vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Secrets Manager replaces the existing value with a randomly generated 32-character password that contains uppercase letters, lowercase letters, digits, and symbols.

The command outputs the value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-version-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-version-create-command).





 Rotating imported certificates 

To reimport a certificate by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-version-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-version-create-command) command. For example, the following command rotates a secret and assigns new-secret-data as its new version.

ibmcloud secrets-manager secret-version-create 
--secret-id=SECRET_ID 
--secret-version-prototype='{"certificate": "new-secret-data", "custom_metadata": {"anyKey": "anyValue"}, "version_custom_metadata": {"anyKey": "anyValue"}}'

Replace new lines in the certificate, intermediate, and private key data with n.

The command outputs the value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-version-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-version-create-command).





 Rotating KV secrets
ne != http.request.uri.path ne "/articles/2010/" ip.src ne 93.184.216.0 cf.threat_score ne 60 
 lt < http.request.uri.path lt "/articles/2009/" cf.threat_score lt 10 
 le <= http.request.uri.path le "/articles/2008/" cf.threat_score le 20 
 gt http.request.uri.path gt "/articles/2006/" cf.threat_score gt 25 
 ge = Greater than or equal to cf.threat_score ge 60 
 contains http.request.uri.path contains "/articles/" 
 matches http.request.uri.path "^/articles/200[7-8]/$" 
 in http.request.method in { "HEAD" "GET" } ip.src in { 93.184.216.0 93.184.216.1 } cf.threat_score in {0 2 10} 



The evaluation of expressions using string values is case-sensitive. As such, a firewall rule might require you to define more than one test condition. Enterprise customers can use a regular expression with the matches operator to capture multiple variations with a single expression.





 Boolean comparison 

For fields of boolean type (for example, ssl) the field appears by itself in the expression when evaluating for a true condition. For a false condition, the not operator applies.



Table 6. Boolean comparison

 True False 

 ssl not ssl 









 Compound expressions 

You can create compound expressions by grouping two or more single expressions using logical operators.



Table 7. Compound expressions

 English C-like Description Example Precedence 

 not ! Logical NOT not ( http.host eq "www.example.com" and ip.src in 93.184.216.0/24 ) 1 
 and && Logical AND http.host eq "www.example.com" and ip.src in 93.184.216.0/24 2 
 xor ^^ Logical XOR http.host eq "www.example.com" xor ip.src in 93.184.216.0/24 3
"password": "TYRodi/HX7s095UpQ38)L1z(t4u003ccG6!2",
"username": "my-username"
},
"secret_type": "USERNAME_PASSWORD",
"state": 1,
"state_description": "Active"
},
"warnings": null
}







 Delete a secret 

Use this command to delete a secret. Allowable values for SECRET_TYPE are: arbitrary, iam_credentials, imported_cert, kv, private_cert, public_cert, and username_password.

Delete a secret in the default secret group.

vault delete ibmcloud/SECRET_TYPE/secrets/SECRET_ID

Delete a secret in an existing secret group.

vault delete ibmcloud/SECRET_TYPE/secrets/groups/SECRET_GROUP_ID/SECRET_ID



 Prerequisites 

You need the [Manager service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to delete secrets.





 Command options 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

Delete an arbitrary secret by its assigned ID.

vault delete ibmcloud/arbitrary/secrets/d26702aa-77ae-400e-4f25-9790a9cabf9c





 Output 

The command returns the following output:

Success! Data deleted (if it existed) at: ibmcloud/arbitrary/secrets/d26702aa-77ae-400e-4f25-9790a9cabf9c









 Dynamic secrets 

Dynamic secrets are single-use credentials that are generated only when they are read or accessed.

To create a dynamic secret by using the Vault CLI, use the role command to scope the secret with the wanted level of permissions in your IBM Cloud account.
Click Save.







 Policy: Password expiration 

For security reasons, you might want to enforce a password rotation policy. By setting an expiration for your users password, they are forced to update their password to retain access to your application. This lessens the chance that a user's credentials can cause long term damage to your application. When their password expires, your users are forced to reset it on their next sign-in attempt.

To set this configuration by using the GUI:



1. Go to the Cloud Directory > Password policies tab of the App ID dashboard.
2. Toggle Advanced password policy to Enabled.
3. Specify a Password expiration time. The time is specified in days. You can use any whole value in range 1 - 90.
4. Toggle Password expiration time to Enabled.
5. Click Save.



When this option is first set to on, any existing user passwords do not have an expiration date. To ensure that all your users are limited by the password rotation policy, you might encourage users to update their password after you configure this feature.



 Custom sign-in experience 

If you're using a custom sign-in experience, an error is triggered when a user attempts to sign in with an expired password. It is your responsibility to configure your application to provide the necessary user experience. You can call the change password API to set the new password.

The token endpoint response looks similar to the following:

{
"error" : "invalid_grant",
"error_description" : "Password expired",
"user_id" : "356e065e-49da-45f6-afa3-091a7b464f51"
}







 Policy: Ensure that the password does not include user name 

For stronger passwords, you might want to prevent users from creating a password that contains their username or the first part of their email address.

To set this configuration by using the GUI:



1. Go to the Cloud Directory > Password policies tab of the App ID dashboard.
2. Toggle Advanced password policy to Enabled.
3.
--keystores ([KeystoresPropertiesUpdate[]](https://cloud.ibm.com/docs/cli?topic=cli-hpcs-cli-pluginuko-keystores-properties-update-example-schema))
: Optional. An array describing the type and group of target keystores where the managed key is to be installed. The maximum length is 1 item. The minimum length is 1 item.

--description (string)
: Optional. The updated description of the key template. The length must be between 0 and 200 characters. The value must match the regular expression /(.|\n)/.

--key ([KeyPropertiesUpdate](https://cloud.ibm.com/docs/cli?topic=cli-hpcs-cli-pluginuko-key-properties-update-example-schema))
: Optional. Properties of the managed key.
* Example

ibmcloud hpcs uko key-template-update 
--id=07b62c12-75a2-46c9-9259-0cecde3985d2 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--if-match=2022-05-11T14:58:26Z 
--description="The update of the template" 
--output json
* Output

The command returns the output similar to the following example:

ETag
2022-05-20T15:20:06Z
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
Authentication Username The username that you use to connect. 
 Authentication Password A password for the user - might be shown as $PASSWORD 
 Authentication Method How authentication takes place; "direct" authentication is handled by the driver. 
 Hosts 0... A hostname and port to connect to. 
 Composed 0... A URI combining Authentication, Host, and Port used to connect. 
 Certificate Name The allocated name for the self-signed certificate for database deployment 
 Certificate Base64 A base64 encoded version of the certificate. 





* 0... indicates that there might be one or more of these entries in an array.







 The CLI and https Sections 

The CLI section contains information that is suited for the management plug-in and command-line clients that make connections to RabbitMQ.



Table 3. rabbitmqadmin/cli connection information

 Field Name Index Description 

 Bin The recommended binary to create a connection; in this case it is rabbitmqadmin. 
 Composed A formatted command to establish a connection to your deployment. The command combines the Bin executable, Environment variable settings, and uses Arguments as command-line parameters. 
 Environment A list of key/values you set as environment variables. 
 Arguments 0... The information that is passed as arguments to the command shown in the Bin field. 
 Certificate Base64 A self-signed certificate that is used to confirm that an application is connecting to the appropriate server. It is base64 encoded. 
 Certificate Name The allocated name for the self-signed certificate. 
 Type The type of package that uses this connection information; in this case cli. 





* 0... indicates that there might be one or more of these entries in an array.



The https section contains information that you can use to access the RabbitMQ management plug-in via web browser.



Table 4. https/uri connection information

 Field Name Index Description 

 Type Type of connection - for RabbitMQ, it is uri 
 Scheme Scheme for a URI - for RabbitMQ, it is https 
 Path Path for a URI 
 Authentication Username The username that you use to connect. 
 Authentication Password A password for the user - might be shown as $PASSWORD
tEqoiCu9CeUsbqRe6yBUkrJg80QKKG/z46OkX0YQMV8=





 Example 3 

Wrap a root key and provide AAD information.

One use case for supplying additional authentication data (AAD) is to "password protect" and add a "verification phrase" to the ciphertext, which makes it more difficult to unwrap.

The ciphertext and the AAD is required to unwrap the ciphertext and reveal the plaintext DEK.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

5f2cc155-fe16-492c-845c-4d1f0688c7ba

 set the additional authentication data (AAD)
$ AAD1=My-Secret-Password
$ AAD2=My-Verification-Phrase

 wrap the plaintext DEK with the root key and AAD
$ CIPHERTEXT=$(ibmcloud kp key wrap $KEY_ID -a "$AAD1,$AAD2" --output json | jq -r '.["Ciphertext"]')

$ echo $CIPHERTEXT

eyJjaXBoZXJ0ZXh0IjoiL1pQUzRLbUxQ ...<redacted>... ZjA2ODhjN2JiIn0=

 unwrap the ciphertext and reveal the original DEK
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD1,$AAD2

Unwrapping key...
OK
Plaintext Rewrapped Plaintext
H4ZfQe66aKcxirfCdNZ/3Na0JECP6HsAM3yclKmIfPQ=

 this should fail (missing some of the AAD)
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD1
The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.

Note: To find the version ID of a secret, use the Get secret metadata method and check the response details. Required.

The value must match regular expression /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|previous)$/.





 Examples 

ibmcloud secrets-manager secret-version --secret-type=arbitrary --id=exampleString --version-id=exampleString







 ibmcloud secrets-manager secret-version-update 

Invoke an action on a specified version of a secret. This method supports the following actions:



* revoke: Revoke a version of a private certificate.



ibmcloud secrets-manager secret-version-update --secret-type SECRET-TYPE --id ID --version-id VERSION-ID --action ACTION



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: private_cert.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.

--version-id (string)
: The v4 UUID that uniquely identifies the secret version. You can also use previous to retrieve the previous version.
The value must match the regular expression /^[A-Za-z]$/.

--key ([KeyProperties](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-pluginuko-key-properties-example-schema))
: Required. Properties that describe the managed key.

--keystores ([KeystoresPropertiesCreate[]](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-pluginuko-keystores-properties-create-example-schema))
: Required. An array describing the type and group of target keystores that the managed key is to be installed in. The maximum length is 1 item. The minimum length is 1 item.

--description (string)
: Optional. The description of the key template. The length must be between 0 and 200 characters. The value must match the regular expression /(.|\n)/.
* Example

ibmcloud hpcs uko key-template-create 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--vault='{"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b"}' 
--name=IBM-CLOUD-EXAMPLE-TEMPLATE 
--key='{"size": "256", "algorithm": "aes", "activation_date": "P5Y1M1W2D", "expiration_date": "P1Y2M1W4D", "state": "active"}' 
--keystores='[{"group": "Production", "type": "ibm_cloud_kms"}]' 
--description="IBM CLOUD key template description"
Environment Variables:
Type Name Value
Secret full reference mydatabasesec
Secret key reference password mydatabasesec-writer.password
Secret key reference username mydatabasesec-writer.username
Image: busybox
Resource Allocation:
CPU: 1
Memory: 4G

Runtime:
Array Indices: 0
Max Execution Time: 7200
Retry Limit: 3
3. Run a job that uses the writerpick job.

ibmcloud ce jobrun submit --name writerpick1 --job writerpick
4. Display the logs of the writerpick1 job run by using the [ibmcloud ce jobrun logs](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-jobrun-logs) command. You can display logs of all the instances of a job run or display logs of a specific instance of a job run. To display the logs of a specific instance of the job run, use the --instance option with the jobrun logs command. If needed, use the jobrun get --name writerpick1 command to display details of this job run, including the instances of the job run. Because the writerpick job was updated to reference specific keys in the mydatabasesec-writer secret and to reference the full mydatabasesec secret, the reference to the username and password keys in the mydatabasesec-writer secret overrides the reference to the full secret. Secret values are added to the environment decoded.

ibmcloud ce jobrun logs --instance writerpick1-0-0

Example output

Getting logs for job run instance 'writerpick1-0-0'...
[...]

username=writer
certificate=-----BEGIN CERTIFICATE--------
asdf;aksjdflkajsdflkjasldkfjalskdjflaksjdflk
-----END CERTFICIATE----------
password=wxyz
3000720 - Check whether App ID prevent username in password policy is enabled
3000723 - Check whether App ID multifactor authentication (MFA) is enabled for Cloud Directory users
3000724 - Check whether App ID access tokens are configured to expire within minutes
3000802 - Check whether Kubernetes Service is accessible only by using private endpoints
3000804 - Check whether Kubernetes Service clusters are enabled with IBM Cloud Monitoring
3000805 - Check whether Kubernetes Service clusters are enabled with IBM Log Analysis
3000902 - Check whether OpenShift clusters are accessible only by using private endpoints
3000907 - Check whether OpenShift version is up-to-date
Show more





 Security and Compliance Center rules 

The Terraform Analyzer supports the following Security and Compliance Center rules:

rule-f8722625-1968-4d7a-93cb-4b0f8da726da - Check whether IBMid password policy requires at least one uppercase letter
rule-789cb35b-5bdf-46d3-8b59-e1377e3b211c - Check whether IBMid password policy requires at least one lowercase letter
rule-81b36ae4-0f15-41c7-adac-fa9586ff46ab - Check whether IBMid password policy requires at least one number
rule-979fd713-d39f-4efe-ba02-bf6fc07e57bb - Check whether IBMid password policy requires minimum length of 12 characters
rule-e76a3a81-b0d0-41fc-947d-13dc9cfff379 - Check whether IBMid password policy prevents password reuse below the minimum of 
rule-759d504b-9eed-4602-8b5b-7244bf3f5690 - Check whether IBMid password may contain only printable ASCII characters (in the range 33 - 126)
A basic authentication secret contains a username and password key and is used to access a service that requires basic HTTP authentication. The following example creates a basic authentication secret with credentials for myusername and the associated password is provided in a file on the local workstation

ibmcloud ce secret create --name mysecret-basicauth --format basic_auth --username myusername --password-from-file ./password.txt

To display the details of this secret,

ibmcloud ce secret get --name mysecret-basicauth

Example output

Getting secret 'mysecret-basicauth'...
OK

Name: mysecret-basicauth
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Format: basic_auth
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 66s
Created: 2021-03-10T18:44:18-05:00

Data:
---
password: REDACTED
username: bXl1c2VybmFtZQ==

Notice that the value of the key username for this basic authentication secret is encoded, and the value of password is redacted. To display the secret data as decoded, use the --decode option with the secret get command.





 Creating a generic secret with the CLI 

A generic secret stores simple key-value pairs and Code Engine makes no assumptions about the defined key-value pairs nor about the intended use of the secret.

You can create a generic secret with the secret create command in one of the following ways. By default, a generic secret is created when the --format option is not specified.



* Create a secret directly from the command line by using the --from-literal option in KEY=VALUE format. For example,

ibmcloud ce secret create --name myliteralsecret --from-literal "TARGET=My literal secret"
[MAS-MS-CCC-Access-5](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AMT-Select-DB-Act.png)
7. You can provide a new password in the New Database Password field, or leave it blank to have one generated.

![MAS-MS-CCC-Access-5](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AMT-DB-New-Pwd.png)
8. Submit the request by pressing the Reset Database Password button. No Manager approval is required for this. You will receive an email notification when the password has been reset.

![MAS-MS-CCC-Access-13](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AMT-DB-PW-Reset.png)
9. Once the reset is complete you can return to the access record to retrieve the database password and SSL Certificate information. Use the Show Database Password and Show SSL Certificate checkboxes to display/hide the information.

![MAS-MS-CCC-Access-13](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AMT-DB-Details-Hidden.png)

!
create a random, base64-encoded, 32-byte data encryption key (DEK)
$ PLAINTEXT=$(openssl rand -base64 32)

$ echo $PLAINTEXT

H4ZfQe66aKcxirfCdNZ/3Na0JECP6HsAM3yclKmIfPQ=

 set the additional authentication data (AAD)
$ AAD1=My-Secret-Password
$ AAD2=My-Verification-Phrase

 wrap the plaintext with the root key and AAD
$ CIPHERTEXT=$(ibmcloud kp key wrap $KEY_ID -a "$AAD1,$AAD2" -p $PLAINTEXT --output json | jq -r '.["Ciphertext"]')

$ echo $CIPHERTEXT

eyJjaXBoZXJ0ZXh0IjoiL1pQUzRLbUxQ ...<redacted>... ZjA2ODhjN2JiIn0=

 unwrap the ciphertext and reveal the original plaintext DEK
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD1,$AAD2

Unwrapping key...
OK
Plaintext Rewrapped Plaintext
H4ZfQe66aKcxirfCdNZ/3Na0JECP6HsAM3yclKmIfPQ=

 this should fail (missing some of the AAD)
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD1

Unwrapping key...
FAILED

 this should fail (AAD is in a different order)
$ ibmcloud kp key unwrap $KEY_ID $CIPHERTEXT -a $AAD2,$AAD1

Unwrapping key...
FAILED







 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the root key that you used for the initial wrap request.
* CIPHERTEXT_FROM_WRAP
keyfile:
storage:
filestore:
enabled: false
storagepath:
 'remotestore' needs to be enabled if you want to generate keys with the attribute CKA_TOKEN.
remotestore:
enabled: true
users:
0: The index of the Security Officer (SO) user MUST be 0.
 The name for the Security Officer (SO) user. For example: "Administrator".
 NEVER put the API key under the SO user for security reasons.
name: "Administrator"
iamauth:
<<: defaultiamcredential
1: The index of the normal user MUST be 1.
 The name for the normal user. For example: "Normal user".
 NEVER put the API key under the normal user for security reasons.
name: "Normal user"
 The Space ID is a 128-bit UUID and can be chosen freely.
 The UUID can be generated by third-party tools, such as 'https://www.uuidgenerator.net/'.
 For example: "f00db2f1-4421-4032-a505-465bedfa845b".
 'tokenspaceID' under the normal user is to identify the private keystore.
tokenspaceID: "f00db2f1-4421-4032-a505-465bedfa845b"
iamauth:
<<: defaultiamcredential
2: The index of the anonymous user MUST be 2.
 The name for the anonymous user. For example: "Anonymous".
name: "Anonymous"
 The Space ID is a 128-bit UUID and can be chosen freely.
 The UUID can be generated by third-party tools, such as 'https://www.uuidgenerator.net/'.
 For example: "ca22be26-b798-4fdf-8c83-3e3a492dc215".
 'tokenspaceID' under the anonymous user is to identify the public keystore.
option in below screen.

Zoom

![MAS-MS-Password-Change-2](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Password-Change-2.png)

Figure 2. MAS Login Screen
3. A confirmation code will be sent to your e-mail address. Enter the code contained in your email and click Continue

Zoom

![MAS-MS-Password-Change-3](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Password-Change-3.png)

Figure 3. MAS Login Code Confirmation
4. The email with the confirmation code will look similar to below.

Zoom

![MAS-MS-Password-Change-4](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Password-Change-4.png)

Figure 4. MAS Login Code Email
5. After the code is enter in the above screen with the code you received over an email, you will see below screen asking for the password. You will receive the temporary password (again via email).

Zoom

![MAS-MS-Password-Change-5](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/MAS-MS-Password-Change-5.png)

Figure 5. MAS Login Temp Password
6.