vania-janet/multiturn-rag-retrieval-data huggingface dataset:
In other words, the root key remains registered for a resource that doesn't exist. Always delete a BYOK resource before you remove IAM authorization. For more information about safely removing service authorization, see [Removing service authorization to a root key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managinginstance-byok-inaccessible-data).
* What can I do if my root key is compromised?

 What can I do if my root key is compromised? 

Independently back up your data. Then, delete the compromised root key and power down the instance with volumes that are encrypted with that key.

Also, consider setting up a key rotation policy that automatically rotates your keys based on a schedule. For more information, see [Key rotation for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotation).
* What is key rotation?

 What is key rotation? 

For IBM Cloud VPC resources such as Block Storage for VPC volumes that are protected by your customer root key (CRK), you can rotate the root keys for extra security. When you rotate a root key by a schedule or on demand, the original key material is replaced. The old key remains active to decrypt existing volumes but can't be used to encrypt new volumes. For more information, see [Key rotation for VPC resources](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-key-rotation).
* How does key rotation work?

 How does key rotation work? 

Customer-managed encrypted resources such as Block Storage for VPC volumes use your root key (CRK) as the root-of-trust key that encrypts a LUKS passphrase that encrypts a master key that's protecting the volume. You can import your CRK to a key management service (KMS) instance or instruct the KMS to generate one for you. Root keys are rotated in your KMS instance.
$ ibmcloud kp key delete $KEY_ID -i $KP_INSTANCE_ID

Deleting key: '0c17...<redacted>...5c34', from instance: 'a192...<redacted>...7411'...
OK
Deleted Key
0c17...<redeacted>...5c34

 this request fails because the key was previously deleted
$ curl -X DELETE "https://us-south.kms.cloud.ibm.com/api/v2/keys/$KEY_ID" -H "authorization: Bearer $ACCESS_TOKEN" -H "bluemix-instance: $KP_INSTANCE_ID" -H "content-type: application/vnd.ibm.kms.key+json"



 JSON response 

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Gone: Key could not be deleted. Please see reasons for more details.",
"reasons":
{
"code": "KEY_DELETED_ERR",
"message": "Key has already been deleted. Please delete references to this key.",
"status": 410,
"moreInfo":"https://cloud.ibm.com/apidocs/key-protect"
}
]
}
]
}











 7 - Key is not in a valid state 



 Message 

Key is not in a valid state

Reason code: KEY_ACTION_INVALID_STATE_ERR





 HTTP status code 

409 - Conflict

The HTTP 409 Conflict response status code indicates a request conflict with current state of the server.

Conflicts are most likely to occur in response to a PUT request. For example, you may get a 409 response when uploading a file which is older than the one already on the server resulting in a version control conflict.
To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.







 Optional parameters 



* -m, --monthly-interval

Set the key rotation interval in months. The rotation interval must be 1 to 12 months.
* -e, --enable or -d, --disable

By default, key rotation policy is enabled. If user wants to disable or enable the policy, they can use -d(--disable) or -e(--enable) respectively.
* -o, --output

Set the CLI output format. By default, all commands print in table format. To change the output format to JSON, use --output json.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key restore 

Key Protect can restore a previously deleted root key, which restores access to its associated data in the cloud.

As an admin, you might need to restore a root key that was imported into Key Protect to access data the key previously protected.

When you restore a key, you move the key from the Destroyed (value is 5) to the Active (value is 1) key state, and you restore access to any data that was previously encrypted with the key.

You can restore a deleted key within 30 days of its deletion. This capability is available only for root keys that were created with a key material.

You can only restore root keys that were created with a key material, using kp key create with the -k, --key-material option. You cannot restore a root key if the --key-material option was not specified.

If you want to restore a deleted root key then you must save the key material that was used to create the root key. You cannot restore a deleted key without provided the original key material.

ibmcloud kp key restore KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
2. Identify the row of the service ID that you want to remove, and click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Remove.
3. Click Remove.



Deleting a service ID also deletes all associated API keys and assigned policies. This action can't be undone, and might cause disruptions between dependent services.





 Deleting a service ID by using the CLI 

To delete a service ID, use the following command:

ibmcloud iam service-id-delete (NAME|UUID) [-f, --force]

Deleting a service ID also deletes all associated API keys and assigned policies. This action can't be undone, and might cause disruptions between dependent services.



 Command options 

NAME (required)
: Name of the service, exclusive with UUID.

UUID (required)
: UUID of the service, exclusive with NAME.

-f, --force
: Delete without confirmation.

Either NAME or UUID are required, but you don't need to provide both.





 Examples 

Delete service ID sample-teset without confirmation:

ibmcloud iam service-id-delete sample-teset -f

Delete service ID ServiceId-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976:

ibmcloud iam service-id-delete ServiceId-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976

For more information about managing API keys by using the CLI, see [Managing IAM access](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iam&interface=cliibmcloud_iam_service_id_delete).
"lastUpdateDate": "2020-06-19T16:08:59Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": { "enabled": true
}
}
]

 this should fail (the key has a dual authorization policy)
$ ibmcloud kp key delete $KEY_ID_OR_ALIAS

Deleting key: d887bfe8-5166-4dad-af32-7e3055ca1873, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
FAILED
kp.Error:
correlation_id='fe0db627-1726-4827-a9d2-c21d728e1c92',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted.
Please see "reasons" for more details.',
reasons='[AUTHORIZATIONS_NOT_MET: Number of authorizations required to delete is not met -
FOR_MORE_INFO_REFER: https://cloud.ibm.com/apidocs/key-protect]'





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to query. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-keys) command.
* -e, --enable

Once you enable the dual-auth-delete policy you cannot disable it. You cannot delete a key without two (dual) authorizations. The process must be completed within 7 days, otherwise the dual authorization policy is automatically canceled, which means the key can be deleted by anyone that has authorization (two authorizations are not needed).
Deleting secrets with the CLI 

To delete a secret with the CLI, use the [secret delete](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-secret-delete) command; for example,

ibmcloud ce secret delete --name myliteralsecret -f

Example output

Deleting secret myliteralsecret...
OK

You can also [delete environment variables](https://cloud.ibm.com/docs/codeengine?topic=codeengine-envvarenvvar-delete-cli) that reference secrets and configmaps from the CLI.
});







 Deleting an API key for a service ID using the API 

To delete an API key by for a service ID using the API, call the [IAM Identity Service API](https://cloud.ibm.com/apidocs/iam-identity-token-apidelete-api-key) as shown in the following example:



* Curl
* Java
* Python
* Go
* Node



curl -X DELETE 'https://iam.cloud.ibm.com/v1/apikeys/APIKEY_UNIQUE_ID' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json'

DeleteApiKeyOptions deleteApiKeyOptions = new DeleteApiKeyOptions.Builder()
.id(apikeyId)
.build();

service.deleteApiKey(deleteApiKeyOptions).execute();

delete_api_key(self,
id: str,
kwargs
) -> DetailedResponse

response = iam_identity_service.delete_api_key(id=apikey_id)

print(response)

deleteAPIKeyOptions := iamIdentityService.NewDeleteAPIKeyOptions(apikeyID)

response, err := iamIdentityService.DeleteAPIKey(deleteAPIKeyOptions)
if err != nil {
panic(err)
}

const params = {
id: apikeyId,
};

iamIdentityService.deleteApiKey(params)
.then(res => {
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err);
});





 Before you begin 

Before you can manage service ID API keys by using Terraform, make sure that you have completed the following:
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko managed-key-delete 

Delete a managed key by key ID from the vault. Make sure that the key is in a Destroyed state before you run this command.

ibmcloud hpcs uko managed-key-delete --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request. You can use the ibmcloud hpcs uko managed-key command to retrieve the ETag.
* Example

ibmcloud hpcs uko managed-key-delete 
--id=21a7498e-2ae4-47ee-85ac-a19bf64e92fa 
--uko-vault=eb66ebbd-7230-4cde-89bf-17282cda5faa 
--if-match=2022-05-27T10:15:38Z
* Output

The command returns the output similar to the following example:

...
OK







 hpcs uko managed-key 

Retrieve a managed key and its details by specifying the key ID.

ibmcloud hpcs uko managed-key --id ID --uko-vault UKO-VAULT



* Command options
If you need to delete the key during the soft-deletion period, you have to force delete the key. After the soft-deletion period, the key can be deleted without the force. You can check the association between the key and your deployment to determine when you can delete the key.





 Deleting data in your database 

The Db2 database stores data in pages on block storage. When DELETE or TRUNCATE operations are performed, that data is no longer accessible unless you are using TEMPORAL tables. The physical pages that contain the data are not immediately erased and might still exist on the disk, but will be overwritten as needed. There is no ability to recover this data. The database provides the REORG and REDUCE MAX capability to reclaim this space for other activities or it will be reused when the database needs to store more data.
If the Key Protect instance contains more than 200 keys, you need to use the [offset and limit parameters](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysretrieve-subset-keys-api) to list another subset of keys.

For example, if you want to list keys 201 - 210 that are available in a service instance, you use ../keys?offset=200&limit=10 to skip the first 200 keys.





 Unable to delete keys 

When you use the Key Protect user interface or REST API, you're unable to delete a key.

 What’s happening 

From the IBM Cloud dashboard, you select your instance of the Key Protect service.

You're assigned a Manager access policy for the Key Protect instance. You try to delete a key, but the action fails with the following error message.

Conflict: Key could not be deleted. Status: 409, Correlation ID: 160cc463-71d1-4b30-a5f2-d3f7e9f2b75e

You also try to delete the key by using the Key Protect API, but you receive the following error message.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.error+json",
"collectionTotal": 1
},
"resources": [
{
"errorMsg": "Conflict: Key could not be deleted. Please see reasons for more details.",
"reasons":
{
"code": "PROTECTED_RESOURCE_ERR",
"message": "Key is protecting one or more cloud resources",
"status": 409,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect",
"target": {
"type": "query_param",
"name": "force"
}
}
]
}
]
}

 Why it’s happening
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:31:44Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}





 Required parameters 



* KEY_ID_OR_ALIAS

The v4 UUID or alias of the key that you want to delete. To retrieve a list of your available keys, run the [kp keys](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-keys) command.
* -i, --instance-id

The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* --key-ring
"request_id": "97a3d1fb-c137-9c1c-16fb-7aebf05a0eae",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"secret_group_id": "d2e98a96-18ed-f13c-8dee-db955fb94122",
"secret_id": "c86946e6-b392-2613-159d-aff5a3f095b3",
"versions": [
{
"alias": "current",
"id": "3993c39b-3ef5-f6f3-5e20-f6f9c6f8d053",
"locks": ],
"payload_available": true
},
{
"alias": "previous",
"id": "ad6aa6d9-b43c-4bc3-597d-15c376622e64",
"locks":
"lock-for-app-1"
],
"payload_available": true
}
]
},
"wrap_info": null,
"warnings": null,
"auth": null
}
Show more







 Unlock a secret version 

Delete one or more locks that are associated with the specified secret version.

A successful request deletes the locks that you specify. To remove all locks, you can pass {"locks": [""]} in in the request body. Otherwise, specify the names of the locks that you want to delete. For example, {"locks": ["lock-1", "lock-2"]}.

A secret is considered unlocked and able to be revoked or deleted only after all of its locks are removed. To understand whether a secret contains locks, check the locks_total field that is returned as part of the metadata of your secret.
* Key is protecting one or more cloud resources - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-protected-resource-err)
* KeyCreateImportAccess instance policy does not allow this action - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-key-create-import-access-err)
* Number of authorizations required to delete is not met - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-authorizations-not-met)
* The import token has expired - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-import-token-expired-err)
* The key cannot be deleted because it's protecting a cloud resource that has a retention policy: Before you delete this key, contact an account owner to remove the retention policy on each resource that is associated with the key - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-prev-key-del-err)
* The key is not dual auth enabled and cannot be set for deletion - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-not-dual-auth-err)
* The key was updated recently: Please wait and try again - [details](https://cloud.ibm.com/docs/key-protect?topic=key-protect-error-messageserror-messages-req-too-early-err)
Unlike deleting a root key, however, you can reenable a disabled key to make your cluster usable again.





 Controlling encryption 

When you enable a KMS provider in your cluster, your own KMS root key is used to encrypt data encryption keys (DEKs) which are used to encrypt Kubernetes secrets. Using your own encryption root key adds a layer of security to Kubernetes secrets and gives you more granular control of who can access sensitive cluster information. For more information, see the [overview](https://cloud.ibm.com/docs/containers?topic=containers-encryptionencrypt_ov) and your KMS provider's documentation, such as [Key Protect envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).





 Features and limitations of KMS providers 

Review the following known limitations:



* Customizing the IP addresses that are allowed to connect to your key management service, such as a Key Protect instance, is not supported.



Additionally, your cluster version impacts the functionality of the KMS provider. To see what KMS features are available for different cluster versions of IBM Cloud Kubernetes Service, review the following table.

To check your cluster version, run the following command.

ibmcloud ks cluster ls

To take advantage of all the KMS features, encryption must be enabled on version 1.19.4_1527 or later.

If KMS was enabled before this version, [update your cluster](https://cloud.ibm.com/docs/containers?topic=containers-update) to at least version 1.19.4_1527 and then [reenable KMS encryption](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect) with a new root key. If you are unsure when KMS was enabled, log in to the IBM Cloud console and click on your KMS instance under [Resources](https://cloud.ibm.com/resources). Find your root key and click the Actions icon !
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:23:26Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 2,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}





 Example 2 

Create a root key, disable it, and attempt to use the root key to wrap another key.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

63d044d9-b38b-4803-85ef-ed9a1e5087c2

 disable the root key
$ ibmcloud kp key disable $KEY_ID
* UI
* CLI







 Deleting service instances 

You can delete your IBM Cloud® Hyper Protect Crypto Services instance with the IBM Cloud console or the IBM Cloud CLI. To do so, you need to set all the

crypto unitsof the service instance back to theimprint modeby zeroizing the crypto units.



 Before you begin 



1. Delete all keys managed in the service instance.
2. Follow [these instructions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-prerequisite) to set the environment variable CLOUDTKEFILES on your workstation to specify the directory where you saved the master key part files and signature key files you created when you initialized your service instance.
3. Log in to IBM Cloud also by following [these instructions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-prerequisite).







 Step 1: Select the crypto units to be deleted 



1. To select the administrators to sign TKE commands, use the following command:

ibmcloud tke sigkey-sel

A list of signature keys that are found on the workstation is displayed. When prompted, enter the key numbers of the signature key files to select for signing future administrative commands. When prompted, enter the passwords for the signature key files.
2. To list the numbers of crypto units in the target resource group under the current user account, run the following command:

ibmcloud tke cryptounits
3. Check whether the crypto units that you want to zeroize are marked as true. If not, add the crypto units by running the following command:

ibmcloud tke cryptounit-add

A list of the crypto units in the target resource group under the current user account is displayed. When prompted, enter crypto unit numbers to be zeroized to the selected crypto unit list.







 Step 2: Zeroize crypto units 

If you initialize your service instance and load the
Before you disable a key, it's best to verify which resources are being protected by it.

To see which root keys are disabled, look in the UI list of resources. The status of volume and snapshot resources are unusable. File shares in a stable state remain so. The UI tooltip displays "key suspended" for the resource. In the API response, you can see an encryption_key_disabled reason code.

You can [enable a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keysenable-ui) that's in a suspended state, which returns the key to an active state. You can also [delete a suspended key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-delete-root-keys) or restore the deleted key if necessary.

For more information about disabling root keys the following topics.



* [Key Protect - Disabling root keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys)
* [Hyper Protect Crypto Services - Disabling root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys)







 Deleting root keys 

When you delete a root key, the key is no longer available to decrypt passphrases that are used to protect your resources. Deleting a root key places it in a destroyed or deleted state in the KMS. Volume, snapshot, and image resources that are protected by the deleted root key have an unusable status and can't be used for normal operations. File Storage for VPC shares show a suspended status. The storage system is offline, and data cannot be accessed.

Your data still exists. You have a 30-day grace period to [restore the deleted key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key).