vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Create a new role](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/tut-iam-3-clear.png)
6. Look for the cloud-object-storage.account.get_account_buckets action and click Add.

![Create a new role](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/tut-iam-4-list.png)
7. Click Create to finish creating the custom role.







 Step 2: Create a new user access policy 

Now that we have our new role, we can apply it to a user.



1. Follow the Users link in the navigation menu, and select the user requiring limited access.
2. Click on the Assign access button.

![Create a new policy](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/tut-iam-5-user.png)
3. Select the Access policy tile and select Cloud Object Storage.

![Create a new policy](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/tut-iam-6-policy.png)
4. Scroll down and assign the new role by checking the box next to List Buckets Only.
5. Click Add.

!
Create a bucket with a different storage class by using the REST API [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-storage-class) 
 Create a bucket with Key Protect or Hyper Protect Crypto Services managed encryption keys (SSE-KP) by using the REST API [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-key-protect) 
 Create a bucket by using Terraform [Learn more](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-object-storage-resources) 







 Step 2: Configure service-to-service authorization 

Configure service-to-service authorization to your COS bucket so you do not need to pass an API key when writing your encrypted data to the COS bucket.

The following steps show how to define service to service authorization when the COS bucket is available in a different account from where auditing events are generated:

You must complete these steps in the account where the COS bucket is available.



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login) as the account owner that will be configuring IBM Cloud Activity Tracker Event Routing targets.

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. Click Manage > Access (IAM). Manage access and users is displayed.
3. Click Authorizations.
4. Click Create.
5. Select the Source account. Choose Other account. Then, enter the account ID for the source service. An account ID is a 32 character, unique account identifier.
6. For Source service select Activity Tracker Event Routing and for How do you want to scope the access? select All resources.
7.
Enable virtual routing and forwarding (VRF) and service endpoints by creating a support case. Follow the instructions in [enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uivrf).









 Set the IAM permissions 



1. Set up account access (Cloud Identity and Access Management (IAM)):



1. Create an IBM Cloud [API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key). The user who owns this key must have the Administrator role.

Service ID API keys are not supported for the Red Hat OpenShift Container Platform on VPC landing zone deployable architecture.
2. For compliance with IBM Cloud Framework for Financial Services: Require users in your account to use [multifactor authentication (MFA)](https://cloud.ibm.com/docs/account?topic=account-account-getting-startedaccount-gs-mfa).
3. [Set up access groups](https://cloud.ibm.com/docs/account?topic=account-accoungetting-startedaccount-gs-accessgroups).

User access to IBM Cloud resources is controlled by using the access policies that are assigned to access groups. For IBM Cloud Financial Services validation, do not assign direct IAM access to any IBM Cloud resources.

Select All Identity and Access enabled services when you assign access to the group.







 Verify access roles 

IAM access roles are required to install this deployable architecture and create all the required elements.

You need the following permissions for this deployable architecture:



* Create services from IBM Cloud catalog.
* Create and modify IBM Cloud VPC services, virtual server instances, networks, network prefixes, storage volumes, SSH keys, and security groups of this VPC.
* Create and modify IBM Cloud direct links and IBM Cloud Transit Gateway.
* Access existing Object Storage services.



For information about configuring permissions, contact your IBM Cloud account administrator.





 Access for IBM Cloud projects
Before you can create an enterprise by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).



If you don't have a Subscription account, you can upgrade your account as described in [Upgrading your account](https://cloud.ibm.com/docs/account?topic=account-upgrading-account).





 Creating an enterprise in the console 



1. In the IBM Cloud console, go to Manage > Enterprise, and click Create.
2. Enter a unique name to identify your enterprise. Typically, the name reflects your company or organization, such as My organization's enterprise. You can edit the enterprise name later if needed.
3. If your company or organization has an associated domain name, enter it in the Domain field. You can specify any domain or subdomain format, such as example.com or my.example.com.
4. Review the information about the impact to your account, and select I understand the impact to my account. Then, click Create.

After the account is added to the enterprise, it can't be removed. Be sure you want to permanently move the account to an enterprise.



After a few moments, your enterprise is created, and you can view the enterprise dashboard. Your IBMid is listed as the contact. The contact serves as a focal point for any enterprise concerns, such as billing or usage questions.
This command returns a URL and prompts for a passcode. Go to that URL in your browser and log in. If successful, you get a one-time passcode. Copy this passcode and paste it as a response on the prompt. After successful authentication, you are prompted to choose your account. If you have access to multiple accounts, select the account that you want to log in as. Respond to any remaining prompts to finish logging in.
2. Select the current generation of VPC.

ibmcloud is target --gen 2







 Creating a backup policy from the CLI 

Run the ibmcloud is backup-policy-create command to create a backup policy without a backup plan. Use the options --match-tags and --name to give your policy a name and identify the tag that you want to use for your target resources. After the policy is created, you can [add backup plans](https://cloud.ibm.com/docs/vpc?topic=vpc-create-backup-policy-and-plan&interface=terraformbackup-create-plan-cli) to it later on.

cloudshell:$ ibmcloud is backup-policy-create --match-tags dev:test --name my-backup-policy-v1
Creating backup policy my-backup-policy-v1 under account Test Account as user test.user@ibm.com...

ID r138-8c494618-9e4f-4b67-9a08-ee3491404f3b
Name my-backup-policy-v1
CRN crn:v1:bluemix:public:is:eu-de:a/a10d63fa66daffc9b9b5286ce1533080::backup-policy:r138-8c494618-9e4f-4b67-9a08-ee3491404f3b
Status pending
Plans ID Name Resource type

Backup tags dev:test
Backup resource type volume
Resource group defaults
You also need to verify that you have server or desktop licenses, along with any additional third-party licenses, depending on the applications that you intend to use.





 Step 4. Set up network connectivity for logging on to IBM Cloud 

All of the resources that are provisioned through this solution are in a private network space with security groups attached wherever needed. The IP addresses are internal to IBM, so you need to use a separate VPN account for logging on to hypervisors and creating the virtual machine images. For more information about enabling VPN access and setting the password, see [Getting started with IBM Cloud Virtual Private Networking](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-getting-started). After you enable your VPN access and set the password, download the [VPN client](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-standalone-vpn-clients). You then have access to the private network where your resources are provisioned.





 Step 5. Enable VLAN spanning or VRF on your IBM Cloud account (Classic and VMWare only) 

To enable VLAN spanning for your classic and VMWare solutions, complete the following steps:



1. Log in to the IBM Cloud console by using your unique credentials.
2. Select Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Classic Infrastructure > Network > IP Management > VLANs.
3. Click VLAN Spanning and select Enable.



To enable VRF, see [Enabling VRF](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf).





 Step 6. Set up user permissions in IAM 



 Classic 

To provision Citrix DaaS for IBM Cloud, classic infrastructure users need these permissions:



Table 1. Required user permissions to provision Classic and VMwWre

 Category Permission
In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images.
2. On the Custom images tab, click the image name to see the volume from which it was created. The image details panel links to the source volume.



To use this image when you create a new instance, select it as operating system type when you create an instanceL



1. In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Virtual server instances.
2. Click Create. For more information about how to provision a new virtual server instance, see [Creating virtual server instances in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers). For the Operating system, select the Custom image tile.
3. Click Select custom image and select the image from volume that you created.









 Create an image from a volume with the CLI 

Use the CLI to create an image from a volume that is attached to an available virtual server instance as the primary boot volume or as a secondary boot volume.



 Before you begin 



1. Make sure that you downloaded, installed, and initialized the following CLI plug-ins:



* IBM Cloud CLI
* The infrastructure-service plug-in
The [Getting Started guide](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) walks through the basic steps of creating buckets and objects, as well as inviting users and creating policies. A list of basic 'curl' commands can be found [here](https://cloud.ibm.com/docs/cloud-object-storage/cli?topic=cloud-object-storage-curl).

Learn more about using the IBM Cloud CLI to create applications, manage Kubernetes clusters, and more [in the documentation](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli).





 Using the API 

For managing data stored in Object Storage, you can use S3 API compatible tools like the [AWS CLI](https://cloud.ibm.com/docs/cloud-object-storage/cli?topic=cloud-object-storage-aws-cli)with [HMAC credentials](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-uhc-hmac-credentials-main) for compatibility. As IAM tokens are relatively easy to work with, curl is a good choice for basic testing and interaction with your storage. More information can be found in [the curl reference](https://cloud.ibm.com/docs/cloud-object-storage/cli?topic=cloud-object-storage-curl), as well as [the API reference documentation](https://cloud.ibm.com/docs/cloud-object-storage/api-reference?topic=cloud-object-storage-compatibility-api).





 Using libraries and SDKs
This command returns a URL and prompts for a passcode. Go to that URL in your browser and log in. If successful, you get a one-time passcode. Copy this passcode and paste it as a response on the prompt. After successful authentication, you are prompted to choose your account. If you have access to multiple accounts, select the account that you want to log in as. Respond to any remaining prompts to finish logging in.
2. Select the current generation of VPC.

ibmcloud is target --gen 2







 Creating a backup policy from the CLI 

Run the ibmcloud is backup-policy-create command to create a backup policy without a backup plan. Use the options --match-tags and --name to give your policy a name and identify the tag that you want to use for your target resources. After the policy is created, you can [add backup plans](https://cloud.ibm.com/docs/vpc?topic=vpc-create-backup-policy-and-plan&interface=clibackup-create-plan-cli) to it later on.

cloudshell:$ ibmcloud is backup-policy-create --match-tags dev:test --name my-backup-policy-v1
Creating backup policy my-backup-policy-v1 under account Test Account as user test.user@ibm.com...

ID r138-8c494618-9e4f-4b67-9a08-ee3491404f3b
Name my-backup-policy-v1
CRN crn:v1:bluemix:public:is:eu-de:a/a10d63fa66daffc9b9b5286ce1533080::backup-policy:r138-8c494618-9e4f-4b67-9a08-ee3491404f3b
Status pending
Plans ID Name Resource type

Backup tags dev:test
Backup resource type volume
Resource group defaults
ibmcloud is load-balancer-pool-member-create r014-c7cadd8e-9e8b-4965-bee3-5d9ff95b3512 r014-474dca7d-aece-48a3-a636-fe8c3e654a3b 200 0767_5545cfb3-febc-4f09-b9ea-0aeb66074edf

Sample output:

Creating member of pool r014-474dca7d-aece-48a3-a636-fe8c3e654a3b under account CNS Development Account - netsvs as user ibm@us.ibm.com...

ID r014-1fdb900f-81a4-4204-839a-fcdee6c28e8a
Port 200
Target 0767_5545cfb3-febc-4f09-b9ea-0aeb66074edf
Weight 50
Health unknown
Created 2021-09-14T19:27:11.077-05:00
Provision status create_pending







 Creating a network load balancer with routing mode using the API 

To create a network load balancer by using the API, follow these steps:



1. Set up your [API environment](https://cloud.ibm.com/docs/vpc?topic=vpc-set-up-environmentapi-prerequisites-setup).
2. Create your API request payload using the following template. Modify the name and subnet with your own values.

{
"name": "nlb-vnf",
"is_public": false,
"profile": {
"name": "network-fixed"
},
"route_mode": true,
"subnets": [
{
"id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024"
}
]
This command returns a URL and prompts for a passcode. Go to that URL in your browser and log in. If successful, you get a one-time passcode. Copy this passcode and paste it as a response on the prompt. After successful authentication, you are prompted to choose your account. If you have access to multiple accounts, select the account that you want to log in as. Respond to any remaining prompts to finish logging in.
2. Select the current generation of VPC.

ibmcloud is target --gen 2







 Creating a backup policy from the CLI 

Run the ibmcloud is backup-policy-create command to create a backup policy without a backup plan. Use the options --match-tags and --name to give your policy a name and identify the tag that you want to use for your target resources. After the policy is created, you can [add backup plans](https://cloud.ibm.com/docs/vpc?topic=vpc-create-backup-policy-and-plan&interface=apibackup-create-plan-cli) to it later on.

cloudshell:$ ibmcloud is backup-policy-create --match-tags dev:test --name my-backup-policy-v1
Creating backup policy my-backup-policy-v1 under account Test Account as user test.user@ibm.com...

ID r138-8c494618-9e4f-4b67-9a08-ee3491404f3b
Name my-backup-policy-v1
CRN crn:v1:bluemix:public:is:eu-de:a/a10d63fa66daffc9b9b5286ce1533080::backup-policy:r138-8c494618-9e4f-4b67-9a08-ee3491404f3b
Status pending
Plans ID Name Resource type

Backup tags dev:test
Backup resource type volume
Resource group defaults
Created at 2023-02-21T18:37:17+00:00
[Pre-requisite] [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2. Log in to the region in the IBM Cloud where the logging instance is running. Run the following command: [ibmcloud login](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login)
3. Set the resource group where the logging instance is running. Run the following command: [ibmcloud target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_target)

By default, the default resource group is set.
4. Get the instance name. Run the following command: [ibmcloud resource service-instances](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_instances)

ibmcloud resource service-instances
5. Create the IBM Cloud resource service key. Run the [ibmcloud resource service-key-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_service_key_create) command:

ibmcloud resource service-key-create <NAME> --instance-name <SERVICE_INSTANCE>

Where NAME is the desired name of the service key and SERVICE_INSTANCE is the name of the service instance from the previous step.

The output from this command includes the field service_key that contains the logging service key for the instance.
6. Restrict access to the IBM Cloud resource service key so that only users that have the administrator and manager roles can see information associated with the service key.

Identify the service ID associated with the service that you created in the previous step. Run the following command to list all the service IDs that are available in the resource group:

ibmcloud iam service-ids
Provisioning dedicated instances 

You can provision your dedicated instances through the IBM Cloud® catalog. See [Signing up for IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-account-getting-started) to set up your IBM Cloud catalog credentials.



  Provisioning a dedicated virtual server instance through the IBM Cloud catalog 

To provision a dedicated virtual server instance through the IBM Cloud catalog, complete the following steps:



1.  Log in to the [IBM Cloud catalog](https://cloud.ibm.com/catalog) by using your unique credentials.
2.  In the Compute Infrastructure section, click the Virtual Server tile.
3.  Select Dedicated as your virtual server type.
4.  In the Dedicated Host section, select Auto Assign. IBM Cloud then automatically assigns your instance to a host in your selected data center.

For dedicated hosts, select Specify Host or Create Host. For more information about dedicated hosts and dedicated host instances, see [Dedicated virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-dedicated-virtual-servers).
5.  Complete all of the relevant information for your dedicated virtual server instance.
6.  After you review your order summary, click the Third-Party Service Agreements checkbox.
7.  Click Provision.







  Next steps 

After your virtual server is provisioned and available to use, you can configure your virtual servers by using the IBM Cloud console or API. For more information, see [Configuring virtual servers](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-configuring-virtual-serversconfiguring-virtual-servers).
<br><br> * Prepare requirements template & review client requirements.<br> * Prepare quote.<br> * Create client accounts, locations, and clusters, and API keys.<br><br><br> <br><br> * Perform requirements assessment.<br> * Complete the requirements template.<br> * Review and approve quote.<br> * Review and confirm environment setup.<br> * Assign cluster operator and developer roles.<br><br><br> Verify cluster operator permissions Verify cluster developer permissions 







 Setting up your account 

Before you can resell Satellite, set up an IBM Cloud enterprise and client accounts.



 Creating an enterprise account 

[Create an enterprise account](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-tutorial) for your organization. This account serves as the parent account. After you create the enterprise account, you can [set up client accounts](https://cloud.ibm.com/docs/satellite?topic=satellite-tenancy-modelcreate-account-tenancy) for each customer.





 Setting up client accounts 

Complete the following steps to set up a client account with a resource group, location, logging and monitoring instances, and a Satellite location.

Want to automate this step? After you create an account, you can use the IBM terraform provider plug-in to provision IBM Cloud service instances.



1. [Add a client account to your enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-add).
2. In the client account, [provision an Log Analysis instance](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-getting-startedgetting-started-provision).
3. In the client account, [provision a Monitoring instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-provisionprovision).
4. In the client account, [provision an IBM Cloud Object Storage instance](https://cloud.ibm.com/docs/monitoring?topic=monitoring-provisionprovision).
In addition, users must have a service role that defines the permissions to work with IBM Cloud Monitoring.





 Provisioning an instance of Monitoring 

From the [catalog](https://cloud.ibm.com/login) choose IBM Cloud Monitoring from the available services. When selected, you will be taken to the configuration shown in Figure 1. At the bottom of the screen under "IBM platform metrics:" select Enable before creating the instance. You can use either the console or the CLI to provision a new service instance.

![Instance creation](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/SysDig-instance-creation.png)

After you [login](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login) using IBM Cloud Developer Tools and target both the region and resource group for your account, create a new resource using the command as shown.

ibmcloud resource service-instance-create <INSTANCE_NAME> <SERVICE_NAME> <SERVICE_PLAN_NAME> <LOCATION>

In the code sample, replace the placeholders with the [appropriate values](https://cloud.ibm.com/docs/monitoring?topic=monitoring-pricing_plans).



 Value Description Sample 

 <INSTANCE_NAME> The name of your new instance MyMonitoring 
 <SERVICE_NAME> The name of the service sysdig-monitor 
 <SERVICE_PLAN_NAME> The name of the plan Lite 
 The region of your buckets us-east 



ibmcloud resource service-instance-update <INSTANCE_NAME> -p '{"default_receiver": true}'





 Connect Object Storage to Monitoring 

Most of the work you will do with Monitoring will be in specific dashboards to be discussed later. But first, there are a couple of ways in which you can get started.

Complete the following steps to get an IAM token:



1.