vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* AWS Key Management Service keys: [AWS Key Management Service Pricing](https://aws.amazon.com/kms/pricing/)
* Azure Key Vault keys: [Azure Key Vault pricing](https://azure.microsoft.com/en-us/pricing/details/key-vault/)
* Google Cloud KMS keys: [Google Cloud Key Management Service Pricing](https://cloud.google.com/security-key-managementsection-11).
* IBM Cloud KMS keys: No extra fees. For more information, see [Hyper Protect Crypto Services with Unified Key Orchestrator pricing](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-pricingfaq-how-charge-hpcs-uko).
* IBM Key Protect keys: No extra fees. For more information, see [Key Protect pricing](https://cloud.ibm.com/docs/key-protect?topic=key-protect-pricing-plan).





 How managed key rotation works 

When you rotate a managed key, new key material is automatically generated and replaces the previous key material. It moves into the Active state and becomes available for cryptographic operations. When you use the managed key to perform encryption, Hyper Protect Crypto Services with Unified Key Orchestrator uses only the latest key material. Key rotation changes the key material. The key ID can also change, depending on the keystore type.

The following diagram shows a contextual view of the key rotation functionality.

Zoom

![Manage key rotation](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/uko-key-rotation.svg)

Figure 1. Managed key rotation

Depending on the key type, managed keys in certain states are not eligible for key rotation. Before you rotate a managed key, make sure to check the following table. The Checkmark icon !
Go to the [Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) page by clicking the Help icon ![Help icon](https://cloud.ibm.com/docs-content/v1/content/9713d864488177dc6b273b53b7f2383a81f10bc1/icons/help.svg) > Support center from the console menu bar. From there, review the list of common FAQs. If you don't find the answers that you need, review the Contact Support section. For more information on account types and support products, see [Basic, Advanced, and Premium Support plans](https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans).





 Where can I view the billing address for my account? 

You can view the primary contact and address that is associated with an account by going to Manage > Account in the IBM Cloud console, and selecting Company profile.





 How can I ensure that my account is secure to avoid charges due to unauthorized access? 

As a self-managed platform, the security of an account is the responsibility of the account owner and all users with access to the account. Any charges that result from unauthorized access are the responsibility of the account owner.

To prevent unauthorized access, change your password regularly and require the use of multifactor authentication by all users on your account. These options include the use of time-based one-time passcode authentication, security questions, third-party authentication mechanisms, and password expiration rules. For more information, see [Types of multifactor authentication](https://cloud.ibm.com/docs/account?topic=account-types).

You can regularly review the list of account users and remove users who don't need access to the account. For more information, see [Removing users from an account](https://cloud.ibm.com/docs/account?topic=account-remove).
Use trusted profiles as foundation for secure cloud environments 

This tutorial may incur costs. Use the [Cost Estimator](https://cloud.ibm.com/estimator/review) to generate a cost estimate based on your projected usage.

IBM Cloud [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/account?topic=account-cloudaccess) enables you to control which users see, create, use, and manage resources in your cloud environment. Your environment might be a single IBM Cloud account, multiples accounts, or an [enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise) with a hierarchy of many account groups and accounts. When operating with account resources, often, users and service IDs are involved. Yet, there are more options available to manage access, assign privileges, and to identify: [Trusted profiles](https://cloud.ibm.com/docs/account?topic=account-identity-overviewtrustedprofiles-bestpract).

In this tutorial, you are going to learn about trusted profiles, their use cases, and how to utilize them for enhanced security. Trusted profiles can serve as foundation for secure cloud environments, as building block for secure cloud solutions. As part of this tutorial, you will create a trusted profile which is utilized by an app to perform administrative tasks.



 Objectives 



* Learn about use cases for trusted profiles
* Create trusted profiles and manage access to cloud resources
* Deepen your Identity and Access Management (IAM) knowledge



Zoom

![Architecture](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution68-trusted-profile-for-enterprise-security/TrustedProfile_with_CR_architecture.svg)

Solution architecture



* The container image for the application is pulled from the Container Registry and deployed to the Kubernetes cluster into a namespace.
* The user connects to the application.
* UI
* API







 Creating support cases 

If you experience problems with IBM Cloud®, you can use the [Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) to create a support case. Users with a Basic, Advanced, or Premium [support plan](https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans) can create a technical support case by attaching a specific resource or product to ensure that the case gets to the correct support engineer faster. This allows for a more efficient and effective resolution.

If your account is deactivated or if you don't have access to your account, you can create a support case by completing the [Create an Account, Login or Billing Request](https://watson.service-now.com/x_ibmwc_open_case_app.do!/create) form.

You can also create support cases for issues that are associated with access (IAM), billing & usage, account, and invoice or sales inquiries. The types of available support depend on the support level of the account. Your support plan also determines the severity level that you can assign to support cases. For more information, see [Case severity and response time](https://cloud.ibm.com/docs/get-support?topic=get-support-support-case-severity).

Users with a Lite account can also create support cases, but are limited to issues associated with access (IAM), billing & usage, account, and invoice or sales inquiries. Technical support for Lite accounts with free support is provided by the [IBM Cloud docs](https://cloud.ibm.com/docs) and [Stack Overflow](https://stackoverflow.com/questions/tagged/ibm-cloud?tab=Newest).

By default, account users don't have access to create, update, search, or view cases. The account owner must provide users access by assigning an Identity and Access Management (IAM) access policy.
* UI
* CLI
* API







 Viewing usage in an enterprise 

You can track resource and support costs from accounts in your IBM Cloud® enterprise by viewing their usage. The accounts and account groups that you can view usage for depend on your assigned access.

IBM Cloud enterprises enable you to centrally manage multiple IBM Cloud accounts. As an enterprise user, you can keep an eye on resource usage and the associated costs for any account in the enterprise. See [What is an enterprise?](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise) for more information.



 Required access for viewing enterprise usage 

In an enterprise, access to usage information is controlled by the Enterprise service. To view usage information, users must be invited to the enterprise account and have the Usage Reports Viewer, Editor, or Administrator role on the Enterprise service. The Usage Reports Viewer role provides access only to viewing usage reports, while the Editor and Administrator roles enable additional enterprise management actions. In keeping with security best practices, assign the least amount of access that is needed for the user to complete their task. For more information, see [Enterprise actions and roles](https://cloud.ibm.com/docs/account?topic=account-account-servicesenterprise-account-management).

You can give users granular access so that they can view usage for a certain account or account group. For example, say that your enterprise has account groups for each department, and each department has account groups for each team. You can scope the access so that each enterprise user can see only the information that is needed to fulfill their job role.



* Your financial officer needs to view usage for the entire enterprise so that they can track and recover costs for each department, but they don't need to create accounts or account groups. Assign them the Usage Reports Viewer role for the enterprise.
* Each department lead needs to view usage for their department, and they also need to create and manage accounts and account groups for their teams. Assign each department lead the Editor role for their department's account group.
* Each team lead needs to view their team's usage, but you want them to get department approval to add new accounts to their team.
8. Select the broker that you want to link to this plan. If you haven't added a broker to your account, you can't link a broker to your plan. After you add a broker, you can link it by editing the pricing plan.
9. Click Save.
10. Click Add metrics.
11. In the Usage metrics section, click Add metrics.
12. Enter 1 as the smallest unit that customers pay.
13. Select Instance as the unit.
14. Enter Instance as the display name for the unit.
15. Select Per unit as the charge method.
16. Enter 1 as the USD price.
17. Click Done.
18. When you are ready to submit your pricing plan and metering for review, click Request update.







 Step 5: Add features for your service 

If you completed the steps to define your pricing plan, you can add a list of features for your service. These features uniquely identify your product's attributes and differentiate your pricing plan from others. By providing a list of features for your product, you can help customers choose the most suitable pricing plan for their use case.

You can add up to five features for your product, but you must add at least one. The first feature that you add appears more prominently. Include the most important and differentiating details as the first feature.

To add features for your service, complete the following steps:



1. Click Pricing.
2. Select a pricing plan from the table that you previously added. After you select a plan, you are redirected to the Pricing plan details page.
3. Click Add features.
4. Enter a description for each feature.



* You can remove any feature that you add by clicking Remove feature.



5. Click Save.







 Step 6: Review and submit the digital platform reseller agreement 

If you plan to offer usage-based pricing plans, it is required to review and submit the IBM Digital Platform Reseller Agreement. This legal agreement sets the terms and conditions under which providers can onboard and sell products in IBM Cloud.
Centrally managing billing and usage with enterprises 

You can centrally manage multiple IBM Cloud® accounts with

Enterprises. Because billing is separate from the individual child accounts and consolidated to the enterprise level, enterprises simplify managing billing, invoicing, and payments for the accounts.

New to IBM Cloud enterprises? See [What is an enterprise?](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise) for more details about how enterprises can help you centrally manage billing and usage.



 Enterprise billing model 

In an enterprise, billing is managed by the enterprise rather than in the individual child accounts. This centralized billing model differs from a stand-alone account in the following ways.



* Credit from any existing subscriptions or promotions in accounts that are added to the enterprise is consolidated into the enterprise's credit pool. The billing administrator adds new subscriptions to the credit pool from the enterprise account.
* Usage from all accounts is deducted from the shared credit pool. If given access, enterprise users can view usage costs for all accounts and account groups in the enterprise. Users within each child account can continue to monitor usage in the particular account, but they don't have visibility to other accounts in the enterprise.
* Usage is invoiced through the enterprise account. Only the enterprise billing administrator can view invoices and manage payments.



Zoom

![A diagram that shows that credit from accounts is added to the enterprise credit pool, which is managed by the billing administrator in the enterprise account. Usage access is managed separately and can be targeted to the enterprise, an account group, or an account.](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/includes/billing-usage/includes/billing-usage/images/enterprise-billing-usage.svg)

Figure 1.Enterprise billing and usage management





 Billing options
How does pricing work on the IBM Blockchain Platform for IBM Cloud? 

IBM Blockchain Platform for IBM Cloud is priced based on the VPCs that you allocate to your blockchain nodes on the IBM Kubernetes Service. For more information, see [Pricing for IBM Blockchain Platform for IBM Cloud](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricingibp-saas-pricing).





 What are the limitations of the free IBM Blockchain Platform using the IBM Cloud Kubernetes Service free cluster? 



* Preview the IBM Blockchain Platform at no charge for 30 days when you link your IBM Blockchain Platform service instance to an IBM Cloud Kubernetes free cluster.
* Performance will be limited by throughput, storage, and functionality. Read more about the [limitations of free clusters](https://cloud.ibm.com/docs/containers?topic=containers-cs_ovcluster_types).
* IBM Cloud will delete your Kubernetes cluster after 30 days.
* Only one blockchain console can be connected to a free cluster at a time.
* You cannot migrate any nodes or data from a free cluster to a paid cluster.



The following capabilities are only available on a paid cluster:



* Customizing resource allocation for a node during or after deployment.
* Using a Hardware Security Module (HSM) to secure the private key for a node.
* Configuring a Certificate Authority (CA) for high availability by using a PostgreSQL database and replica sets.
* Selecting a specific Kubernetes zone when deploying a node.
* Overriding node configuration during or after deployment by using the console or APIs.
* Adding or removing ordering nodes to an ordering service. The free offering only supports a single node Raft ordering service.



See [Find out how to preview the platform free for 30 days](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-saas-pricingibp-saas-pricing-free) for more information on how to get started.
Use the values in the https_url, username, and password to open the web console.
* To reset the password, select the Service credentials tab from your service page and then delete the existing service lite-tier service credential. Then click New credential to generate a new password for the existing username.
* When you create a Lite instance, be sure to provide an email address so you receive reactivation notices and password reset notices.
* If your use of Db2 on Cloud exceeds the purpose provided by a Lite account with free support, upgrade to a paid account with [basic, advanced, or premium support](https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans) to open cases for technical issues.







 What options do I have for support? 

The free Lite plan for Db2 on Cloud, intended for prototyping and demoing applications, has only community support available to help you. You cannot get assistance with your free Lite plan by opening a support ticket. For example, if you need help with a Db2 usage question, query optimization, or a syntax error, review the available [Communities](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-communities) and the list of [Db2 on Cloud Resources](https://www.ibm.com/cloud/db2-on-cloud/resources).
Use the values in the https_url, username, and password to open the web console.
* To reset the password, select the Service credentials tab from your service page and then delete the existing service lite-tier service credential. Then click New credential to generate a new password for the existing username.
* When you create a Lite instance, be sure to provide an email address so you receive reactivation notices and password reset notices.
* If your use of Db2 on Cloud exceeds the purpose provided by a Lite account with free support, upgrade to a paid account with [basic, advanced, or premium support](https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans) to open cases for technical issues.



* What options do I have for support?

The free Lite plan for Db2 on Cloud, intended for prototyping and demoing applications, has only community support available to help you. You cannot get assistance with your free Lite plan by opening a support ticket. For example, if you need help with a Db2 usage question, query optimization, or a syntax error, review the available [Communities](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-communities) and the list of [Db2 on Cloud Resources](https://www.ibm.com/cloud/db2-on-cloud/resources).



IBM Watson Query



* How do I generate credentials for my instance?



1. Log in to [IBM Cloud](https://cloud.ibm.com).
2. Open your [Resource list](https://cloud.ibm.com/resources).
3. Under Databases, locate your Watson Query instance and click the service name. This list includes all instances that were created under a resource group or that were migrated into a resource group.
4. Click Service credentials > New credentials > Add to generate your Watson Query Manager credentials.
5. Expand View credentials, which displays your service connectivity information including your credentials (username and password).
6.
How did I exceed the runtime memory allowance? 

You went over the allowed memory for your IBM Cloud® account.

  What’s happening 

You're unable to deploy apps, and an error states that you've exceeded your organization's memory limit.

  Why it’s happening 

In Lite accounts that were created before 12 August 2021, your Cloud Foundry apps can use up to 256 MB of instantaneous runtime memory. In Pay-As-You-Go or Subscription accounts, there's a 2 GB memory limit.

  How to fix it 

You can get more memory by upgrading your Lite account. Go to Manage > Account in the IBM Cloud console, and select Account settings. For more information about Lite account features, see [Lite account](https://cloud.ibm.com/docs/account?topic=account-accountsliteaccount).

If you don't want to upgrade from a Lite account but have some idle apps, you can delete them to free up some runtime memory.
Take advantage of multiple IBM Cloud locations 

All users of IBM Cloud automatically have access to the Dallas, London, Frankfurt, Sydney, Washington DC, and Tokyo locations. The IBM Cloud Global Operations team manages all locations to avoid maintenance impacts and minimize the risk of incidents that affect all locations at the same time.

You can check the status of your locations from the dashboard on the IBM Cloud status widget. To view specific events, click View all.





 Subscribing to email notifications 

As a Lite account owner, you can select whether to receive email notifications about IBM Cloud platform unplanned events, such as outages, and planned events, such as maintenance. As a Pay-As-You-Go or Subscription account, you can choose whether to receive IBM Cloud infrastructure email notifications about unplanned events, maintenance, and announcements. For more information, see [Setting email preferences](https://cloud.ibm.com/docs/account?topic=account-email-prefs).
Infrastructure resources for classic clusters are created in a separate IBM Cloud infrastructure account. Usually, your Pay-As-You-Go or Subscription account is linked to the IBM Cloud infrastructure account so that account owners can access classic IBM Cloud infrastructure automatically. To authorize other users to access classic compute, storage, and networking resources, you must assign [classic infrastructure roles](https://cloud.ibm.com/docs/openshift?topic=openshift-classic-roles).

VPC infrastructure resources are integrated into IAM and as such, you must have the IBM Cloud IAM Administrator platform access role to the [VPC Infrastructure service](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started) to create and list VPC resources.

For both [classic and VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-infrastructure_providers), the credentials to access infrastructure resources are stored in an API key for the region and resource group of the cluster. To create and manage clusters after the infrastructure permissions are set, assign users IAM access roles to Red Hat OpenShift on IBM Cloud.

Unlike classic, VPC does not support manually setting infrastructure credentials (ibmcloud oc credential set) to use another IBM Cloud infrastructure account to provision worker nodes. You must use your IBM Cloud account's linked infrastructure account.

Does my account already have access to the IBM Cloud infrastructure portfolio?
: To access the IBM Cloud infrastructure portfolio, you use an IBM Cloud Pay-As-You-Go or Subscription account. If you have a different type of account, view your options in the following list.

Lite accounts
: Lite accounts can't provision clusters. To create a standard cluster, upgrade your Lite account to an IBM Cloud [Pay-As-You-Go](https://cloud.ibm.com/docs/account?topic=account-accountspaygo) or [Subscription](https://cloud.ibm.com/docs/account?topic=account-accountssubscription-account) account.

Pay-As-You-Go
: You can create standard clusters.