains a set of [user IDs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-audit_user_ids) in your instance. You can disable or revoke these user IDs. When you need to restore IBM Cloud access, for example, to deploy a new host, you must re-enable these accounts. If you changed the password for these accounts, you must open a support ticket to provide the updated password to IBM Cloud.







 About customer-managed keys