vania-janet/multiturn-rag-retrieval-data huggingface dataset:
FAQs: Provisioning and operations 

Read to get answers for questions about provisioning an IBM Cloud® Hyper Protect Crypto Services instance and related operations.



 Are there any prerequisites for using Hyper Protect Crypto Services? 

To use Hyper Protect Crypto Services, you need to have a Pay-As-You-Go or Subscription IBM Cloud account.

If you don't have an IBM Cloud account, create an account first by going to [IBM Cloud registration](https://cloud.ibm.com/registration). To check your account type, go to [IBM Cloud](https://cloud.ibm.com/login) and click Management > Account > Account settings. You can also [apply your promo code](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-applying-promo-codes) if you have one. For more information about IBM Cloud accounts, see [FAQs for accounts](https://cloud.ibm.com/docs/account?topic=account-accountfaqs).

The service can be provisioned quickly by following instructions in [Provisioning service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision). However, in order to perform key management and cryptographic operations, you need to [initialize service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode) first by using IBM Cloud TKE CLI plug-in or the Management Utilities.





 How to initialize Hyper Protect Crypto Services service instances? 

To initialize the service instance, you need to create administrator signature keys, exit the imprint mode, and load the master key to the instance. To meet various security requirements of your enterprises, IBM offers you the following options to load the master key:



* [Using the IBM Hyper Protect Crypto Services Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities) for the highest level of security. This solution uses smart cards to store signature keys and master key parts.
[Create a VSI](https://test.cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers) in your account.
3. [Connect to the VSI](https://test.cloud.ibm.com/docs/vpc?topic=vpc-vsi_is_connecting_linux) from a terminal in your local environment.
4. After you ssh into the VSI, [install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli). Run the following command:

curl -fsSL https://clis.cloud.ibm.com/install/linux | sh



You can run the following command to check that you can access the private endpoints:

ping private.{region}.atracker.cloud.ibm.com

For example, you can run the following command to check access to the Dallas region:

ping private.us-south.atracker.cloud.ibm.com







 Step 1: Check your IAM permissions to work with Activity Tracker Event Routing 

Every user that manages Activity Tracker Event Routing configurations in your account must be assigned an access policy. The policy determines what actions the user can perform. The allowable actions are customized and defined by Activity Tracker Event Routing as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles. [Learn more](https://cloud.ibm.com/docs/atracker?topic=atracker-iam).

Your user ID needs account management permissions to manage Activity Tracker Event Routing configurations in the account. You need the administrator role for the Activity Tracker Event Routing service. You might need to contact the account administrator to get permissions to work with Activity Tracker Event Routing. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-account-services).
You must create a service ID for your IBM Cloud Object Storage instance. This service ID is used by the IBM Cloud Activity Tracker instance to authenticate with your IBM Cloud Object Storage instance.

You must assign specific access policies to the service ID that restrict permissions for using specific services, or even combine permissions for accessing different services.

Complete the following steps to create a service ID with writing permissions for the IBM Cloud Object Storage instance:



1. From the Dashboard, select the IBM Cloud Object Storage instance where you plan to create the bucket.
2. Select Service credentials. Then, select New credential.
3. Enter a name that it is easy to recognize. For example, you can name the service ID activity-tracker-cos-serviceID.
4. Select the Reader role.
5. Click Add.

A new service ID is created and added to the list.

Note: The service ID that is created in the IBM Cloud and listed through the IAM UI has a generic name. The name of the service ID in the IAM UI maps to the value of the field iam_apikey_name that you created in this step through the COS service ID UI.
6. [Optional] To lock the service ID to prevent deletion, from the menu bar, click Manage > Access (IAM). Search for the service ID. Then, select the action Lock.



For the service ID that you just created, click View credentials. You can see information that is related to the service ID.



* Copy the API key. This is the value set for the field apikey.

When the service credential is rotated, make sure the [API Key is updated with the new API Key.](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-archivingarchiving_step8) Archiving will stop if the API Key is not updated.
* Copy the resource instance ID. This is the value set for the field resource_instance_id.
* Copy the value of the iam_apikey_name field.







 Step 5.
IBM Cloud API key As an alternative to using the IBM Cloud username and password, you can [use IBM Cloud API keys](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key). IBM Cloud API keys are specific to the IBM Cloud account they are generated for. To access workspaces that were created in a different account other than the one your IBM Cloud API key is based on, you must generate an API key for that account. 





1. Create your IBM Cloud IAM access token.



The request body for your API token request depends on the IBM Cloud authentication method.

You can find the IBM Cloud IAM token in the access_token field of your API output. Note the IBM Cloud IAM token to retrieve additional header information in the next steps. sh {: codeblock} POST https://iam.cloud.ibm.com/identity/token 



Table

 Input parameters Values 

 Header :Content-Type: application/x-www-form-urlencoded:Authorization: Basic Yng6Yng=[^] <br>Yng6Yng= equals the URL-encoded authorization for the username bx and the password bx. 
 Body for IBM Cloud username and password :grant_type: password:response_type: cloud_iam uaa:username: Your IBM Cloud username.:password: Your IBM Cloud password.:uaa_client_id: cf:uaa_client_secret: <br>Add the uaa_client_secret key with no value specified. 
 Body for IBM Cloud API keys :grant_type: urn:ibm:params:oauth:grant-type:apikey:response_type: cloud_iam uaa:apikey: Your IBM Cloud API key:uaa_client_id: cf:uaa_client_secret: <br>Add the uaa_client_secret key with no value specified. 
 Body for IBM Cloud one-time passcode :grant_type:urn:ibm:params:oauth:grant-type:passcode:response_type: cloud_iam uaa:passcode: Your IBM Cloud one-time passcode.
To make sure that all account-related actions can be successfully performed, verify that the user has the correct IBM Cloud IAM platform access roles.



1. From the menu bar, select Manage > Access (IAM), and then click the Users page.
2. Click the name of the user who you want to set the API key for or whose credentials you want to set for the API key, and then click the Access policies tab.
3. [Assign the user](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-perms) the [minimum permissions that are needed to create and manage clusters](https://cloud.ibm.com/docs/containers?topic=containers-access_referencecluster_create_permissions).



3. To make sure that all infrastructure-related actions in your cluster can be successfully performed, verify that the user has the correct infrastructure access policies.



1. From the menu bar, select Manage > Access (IAM).
2. Select the Users tab, click on the user. The required infrastructure permissions vary depending on what type of [cluster infrastructure provider](https://cloud.ibm.com/docs/containers?topic=containers-infrastructure_providers) you use, classic or VPC.



* For classic clusters



1. In the API keys pane, verify that the user has a Classic infrastructure API key, or click Create an IBM Cloud API key. For more information, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keysclassic_keys).
2. Click the Classic infrastructure tab and then click the Permissions tab.
3. If the user doesn't have each category checked, you can use the Permission sets drop-down list to assign the Super User role. Or you can expand each category and give the user the required [infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-classic-roles).
Getting started with Db2 Warehouse on Cloud 

You can provision an instance of IBM Db2 Warehouse on Cloud through the [IBM Cloud catalog](https://cloud.ibm.com/catalog/db2-warehouse). Create a [free account](https://cloud.ibm.com/registration?target=%2Fcatalog%2Fservices%2Fdb2-warehouse) and get an IBM Cloud credit of $200 that you can use towards Db2 Warehouse on Cloud. You can also get a $1000 promo code to try out Db2 Warehouse on Cloud by following the instructions [here.](https://cloud.ibm.com/registration/premium1?target=/catalog/services/db2-warehouse&cm_mmca1=000030YW&cm_mmca2=DAFWW&S_PKG=ov34433&uucid=0040c3e10b80999b&cm_sp=cloud-product---onpagenav-ibmcloudplatform_db2-warehouse-on-cloud---bm_nsl_customize_leadspace)

After creating the IBM® Db2® Warehouse on Cloud service, you can create a user name and password by clicking the Service credentials tab on your service page and selecting New credential.

While logged in as the IAM user that provisioned the instance, you can log into the web console by clicking on the Go to UI button on the Manage tab.

You can create database/JDBC users, which you will use to connect to the database, by navigating to the Settings --> User Management panel. Additionally, you may want to give admin access to an IAM user to allow them to use console administration functions such as backup and restore.
Linking your accounts also provides you with a single invoice for all the PaaS and IaaS resources that you use.<br><br>If you do not have an IBM Cloud infrastructure account, request one by following the procedure in [Signing up for an IBM Cloud infrastructure account](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-signing_required_accountssigning_required_accounts-infra), and then link your IBM Cloud infrastructure account with your IBM Cloud account by following the procedure in [Upgrading your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account).<br><br>If you have an IBM Cloud infrastructure account, you can link it with your IBM Cloud account by following the procedure in [Upgrading your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account). 







 Deployment offerings 

Review and choose your deployment offering.



Table 2. Deployment offerings

 Deployment offering Description 

 [VMware as a Service](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vmware-aas-overview) This offering provides the VMware Cloud Director platform as a managed service. IBM® performs the configuration, hosting, operations, and lifecycle management of the VMware® software so you can quickly deploy your VMware-based cloud computing environments. 
 [VMware Shared](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-shared_overview) This offering provides standardized and customizable deployment choices of VMware® virtual data center environments. 
 [VMware vSphere®](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vs_vsphereclusteroverview) This offering provides a customizable virtualization service that combines VMware-compatible bare metal servers, hardware components, and licenses, to build your own IBM-hosted VMware environment.
Getting started with Informix on Cloud 

IBM® Informix® on Cloud for IBM Cloud provides you with a hosted server environment, which you can control and configure to your benefit. You can use Informix on Cloud to extend the reach of your business by easily expanding your database capacity in the IBM Cloud data center of your choice. IBM provides you with an initially configured Informix server that is exclusively yours to tailor to the needs of your business. Informix on Cloud provides several different plans so that any size business can access the IBM enterprise class database server.

Complete the following steps to create an account and get started with Informix on Cloud:

If you would like to register by contacting an IBM sales representative, use the following guidelines:



1. After logging in to IBM Cloud, select IBM Informix on Cloud from the catalog tab. Select from the last four plans that are listed which read Contact IBM Sales and click REQUEST. The currently supported plans are Small, Medium, Large, and Extra Large. The Extra Large plan is a bare metal system. The Small, Medium, and Large plans are on a virtual machine. A page then appears, displaying a detailed summary about your chosen plan. If you have a trial IBM Cloud account, you can expect a message that outlines the details about your trial. Review this information.
2. Provide any additional comments that you have, then click SEND to place your order. After you place your order, a confirmation email with the selected plan information is sent to you.
3. Confirm your order. When the system is ready, a welcome email with the information about accessing the system is sent to you.



If you would like to register by using your credit card directly without contacting an IBM sales representative, use the following the guidelines:



1. After logging in to IBM Cloud, select IBM Informix on Cloud from the catalog tab. Set your Datacenter location from the available dropdown menu. Select one of the four plans that are listed which do not read Contact IBM Sales and click CREATE. The currently supported plans are Small, Medium, Large, and Extra Large. The Extra Large plan is a bare metal system. The Small, Medium, and Large plans are on a virtual machine.
Use [IBM Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about) or [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview) to create, add, and manage keys, which you can then associate with your instance of IBM Cloud Object Storage.
5. Grant service authorization



1. Open your IBM Cloud dashboard.
2. From the menu bar, click Manage > Access.
3. In the side navigation, click Authorizations.
4. Click Create authorization.
5. In the Source service menu, select Cloud Object Storage.
6. In the Source service instance menu, select the service instance to authorize.
7. In the Target service menu, select IBM Key Protect or Hyper Protect Crypto Services.
8. In the Target service instance menu, select the service instance to authorize.
9. Enable the Reader role.
10. Click Authorize.









 How do I restrict access to a single bucket using IAM? 



1. Go to the IBM Cloud Object Storage page for [using service credentials](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-service-credentialsservice-credentials-bucket) to research the authentication topic.
2. Create a bucket, but do not add any public or other permissions to it.
3. To add the new user you first need to leave the current Object Storage interface and head for the IAM console. Go to the Manage menu and follow the link at Access (IAM) > Users. Click Service Credentials.
4. Click New credential and provide the necessary information. If you want to generate HMAC credentials, click the 'Include HMAC Credential' check box. Select the "Manager" service access role to allow the user to manage the bucket that you will select next.
5. Click Add to generate service credential.







 How do I resolve a 404 error when using the command line?
Part 1: Set up prerequisites 

This tutorial is part 1 of a 3-part tutorial series where you learn IBM Cloud® DevSecOps best practices to develop Infrastructure as Code (IaC) (Terraform configuration) and deploy it by using a complete reference implementation that is available as a service and powered by IBM Cloud® Continuous Delivery. In part 1 of this tutorial series, you review some background information and set up prerequisites.



 Before you begin 

See the following documentation to get more information about DevSecOps and its implementation in IBM Cloud® Continuous Delivery:



* [What is DevSecOps](https://www.ibm.com/cloud/learn/devsecops?)
* [DevSecOps architecture](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-arch)
* [DevSecOps with Continuous Delivery](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops_intro)
* [Understanding DevSecOps pipelines](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-pipelines)







 Step 1: Set up an IBM Cloud account 

Set up an [IBM Cloud account](https://cloud.ibm.com/registration). Depending on your IBM Cloud account type, access to certain resources might be limited. Depending on your account plan limits, certain capabilities that are required by some DevSecOps toolchains might not be available. For more information, see [Setting up your IBM Cloud account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started) and [Upgrading your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account).





 Step 2: Create resource group 

Resource groups organize your account resources in customizable groupings so that you can assign users access to multiple resources at a time. Every toolchain is associated with a resource group.
To learn more about IAM permissions, see [Managing access with IAM](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam).





 How do I create an API key? 

Complete the following steps:



1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Create a [service ID](https://cloud.ibm.com/docs/iam?topic=iam-serviceids) for your application.

ibmcloud iam service-id-create <SERVICE_ID_NAME> [-d, --description DESCRIPTION]
3. [Assign an access policy](https://cloud.ibm.com/docs/iam?topic=iam-serviceidpolicy) for the service ID.

You can assign access permissions for your service ID [by using the IBM Cloud console](https://cloud.ibm.com/docs/iam?topic=iam-serviceidpolicyaccess_new).

To learn how roles map to specific actions, see [Managing IAM access for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam).
4. Create a [service ID API key](https://cloud.ibm.com/docs/iam?topic=iam-serviceidapikeys).

ibmcloud iam service-api-key-create <API_KEY_NAME> <SERVICE_ID_NAME> [-d, --description DESCRIPTION] [--file FILE_NAME]

Replace SERVICE_ID_NAME with the service ID name.
For more information about onboarding to the IBM Cloud, see [Registering a virtual server image for Power Systems in IBM Cloud Partner Center](https://cloud.ibm.com/docs/sell?topic=sell-vsipower-register). For more information about onboarding to your private catalog, see [Onboarding a virtual server image for Power Systems to a private catalog](https://cloud.ibm.com/docs/sell?topic=sell-vsipower-onboard).

Upload translations of your software by using the CLI
: You can now download and upload translations of your software by using the CLI. For more information, see [Translating product details by using the CLI](https://cloud.ibm.com/docs/account?topic=account-translate-product-details).





 4 April 2022 

Adding custom service parameters for your service
: If the provisioning process of your product requires additional information from your customers, you can now add custom input fields for your product in IBM Cloud Partner Center. For more information, see [Adding custom service parameters for your service in Partner Center](https://cloud.ibm.com/docs/sell?topic=sell-service-add-custom-parameters).







 March 2022 



 25 March 2022 

Trusted profiles are now members of access groups
: You can now add trusted profiles as members of access groups like other IAM identities, such as users and service IDs. For more information, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile) and [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).





 1 March 2022 

Use feature and subscription codes to create new accounts
: When you [register for a new IBM Cloud account](https://cloud.ibm.com/registration), you can use a feature code that you received from participating in a special event or a subscription code that you received by email. Instead of verifying your identity by entering your credit card information, click the option to Register with a code to complete the set up of your new account.







 February 2022
* [Retention](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-immutable) set to 12 months



3. [Generate a new set of service credentials](https://cloud.ibm.com/docs/account?topic=account-service_credentials) with the [bucket permissions](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-bucket-permissions) of Object Write access and the advanced option of Include HMAC Credentials enabled.



Teleport session recordings can contain sensitive information. You should have policies to ensure that operators do not enter secrets on the command line interface. In addition, you need to employ least privilege and make sure that access to these recordings is restricted only to those employees who need the recordings to do their jobs (such as your security incident response team).





 Step 2: Configure App ID 



1. Provision an [IBM Cloud® App ID instance](https://cloud.ibm.com/catalog/services/app-id) with the Graduated tier Plan.
2. If you have your own SAML-based identity provider, complete the following steps:



1. Configure your [SAML-based identity provider](https://cloud.ibm.com/docs/appid?topic=appid-enterprise) within App ID.
2. Set up MFA by using a physical hardware-based security key and your identity provider.
3. Set up the following password policies:





* Lock user accounts after three (3) consecutive failed logon attempts within 15 minutes.
* Lock user accounts for 30 minutes after more than three unsuccessful logon attempts. When the lockout period ends, the user can reset their password. Internal privileged accounts must remain locked until they are released by an administrator.
* Set sessions to time out after 15 minutes of inactivity.



3. [Generate a service credential](https://cloud.ibm.com/docs/account?topic=account-service_credentials) with the role of Reader.
4.