vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Why it’s happening 

If you remove IAM authorization from Cloud Block Storage to the KMS before you delete all BYOK volumes or images, the root key fails to unregister from the resource.

 How to fix it 

As best practice, delete all storage or image resources before you remove IAM authorization. If you already removed authorization, you must restore the IAM authorization between Cloud Block Storage (source service) and your KMS (target service). For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth) to establish IAM service-to-service authorizations in the UI, CLI, or API.





 Resolving volume resize issues while a snapshot is taken 

 What’s happening 

If you take a snapshot of a volume and resize the source volume while the snapshot is being created, you get an error.

 Why it’s happening 

While the snapshot is in a pending state, a volume resize error displays with the message "The resize validation failed." The correct message says, "volume is locked."

 How to fix it 

Wait until the snapshot is created and it is in an available state before you resize the source volume.
"crn": "crn:v1:staging:public:is:us-south-1:a/82a90f2e-39e1-4a18-a8dc-6ebc17b61d7f::volume:cc6d2924-3cd2-459c-bb5e-9e84287fb530",
"generation": "gc",
"id": "cc6d2924-3cd2-459c-bb5e-9e84287fb530",
"requestPath": "",
"resourceGroupID": "696cb88e9039453f86f0802c92446a60"
},
"correlationId": "496cbc9b-3758-4eff-bc7d-f71a51be0e1d"
},
"logSourceCRN": "crn:v1:staging:public:is:us-south-1:a/82a90f2e-39e1-4a18-a8dc-6ebc17b61d7f::volume:cc6d2924-3cd2-459c-bb5e-9e84287fb530",
"saveServiceCopy": true
}
Show more





 Activity Tracker events for key suspension and deletion 

When you initiate activity in the KMS to disable or delete a root key, specific Activity Tracker events are generated. These events are particular to Key Protect, but similar events are generated for Hyper Protect Crypto Services.



* When you disable a key (key state changes from active to suspended), a kms.secrets.disable event is generated.
* When you enable a disabled key (key state changes from suspended to active), a kms.secrets.enable event is generated.
* When you delete a key (key state changes to destroyed), a kms.secrets.delete event is generated.
iamPolicyManagementService.deletePolicy(params)
.then(res => {
console.log(JSON.stringify(res, null, 2));
})
.catch(err => {
console.warn(err)
});

If the source service is removed from the account, any policies that are created by that service for its dependent services are deleted automatically. Similarly, if the dependent service is removed from the account, any access policies that are delegated to that service are also deleted.





 Removing an authorization by using Terraform 

If you want to remove an authorization by using Terraform, you need to delete the argument from the main.tf file. After you delete the argument, provision your file by using the following steps:



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply
* The responseData.keyState field includes the integer that correlates to the state of the key. The integers correlate with these key state values: Pre-activation = 0, Active = 1, Suspended = 2, Deactivated = 3, and Destroyed = 5. For more information about key states, see [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).
* When you authorize the deletion of a key, a kms.secrets.setkeyfordeletion event is generated. The responseData.keyState field includes the integer that correlates to deleted state (5).
* The responseData.totalResources field includes the total number of key versions that are associated with the key.
* The responseData.eventAckData.newKeyVersionId field includes the unique identifier of the latest key version.



For more information about key rotation events that indicate a successful rotation, see these [key rotation events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-eventsrotate-key-registrations-success). For more information about all Activity Tracker events in Key Protect, see [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-events).





 Example key rotation event 

The following JSON example shows a kms.secrets.rotate event when a root key is rotated.

{
"eventTime":"2020-06-22T15:36:16.7+0000",
"outcome":"success",
"message":"Key Protect: rotate secret my-secret-key1",
"action":"kms.secrets.rotate",
"initiator":{
"id":"MYid-111100P9W2",
"name":"john.doe@mycompany.com",
"typeURI":"service/security/account/user",
"credential":{
$ NEWCIPHERTEXT=eyJjaXBoZXJ0ZXh0IjoiS0FITEFRWjdh ...<redacted>... NWEyMTQwNjdlIn0=

 unwrap the ciphertext and reveal the original DEK (plaintext)
$ ibmcloud kp key unwrap $KEY_ID $NEWCIPHERTEXT --output json

{
"Plaintext": "UPJ4YDwbQMjQG/aqlHsPhHV1CBkpIXngLHFS5+i4UZ4=",
"Rewrapped Plaintext": ""
}







 Required parameters 

KEY_ID
: The ID of the root key that you want to rotate.





 Optional parameters 

-k, --key-material
: To rotate a key that was initially generated without a --key-material parameter, that is kp key create my-key, omit the --key-material parameter.

If a key was created with the --key-material parameter then specify the new base64-encoded key material that you use for rotating an existing root key.

To rotate a key that was initially imported into the service, provide a new 32-byte (256-bit) key.







 kp key schedule-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2. User 1 schedules (authorizes) a key deletion with the kp key schedule-delete command
3. User 2 schedules (authorizes) a key deletion
4. The key is deleted after the second schedule-delete is performed, which is supported in the user interface, API, and CLI
5. If a second authorization does not occur within 7 days, the key returns to its default status



There are two ways to enable the dual-auth-delete policy:
If you delete a deployment that is protected with an HPCS key, the deployment remains registered against the key during the soft-deletion period (up to 9 days). If you need to delete the key in the soft-deletion period, you must [force delete](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys) the key. After the soft-deletion period, the key can be deleted without the force. You can check the [association between the key and your deployment](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-details) to determine when you can delete the key.





 Cryptoshredding 

Cryptoshredding is a destructive action. When the key is deleted, your data is unrecoverable.

Hyper Protect Crypto Services enables [initiation of a force delete](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys) of a key that is in use by IBM Cloud® services, including your Cloud Databases deployments. This action is called cryptoshredding. Deleting a key that is in use on your deployment locks the disks that contain your data and disables your deployment. You are still able to access the UI and some metadata such as security settings in the UI, CLI, and API but you are not able to access any of the databases or data that is contained within them. Key deletion is [sent to the Activity Tracker](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events) as hs-crypto.secrets.delete.
Deleting a database 

When a service instance is deleted, the database that it provides is also removed. This will delete any online data and logs as well as database backups. The data will not be recoverable after this action.



 How is the data deleted 

All data is encrypted at rest to ensure data is protected at all times using encryption keys stored in a key management service called Key Protect. When access to those keys is removed, the data is crypto-shredded and cannot be recovered. When the service instance is deleted, the block storage that is used for the database is wiped to ensure that all of the data is erased. Any data objects in cloud object storage are also deleted and not recoverable.





 When is the data deleted 





 Using your own encryption keys to delete data 

You can use your own encryption keys to delete data. This is called crypto-shredding. After the key is deleted, your data is unrecoverable and unreadable by anyone.

Key Protect allows you to initiate a force delete of a key that is in use by various IBM Cloud® services, including your Db2 on Cloud service instances. Deleting a key that is in use on your deployment locks the disks containing your data when the key is requested again. You can have this occur right away by contacting IBM Support or by deleting your service instance. Key deletion is sent to the Log Analysis Activity Tracker as kms.secrets.delete.

If you delete a deployment that is protected with your Key Protect key, the deployment remains registered against the key for the duration of the soft-deletion period (up to 9 days). If you need to delete the key during the soft-deletion period, you have to force delete the key. After the soft-deletion period, the key can be deleted without the force. You can check the association between the key and your deployment to determine when you can delete the key.





 Deleting data in your database 

The Db2 database stores data in pages on block storage. When DELETE or TRUNCATE operations are performed, that data is no longer accessible unless you are using TEMPORAL tables.
console.log(JSON.stringify(res, null, 2));
})
.catch(err => {
console.warn(err)
});

If the source service is removed from the account, any policies that are created by that service for its dependent services are deleted automatically. Similarly, if the dependent service is removed from the account, any access policies that are delegated to that service are also deleted.





 Removing an authorization by using Terraform 

If you want to remove an authorization by using Terraform, you need to delete the argument from the main.tf file. After you delete the argument, provision your file by using the following steps:



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply
$ ibmcloud kp instance policy-update dual-auth-delete --enable

Updating instance policy...
OK

 create a new key
$ ibmcloud kp key create my-protected-key

Creating key: 'my-protected-key', in instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
OK
Key ID Key Name
6a8a129b-0cd4-4667-ba57-b355a125a7ca my-protected-key

 list the policies for the key - dual-auth-delete is
 enabled because the key inherits the instance policy
$ ibmcloud kp key policies 6a8a129b-0cd4-4667-ba57-b355a125a7ca --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T19:13:00Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 attempt to delete the key - this fails
$ ibmcloud kp key delete 6a8a129b-0cd4-4667-ba57-b355a125a7ca
You must wait 7 days for the policy to expire.

Dual authorization delete for an instance can be enabled or disabled anytime.

If a key has a dual-auth-delete policy, changing the instance policy does not change any existing key policies.

When you change the instance policy, new keys are enforced with the instance policy.

ibmcloud kp instance policy-update dual-auth-delete
-i, --instance-id INSTANCE_ID
-d, --disable OR
-e, --enable





 Examples 

These are examples of kp instance policy-update dual-auth-delete.



 Example 1 

This example enables the dual authorization delete policy.

 enable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --enable

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T18:45:14Z",
"lastUpdated": "2020-06-22T18:45:14Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "dualAuthDelete",
"policy_data": {
"enabled": true
}
}
]

 disable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --disable

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T18:45:14Z",
"lastUpdated": "2020-06-22T18:51:33Z",
<br> <br>For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key is a part of. <br> <br>If unspecified, Key Protect will search for the key in every key ring associated with the specified instance. It is recommended to specify the key ring ID for a more optimized request. <br> <br>Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. <br>For more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 return_preference Optional.A header that alters server behavior for POST and DELETE operations. <br> <br>When you set the return_preference variable to return=minimal, the service returns a successful deletion response. When you set the variable to return=representation, the service returns both the key material and the key metadata. 



If the return_preference variable is set to return=representation, the details of the DELETE request are returned in the response entity-body.

After you delete a key, it transitions to the Deactivated key state. After 24 hours, if a key is not reinstated, the key transitions to the Destroyed state. Deleted keys are recoverable for up to 30 days or until their expiration date, after which the key contents are shredded and its metadata becomes inaccessible.

The following JSON object shows an example returned value.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
An Entrust KeyControl license is ordered for each instance installation.







 Considerations when you delete Entrust KeyControl 

Review the following considerations before you delete the service:



* Before you delete the Entrust KeyControl service, ensure that you decouple all clients from using Entrust KeyContol. After you delete the service, the keys might be deleted, and you might be locked out of your VMs.
* If you installed the Entrust KeyControl service before VMware® Solutions v4.0, and you then delete that service, you must manually remove the DNS entries. For more information, see [Manually removing the DNS entries](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_deletingservicesvc_deletingservices-DNS-entries).







 Related links 



* [Managing Entrust KeyControl](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-managing-entrust-kc)
* [FAQ](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
* [Entrust website](https://www.entrust.com/)
A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key schedule-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2. User 1 schedules (authorizes) a key deletion with the kp key schedule-delete command
3. User 2 schedules (authorizes) a key deletion
4. The key is deleted after the second schedule-delete is performed, which is supported in the user interface, API, and CLI
5. If a second authorization does not occur within 7 days, the key returns to its default status



There are two ways to enable the dual-auth-delete policy:



* Set the policy for a single key using kp key policy-update dual-auth-delete
* Set the policy for the instance using kp instance policy-update dual-auth-delete; all keys created after the instance policy is enabled inherit the instance policy setting



The [kp key cancel-delete](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-cancel-delete) command cancels, or removes, a prior authorization.

ibmcloud kp key schedule-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]



 Example 

This is an example of scheduleing a key to be deleted.

 schedule this key to be deleted
$ ibmcloud kp key schedule-delete $KEY_ID_OR_ALIAS

Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
"keyVersion": { "id": "52a9d772-8982-4620-bfb4-b070dd812a0c", "creationDate": "2020-06-15T20:36:46Z"
}
}
]

 delete the authorization policy between COS AND KMS - this breaks everything
$ ibmcloud iam authorization-policy-delete $COS_KMS_AUTHORIZATION --force

 delete the KP root key - this fails because the registration was not deleted
$ ibmcloud kp key delete $MY_COS_KEY_ID

Deleting key: 52a9d772-8982-4620-bfb4-b070dd812a0c, from instance: b0d84b32-09d0-4314-8049-da78e3b9ab6f...
FAILED
kp.Error:
correlation_id='c27b7948-4a1f-4cbd-8770-cb3616888e27',
msg='Conflict: Key could not be deleted. Please see "reasons" for more details.',
reasons='[PROTECTED_RESOURCE_ERR: Key is protecting one or more cloud resources -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/docs/key-protect?topic=key-protect-troubleshootingunable-to-delete-keys]'

 delete the KP root key; use --force because the registration between COS and KMS still exists
$ ibmcloud kp key delete $MY_COS_KEY_ID --force --output json

{
"id": "52a9d772-8982-4620-bfb4-b070dd812a0c"
}

 delete the KMS instance
$ ibmcloud resource service-instance-delete $KMS_NAME --force

 delete the COS instance
To learn more about the implications of removing or deleting identities in your account, review the following documentation:



* [Removing users from an account](https://cloud.ibm.com/docs/account?topic=account-remove&interface=ui)
* [Deleting service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids&interface=uidelete_serviceid)
* [Removing trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-remove)
* [Deleting an API key](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=uidelete_user_key)
* [Deleting an API key for a service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&interface=uidelete_service_key)
* The Object Storage instance and the Object Storage bucket will not be destroyed.
* The agent assignment policy for the agent is not deleted.







 Deleting an agent using the API 

Follow the [steps](https://cloud.ibm.com/docs/schematics?topic=schematics-setup-apics_api) to retrieve your IAM access token and authenticate with IBM Cloud Schematics by using the API.

Example

GET /v2/agents/agent-beta1-testing.soA.748e/ HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
Authorization: Bearer <auth_token>

Output

{
"requestid": "9dc76486-ec80-4a26-b159-6e2d46eeb39f",
"timestamp": "2023-03-16T21:13:20.244850864Z",
"messageid": "M1074",
"message": "The requested object cannot be located. Check that the ID is correct and try your request again.",
"statuscode": 404
}





 Next steps 



* You can view the [list of agents](https://cloud.ibm.com/docs/schematics?topic=schematics-display-agentb1-overview&interface=cli), and the [agent assignment policy](https://cloud.ibm.com/docs/schematics?topic=schematics-policy-manage&interface=cli).
* You can check out the [agent FAQ](https://cloud.ibm.com/docs/schematics?topic=schematics-faqs-agent) for any common questions related to deleting an agent.
As an admin, you might need to [restore a root key that you imported](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keys) to Key Protect so that you can access data that the key previously protected. When you restore a key, you move the key from the Destroyed to the Active key state, and you restore access to any data that was previously encrypted with the key. This must occur within 30 days of deleting a key.







 Activity Tracking 

When Key Protect root keys are deleted, rotated, suspended, enabled, or restored, an [Activity Tracker management event](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at-eventsat-actions-global) (cloud-object-storage.bucket-key-state.update) is generated in addition to any events logged by Key Protect.

In the event of a server-side failure in a lifecycle action on a key, that failure is not logged by COS. If Key Protect does not receive a success from COS for the event handling within four hours of the event being sent, Key Protect will log a failure.

The cloud-object-storage.bucket-key-state.update actions are triggered by events taking place in Key Protect, and require that the bucket is registered with the Key Protect service. This registration happens automatically when a bucket is created with a Key Protect root key.

Buckets created prior to February 26th, 2020 are not registered with the Key Protect service and will not receive notifications of encryption key lifecycle events at this time. These buckets can be identified by performing [a bucket listing operation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-list-buckets) and looking at the dates for bucket creation.
If the source service is removed from the account, any policies that are created by that service for its dependent services are deleted automatically. Similarly, if the dependent service is removed from the account, any access policies that are delegated to that service are also deleted.





 Removing an authorization by using the API 

You can remove any authorization between services in the account if you are assigned the Administrator role on the target service. If you remove any access policies created by the source service for its dependent services, the source service is unable to complete the workflow or access the target service.

To delete an authorization policy, use the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-managementdelete-policy) as in the following sample request:



* Curl
* Java
* Python
* Go
* Node



curl -X DELETE 'https://iam.cloud.ibm.com/v1/policies/$POLICY_ID' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json'

DeletePolicyOptions options = new DeletePolicyOptions.Builder()
.policyId(examplePolicyId)
.build();

service.deletePolicy(options).execute();

response = iam_policy_management_service.delete_policy(
policy_id=example_policy_id
).get_result()

print(json.dumps(response, indent=2))

options := iamPolicyManagementService.NewDeletePolicyOptions(
examplePolicyID,
)

response, err := iamPolicyManagementService.DeletePolicy(options)
if err != nil {
panic(err)
}

const params = {
policyId: examplePolicyId,
};

iamPolicyManagementService.deletePolicy(params)
.then(res => {