vania-janet/multiturn-rag-retrieval-data huggingface dataset:
After you provision an instance, the Activity Tracker dashboard, that is located in the Observability section of the IBM Cloud UI, opens.







 Manage access to the service 

Every user that accesses the IBM Cloud Activity Tracker service in your account must be assigned an access policy with an IAM user role defined. The policy determines what actions the user can perform within the context of the service or instance you select. The allowable actions are customized and defined as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles. [Learn more](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iam).

To grant a user management permissions to work with the IBM Cloud Activity Tracker service within the context of a resource group, complete the following steps:



 Create an access group 

Complete the following steps to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.







 Add permissions to manage events 

After you set up your group, you must assign a common access policy to the group. Any policy that you set for an access group applies to all entities, users and service IDs, within the group.

When you define the policy, you need to select a platform role and a service role:



* Platform management roles cover a range of actions, including the ability to create and delete instances, manage aliases, bindings, and credentials, and manage access. The platform roles are administrator, editor, operator, viewer. Platform management roles also apply to account management services that enable users to invite users, manage service IDs, access policies, catalog entries, and track billing and usage depending on their assigned role on an account management service.
* Service access roles define a user or service’s ability to perform actions on a service instance. The service access roles are manager, writer, and reader.



To manage the IBM Cloud Activity Tracker service, a user needs the following roles:



* Platform role: Administrator.
* Service role: Manager.
Use this option when you want to call IAM-enabled services as part of instance bootstrapping. For example, you might want to set up a new Object Storage bucket to be used by the instance workload. For more information, see [Using a trusted profile to call IAM-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-trusted-profile-metadata).



Figure 1 illustrates these scenarios.

Zoom

![Figure showing the instance metadata user workflows.](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc//images/metadata-service-user-workflow.png)

Figure 1. User scenarios for the instance metadata service





 Data security 

IBM takes precaution to assure your data is secure. Metadata is retrieved only from the instance to which you have access. Data that is common to multiple instances is retrieved but specific IP addresses of other instances are not exposed.

The default protocol for the metadata service is HTTP. Calls to the metadata service are secure before they leave the compute host from which they originate. Data is wrapped by using a secure protocol before the data leaves the compute host. The initial call to the instance metadata service is over an HTTP connection. The purpose of the call is to acquire an identity token to access the metadata service. These services use a well-known URL. Although you see a nonsecure connection, the VPC compute service takes extra actions to secure the token and metadata services.

The metadata service can also be configured to use HTTP Secure protocol (HTTPS). For more information, see [Enable secure access by using the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-configure-service&interface=uisecure-access-ui).

The instance metadata service is not intended for sensitive data. The service end-point is open to all processes on the instance.
"expires_in": 3600
}







 Generate an IAM token from an instance identity access token 

To access IBM Cloud IAM-enabled services in the account, you can generate an IAM token from the instance identity access token by using trusted profile information. After you generate the IAM token, you can use it to access IAM-enabled services, such as IBM Cloud Object Storage, Cloud Database Service, and the VPC APIs. You can reuse the token multiple times.

Make a POST /instance_identity/v1/iam_token call and specify the ID of the trusted profile. This request uses the instance identity access token and a trusted profile that is linked to a virtual server instance to generate an IAM access token. The trusted profile can be linked either when you create the instance or provided in the request body.

The IAM API used to pass the instance identity access token and generate an IAM token is being deprecated. Beta users must migrate to the metadata service API to generate an IAM token by using POST /instance_identity/v1/iam_token.

Example request:

iam_token=curl -X POST "http://api.metadata.cloud.ibm.com/instance_identity/v1/iam_token?version=2022-08-08"
-H "Authorization: Bearer $instance_identity_token"
-d '{
"trusted_profile": {
"id": "Profile-8dd84246-7df4-4667-94e4-8cede51d5ac5"
}
}' | jq -r '(.access_token)'

The JSON response shows the IAM token.

{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0aGVfYmVzdCI6I8...",
"created_at": "2022-08-08T14:10:15Z",
"expires_at": "2022-08-08T15:10:15Z",
Getting Started with IAM 

Access to IBM Cloud® Object Storage service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM).



 Identity and Access Management roles 

Every user that accesses the IBM Cloud® Object Storage service in your account must be assigned an access policy with an IAM user role defined. That policy determines what actions the user can perform within the context of the service or instance you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.

Policies enable access to be granted at different levels. Some of the options include the following:



* Access across all instances of the service in your account
* Access to an individual service instance in your account
* Access to a specific bucket within an instance (see [Bucket permissions](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-bucket-permissions))
* Access to all IAM-enabled services in your account



After you define the scope of the access policy, you assign a role. Review the following tables which outline what actions each role allows within the Object Storage service.

The following table details actions that are mapped to platform management roles. Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, create or delete service IDs, create instances, and bind instances to applications.



Table 1. IAM user roles and actions

 Platform management role Description of actions Example actions 

 Viewer View service instances but not modify them <br><br> * List available COS service instances<br> * View COS service plan details<br> * View usage details<br><br><br> 
 Editor Perform all platform actions except for managing the accounts and assigning access policies <br><br> * Create and delete COS service instances<br><br><br> 
 Operator Not used by COS None 
 Administrator Perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users, as well as setting PublicAccess policy on buckets.
"expires_in": 3600
}







 Generate an IAM token from an instance identity access token 

To access IBM Cloud IAM-enabled services in the account, you can generate an IAM token from the instance identity access token by using trusted profile information. After you generate the IAM token, you can use it to access IAM-enabled services, such as IBM Cloud Object Storage, Cloud Database Service, and the VPC APIs. You can reuse the token multiple times.

Make a POST /instance_identity/v1/iam_token call and specify the ID of the trusted profile. This request uses the instance identity access token and a trusted profile that is linked to a virtual server instance to generate an IAM access token. The trusted profile can be linked either when you create the instance or provided in the request body.

The IAM API used to pass the instance identity access token and generate an IAM token is being deprecated. Beta users must migrate to the metadata service API to generate an IAM token by using POST /instance_identity/v1/iam_token.

Example request:

iam_token=curl -X POST "http://169.254.169.254/instance_identity/v1/iam_token?version=2022-08-08"
-H "Authorization: Bearer $instance_identity_token"
-d '{
"trusted_profile": {
"id": "Profile-8dd84246-7df4-4667-94e4-8cede51d5ac5"
}
}' | jq -r '(.access_token)'

The JSON response shows the IAM token.

{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0aGVfYmVzdCI6I8...",
"created_at": "2022-08-08T14:10:15Z",
"expires_at": "2022-08-08T15:10:15Z",
For details, see [Configuring and viewing logs](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-viewing-logs).
* How can I track actions performed by users on a serverless Spark instance?

You can use the Activity Tracker service to track how users and applications interact with IBM Analytics Engine in IBM Cloud®. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard. See [Auditing events for IBM Analytics Engine serverless instances](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-at_events-serverless).



Netezza



* How do I sign up for Netezza Performance Server?

[Create a free IBM Cloud account](https://cloud.ibm.com/registration?target=%2Fcatalog%2Fservices%2Fdb2-warehouse). When you have the account, you can provision a Netezza Performance Server instance directly through the IBM Cloud® catalog.
For more information, see [Getting started with Netezza Performance Server](https://cloud.ibm.com/docs/netezza?topic=netezza-getstarted).
* How do I generate or view credentials for my Netezza Performance Server instance?

To generate credentials, follow the steps:



1. Log in to [IBM Cloud](https://cloud.ibm.com/) account.
2. Go to Resource list > Services and Software > Databases.
3. Click on your Netezza Performance Server instance.
You are now on the Service instance details page.
4. Go to the Service Credentials tab.
5. Click New Credentials.
6. Type a name to assing to your credentials.
7. Select the IAM role that was assigned to you to manage the instance.
8. Click Add.
Working with IAM tokens 

You can use IAM tokens to authenticate with the IBM Cloud Monitoring service when you use Python scripts or the monitoring REST API to automate routine tasks and monitor notifications.



 Getting an IAM API key through the IBM Cloud UI 

An application programming interface key (API key) is a unique code that is passed in to an API to identify the calling application or user. [Learn more](https://cloud.ibm.com/docs/account?topic=account-manapikey).

You can use a user API key or an API key that is associated with a service ID that you create.



* A user API key is associated with a user's identity, and each API key that is created by the user has the same access that the user is assigned. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userapikey).

To view your API keys, go to Manage > Access (IAM) > API keys.

To create an API key, see [Creating an API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key).
* API keys, that are associated with service IDs that you create, are used to connect an application inside or outside of IBM Cloud to an IBM Cloud service. [Learn more](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeysserviceidapikeys).

To view the API keys, go to Manage > Access (IAM), and select Service IDs.

Service ID API keys inherit all access that is assigned to the specific service ID.

To create an API key, see [Creating an API key for a service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeyscreate_service_key).







 Getting an IAM API token programmatically 

Complete the following steps to get an IAM token:



1. From a terminal, log in to the IBM Cloud.
2. Run the following command to get a token:
* User Management
* Billing
* Catalog management
* Context-based restrictions
* Enterprise
* Global catalog
* IBM Cloud shell settings
* License and entitlement
* Partner Center
* Partner Center - Sell
* Projects
* Security and Compliance Center
* Software instance
* Support center





Table 2. Roles and example actions for a policy on all account management services

 Roles Actions 

 Viewer All viewer role actions for the account management services 
 Operator All operator role actions for the account management services 
 Editor All editor role actions for the account management services and the ability to create resource groups 
 Administrator All administrator role actions for the account management services and the ability to create resource groups 







 All IAM Account Management services 

Identity and Access Management (IAM) services make up a subset of all account management services. Give users access to all IAM account management services so that they can work with the following services:



* IAM Access Groups
* IAM Identity service
* IAM Access Management



* Role Management



* User Management





Table 3. Roles and example actions for a policy on all IAM account management services

 Roles Actions 

 Viewer All viewer role actions for IAM services 
 Operator All operator role actions for IAM services 
 Editor All editor role actions for IAM services and the ability to create resource groups 
 Administrator All administrator role actions for IAM services and the ability to create resource groups 
 User API key creator Create API keys when the account setting to restrict API key creation is enabled 
 Service ID creator Create service IDs when the account setting to restrict service ID creation is enabled 



Some roles that you might assign on a policy for All IAM Account Management services affect only certain resources. For example, the role Service ID Creator is relevant to only the IAM Identity service.





 Billing 

You can give users access to update account settings, view subscriptions, view offers, apply subscription and feature codes, update spending limits, and track usage by using the Billing service.



Table 4. Roles and example actions for the Billing service

 Roles Actions 

 Viewer View account feature settings<br><br>View subscriptions in account<br><br>View account name<br><br>View subscription balances and track usage
Using a trusted profile to call IAM-enabled services 

You can create a trusted profile for compute resource identities in IBM Cloud® Identity and Access Management, and then assign access rights for IAM-enabled services to a virtual server instance. These services can be called from an instance without having to manage and distribute IAM secrets to the instance. Use this option when you want to call IAM-enabled services as part of instance initialization.



 About trusted profiles for compute resource identities 

Trusted profiles for compute resource identities let you assign an Cloud Identity and Access Management identity to an individual compute resource, such as a virtual server instance. Instead of having to create a service ID, generate an API key, get the application to store and validate that key, you can assign IAM identity directly to the instance and acquire an instance identity access token.

The compute resource identity service creates the trusted profile, against which you assign access rights to enable the instance to call IAM-enabled services, such as IBM Cloud Object Storage and IBM® Key Protect. You link a trusted profile when you provision an instance. Trusted profiles define authorization for all applications running on the instance.

The trusted profile that you specify when you provision the instance becomes the default trusted profile. It's automatically linked to the instance when you use the UI. From the API, you can link it in the same call to create the instance.

The instance inherits the access rights that are defined in the default trusted profile. VPC uses that trusted profile for any instance identity request to generate an IAM token from an instance identity access token, where the token generation request does not specify a trusted profile.





 Before you begin 



1. Install the IBM Cloud CLI and the VPC CLI plug-in (see the [CLI prerequisites](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentcli-prerequisites-setup)).
2. After the installation of the VPC CLI plug-in, set the target to generation 2 by running the ibmcloud is target --gen 2 command.
3.
Managing IAM access, API keys, trusted profiles, service IDs, and access groups (ibmcloud iam) 

Use the following commands from the IBM Cloud® Command Line Interface to manage API keys, service IDs, access groups, and authorization policies for users, services, trusted profiles, and access groups.



 ibmcloud iam service-ids 

List all service IDs:

ibmcloud iam service-ids [--uuid]



 Command options 

--uuid
: Show UUID of service IDs only.





 Examples 

List UUID of all service IDs under current account:

ibmcloud iam service-ids --uuid







 ibmcloud iam service-id 

Display details of a service ID:

ibmcloud iam service-id (NAME|UUID) [--uuid]



 Command options 

NAME (required)
: Name of the service, exclusive with UUID.

UUID (required)
: UUID of the service, exclusive with NAME.

--uuid
: Display the UUID of the service ID.





 Examples 

Show details of service ID sample-test:

ibmcloud iam service-id sample-test

Show details of service ID ServiceId-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976:

ibmcloud iam service-id ServiceId-cb258cb9-8de3-4ac0-9aec-b2b2d27ac976







 ibmcloud iam service-id-create 

Create a service ID:

ibmcloud iam service-id-create NAME [-d, --description DESCRIPTION] [--lock]



 Command options 

NAME (required)
: Name of the service.

-d, --description
: Description of the service ID.

--lock
: Lock the service ID during creation.





 Examples 

Create a service ID with service name sample-test and description hello, world!:

ibmcloud iam service-id-create sample-test -d 'hello, world!'
Identifying a user's MFA status 

The first time that users log in to your account after you [enable multifactor authentication (MFA)](https://cloud.ibm.com/docs/account?topic=account-enablemfa), they must set up their authentication factors. Otherwise, your account is subject to security vulnerabilities and attacks. You can identify the users in your account who don't meet your MFA requirements by generating an MFA status report.

You must have the Administrator role on the IAM Identity Service to view and update the report. The following actions are included in this role.



*  The action iam-identity.mfa-status.get is required to view the report.
*  The action iam-identity.report.create is required to generate a new report.





  Viewing the MFA status of users in the console 

To view the MFA status of users in the console, complete the following steps:



1.  In the IBM Cloud console, click Manage > Access (IAM), and select MFA status.
2.  Click Update report to view the most recent report in your account.

Only the most recent report is available. When you generate a new report, any reports older than a day are deleted.
3.  Contact the users in your account who don't satisfy the MFA requirements. Ask them to comply by logging in and setting up factors. For more information, see [Managing your authentication factors](https://cloud.ibm.com/docs/account?topic=account-verification-authenticationauth-factors).
[Launch the logging web UI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-launch).
2. [View and manage your logs](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-view_logs).







 Step 5. Next steps 

Next, you can manage user access with IAM.

Identify the IAM policies that a user needs to work with the IBM Log Analysis service.

To learn more about IAM integration with the IBM Log Analysis service, see [Managing IAM policies and access groups](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-work_iam).
* UI
* API







 Auditing access policies 

To reduce the number of policies in the account and keep only the minimum access that is necessary for each user, you can identify the infrequently used access policies. You can determine whether to remove them, or in some cases, you might expect an infrequently used policy.

IAM captures authorization information for each policy. This information includes the last time that the policy was used to grant a permit and a running count of its use.



 Managing inactive policies in the console 

The inactive policies report shows policies that haven't permitted access in the last 30 days or longer. Policies that have never permitted access are not included.

To view inactive policies, you need the Editor role or higher on the AM Insight service, the IAM Access Management service, or on All Account Management services.

To manage inactive policies in the console, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Inactive policies.
2. Determine whether you can remove the inactive policies in the report.
3. To delete inactive policies, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/includes/account/includes/icons/action-menu-icon.svg) > Remove.



When you delete a policy, it's no longer included for authorization evaluations. IAM keeps a copy of all deleted policies for 10 days. During this time period, you can list and restore them at any time. To restore a deleted policy, see [Restoring deleted policies by using the API](https://cloud.ibm.com/docs/account?topic=account-iam-audit-policies&interface=apiiam-audit-policies-restore).





 Exporting user access policy reports
Figure 4: IAM identifiers for services and resources
4. The check box under Select roles determines the set of actions available to the user. Select the "Administrator" platform access role to allow the user grant other [users and service IDs](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-iam-overview) access to the instance. Select the "Manager" service access role to allow the user to manage the Object Storage instance as well as create and delete buckets and objects. These combinations of a Subject (user), Role (Manager), and Resource (Object Storage service instance) together form [IAM policies](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-iam-overview). For more detailed guidance on roles and policies, [see the IAM documentation](https://cloud.ibm.com/docs/account?topic=account-userroles).

Zoom

![IAM roles](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/console_iam_roles.png)

Figure 5: IAM select roles







 Give developers access to a bucket. 



1. Navigate to the Manage menu and follow the link at Access(IAM) > Service IDs. Here you can create a service ID, which serves as an abstracted identity bound to the account. Service IDs can be assigned API keys and are used in situations where you don't want to tie a particular Developer's identity to a process or component of an application.

Zoom

!