vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* IAM Trusted ID - Link your trusted profile ID. For more information, to view the trusted profile ID, see [Trusted Profile ID](https://cloud.ibm.com/docs/schematics?topic=schematics-agent-trusted-profile). For example, Profile-1bd5eala-000-4a6666-00011.
* Resource Group - Select your resource group and specific resources where you need to connect a Agent. Check you have the right permissions for the resource group.



6. Click Connect.



* The Agent status will change to Ready to bind status. The Ready to bind status signifies that the Agent is ready for the next step to bind the workspace. Wait 15-30 minutes to view the Agent status.



7. Optional: From your Agent instance you can click the ... dots to perform the following operations.



* Edit Agent to edit the Agent configuration.
* Bind Agent to the Schematics Workspaces.
* Pause Agent to pause the Agent execution.
* Delete Agent to delete an Agent.









 Connecting Agent through API 



1. Follow the [steps](https://cloud.ibm.com/docs/schematics?topic=schematics-setup-apics_api) to retrieve your IAM access token and authenticate with IBM Cloud Schematics by using the API.
2. You have the right permission to create



* [VPC infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).
* [IKS](https://cloud.ibm.com/docs/containers?topic=containers-access_reference) cluster.
* [LogDNA](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam).
* [Activity tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam) services.





Here are the list of CURL commands use to register and unregister the Agent.
Select IAM services.
5. In the section What type of access do you want to assign?, select IBM Log Analysis.
6. In the section Which services do you want to assign access to?, complete the following steps:



1. Select Services based on attributes to refine the scope of the policy. Choose 1 of the following options:

Option 1: Set the scope to 1 instance in a resource group. Select Resource group to choose the resource group. Then select Service Instance to choose the instance within the resource group.

Option 2: Set the scope to 1 instance. Select Service Instance to choose the instance.
2. Select a logGroup.



7. Select a service role. The service role defines the permissions a user has to view and manage resources in that group.



* Select manager to grant admin permissions for the service.
* Select reader to grant permissions to view data only.



[Learn more about the roles that you need](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam).
8. Click Add.
9. Click Assign.









 Step 4. Add a user or service ID to the access group 

You can add users or service IDs to an existing access group.



 Add a user to the access group 

Complete the following steps to add a user:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Add users on the Users tab.
4. Select the users that you want to add from the list, and click Add to group.







 Add a service ID to the access group 

Complete the following steps to add a service ID:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click the Service IDs tab, and click Add service ID.
4.
* CLI
* API







 Retrieving IAM access tokens 

To use the IBM Cloud Metrics Routing API, you must use an IBM Cloud® Identity and Access Management (IAM) access token. Each token is valid only for one hour, and after a token expires, you must request a new one if you want to continue using the API.



 Retrieving an access token for the current session by using the IBM Cloud CLI 

You can use the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started) to generate your IAM access token.

Complete the following steps to generate an access token for the current session:



1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Run the following command to retrieve your Cloud IAM access token.

ibmcloud iam oauth-tokens | grep IAM | cut -d : -f 2 | sed 's/^ //'

The following truncated example shows a retrieved IAM token.

IAM token: Bearer eyJraWQiOiIyM...







 Retrieving an access token by using an API key and the IBM Cloud CLI 

You can also retrieve your access token programmatically by creating a [service ID API key](https://cloud.ibm.com/docs/iam?topic=iam-serviceidapikeys) for your application, and then exchanging your API key for an IBM Cloud IAM token.



1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
For more information, see [IAM events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iam).





 Catalog management events 

You can track the following events:



* Viewing or updating account settings
* Viewing or updating a catalog
* Listing all products in a catalog
* Listing all products in an account
* Creating, updating, viewing, or deleting a product



unavailable indicates when an update is made, but specific details about the update aren't included.

For more information, see [Account management events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_acc_mgt).





 Context-based restrictions events 

You can track the following events:



* Creating, updating, or deleting rules
* Creating, updating, or deleting network zones



For more information, see [Context-based restrictions events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-auditing-events-for-context-based-restrictions).
[Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in, the IBM Cloud Dashboard opens.
2. From the Dashboard, select the IBM Cloud Object Storage instance where you plan to create the bucket.
3. Select Buckets. Then, select the bucket that you created where you want to archive events.
4. Select Configuration.
5. Copy one of the private endpoints.







 Step 7. Grant IAM policies to a user to archive events 

The following table lists the policies that a user must have to configure archiving of events from the IBM Cloud Activity Tracker web UI into a bucket in an IBM Cloud Object Storage instance:



Table 3. IAM policies

 Service Role Permission granted 

 IBM Cloud Activity Tracker Platform role: Viewer Allows the user to view the list of service instances in the Observability Logging dashboard. 
 IBM Cloud Activity Tracker Service role: Manager Allows the user to launch the web UI and view events in the web UI. 



[Learn more](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iamiam).

Complete the following steps to assign a user permission to archive events:



1. From the menu bar, click Manage > Access (IAM), and then select Users.
2. From the row for the user that you want to assign access, select the Actions menu, and then click Assign access.
3. Select Assign access within a resource group.
4. Select a resource group.
5. If the user does not have a role already granted for the selected resource group, choose a role for the Assign access to a resource group field.

Depending on the role that you select, the user can view the resource group on their dashboard, edit the resource group name, or manage user access to the group.

You can select No access, if you want the user to only have access to the IBM Cloud Activity Tracker service in the resource group.
6. Select IBM Cloud Activity Tracker.
7. Select the platform role Viewer.
8. Select the service role Manager.
In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to review.
2. Select your name or the service ID.
3. Review the assigned access in the Access tab.



If you need more access, you must contact the account owner to update your access or contact the administrator for the service or service instance to update the access policy.





 Reviewing assigned access by using the CLI 

If you need to review your assigned access in an account that you've been added to, you can use the [ibmcloud iam user-policies](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_user_policies) command. This example lists policies of user name@example.com:

ibmcloud iam user-policies name@example.com





 Reviewing assigned access by using the API 

By using the API, you can only retrieve all policies in the account and filter by attribute values. You can check your assigned access in an account by going to Manage > Users > your_name > Access in the IBM Cloud console. To retrieve policies, call the [IBM Cloud® Identity and Access Management (IAM) Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-managementlist-policies) as shown in the following sample request:



* Curl
* Java
* Python
* Go
* Node



curl -X GET 'https://iam.cloud.ibm.com/v1/policies?account_id=$ACCOUNT_ID' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json'

ListPoliciesOptions options = new ListPoliciesOptions.Builder()
.accountId(exampleAccountId)
.iamId(EXAMPLE_USER_ID)
.build();

Response<PolicyList> response = service.listPolicies(options).execute();
PolicyList policyList = response.getResult();

System.out.println(policyList);
"IpProtocol": "-1",
"IpRanges": {
"CidrIp": "0.0.0.0/0"
}],
"Ipv6Ranges": ],
"PrefixListIds": ],
"UserIdGroupPairs": ]
}],
"VpcId": "<vpc_ID>"
}
Show more

For more information, see [Control traffic to resources using security groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) in the AWS documentation.





 AWS credentials 

Retrieve the Amazon Web Services (AWS) credentials that Satellite can use to create Satellite resources in your AWS cloud on your behalf.



1. Verify that you have the required [permissions in your AWS account](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-commonpermissions-aws) to create a Satellite location from a template.
2. [Create a separate IAM user that is scoped to EC2 access](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html).
3. [Retrieve the access key ID and secret access key credentials for the IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.htmlaccess-keys-and-secret-access-keys).
4. Optional: To provide the credentials during the creation of a Satellite location, format the credentials in a JSON file. The client_id is the ID of the access key and the client_secret is the secret access key that you created for the IAM user in AWS.

{
"client_id":"string",
"client_secret": "string"
}







 I created a Satellite location, what's next?
* An IAM policy for the IBM Log Analysis service with the service role Manager. This policy grants permissions to monitor, filter and search log, and define alerts through the logging web UI.



Note: As an administrator of the service, when you grant a user these policies, consider doing it within the context of a resource group. An IBM Log Analysis instance is provisioned within the context of a resource group. Therefore, grant access permissions within the context of the resource group.

Complete the following steps to assign a user both policies for the IBM Log Analysis service within the context of a resource group:



1. From the menu bar, click Manage > Access (IAM), and then select Users.
2. From the row for the user that you want to assign access, select the Actions menu, and then click Assign access.
3. Select Assign access within a resource group.
4. Select a resource group.
5. If the user does not have a role already granted for the selected resource group, choose a role for the Assign access to a resource group field.

Depending on the role that you select, the user can view the resource group on their dashboard, edit the resource group name, or manage user access to the group.

You can select No access, if you want the user to have access only to the IBM Log Analysis service in the resource group.
6. Select IBM Log Analysis.
7. Select the platform role Editor.
8. Select the service role Manager.
9. Click Assign.







 Granting permissions to a user to view logs 

As a user, auditor, or developer, you might need permissions to run the following actions:



* View logs
* Search logs
* Filter logs



Therefore, you need the following policies:



* An IAM policy for the IBM Log Analysis service with the platform role Viewer. This policy grants permissions to view the service instance details through the command line and in the IBM Cloud dashboard.
* An IAM policy for the IBM Log Analysis service with the service role Reader. This policy grants permissions to view, filter and search logs through the logging web UI.
Managing access with IAM for IBM Cloud DNS Services 

IBM Cloud® DNS Services leverages IAM to perform authorization and Authentication.

Access to DNS Services instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the DNS Services in your account must be assigned an access policy with an IAM role defined. The policy determines what actions a user can perform within the context of the service or instance that you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.

Policies enable you to grant access at different levels. Some of the options include the following:



* Access across all instances of the service in your account.
* Access to an individual service instance in your account.
* Access to a specific resource within an instance.





 Roles and permissions 

With IBM Cloud IAM, you can manage and define access for users and resources in your account.

To simplify access, DNS Services aligns with IBM Cloud IAM roles so that each user has a different view of the service, according to the role the user is assigned. If you are a security admin for your service, you can assign IBM Cloud IAM roles that correspond to the specific IBM Cloud® DNS Services permissions you want to grant to members of your team.

This section discusses IBM Cloud IAM in the context of DNS Services. For complete IAM documentation, see [Managing access](https://cloud.ibm.com/docs/account?topic=account-cloudaccess) in IBM Cloud.



 Platform access roles 

Use platform access roles to grant permissions at the account level, such as the ability to create or delete DNS Services instances in your IBM Cloud account.



Table 1. Platform access roles

 Action Role 

 View IBM Cloud® DNS Services instances Administrator, Operator, Editor, Viewer 
 Create IBM Cloud® DNS Services instances Administrator, Editor 
 Delete IBM Cloud® DNS Services instances Administrator, Editor 







 Service access roles
That policy determines what actions the user can perform within the context of the service or instance you select.

The actions are customized and defined by the IBM Cloud service as operations that are permitted in the service. The actions are then mapped to IAM user roles. Some of the actions taken you can track with the Activity Tracker service. In the following table, the actions and required permissions for Event Notifications are mapped.



Table 3. Actions mapped to different roles

 Service action Display name Role Description 

 event-notifications.sources.create POST /event-notifications/v1/instances/{instanceID}/sources Manager, Administrator, Event-Source-Manager Create Source for Event Notifications instance 
 event-notifications.sources.read GET /event-notifications/v1/instances/{instanceID}/sources/{sourceID} Manager, Administrator, Event-Source-Manager, Channel-Editor Get Source for Event Notifications instance 
 event-notifications.sources.update PUT /event-notifications/v1/instances/{instanceID}/sources/{sourceID} Manager, Administrator, Event-Source-Manager Update Source for Event Notifications instance 
 event-notifications.sources.delete DELETE /event-notifications/v1/instances/{instanceID}/sources/{sourceID} Manager, Administrator, Event-Source-Manager Delete Source from Event Notifications instance 
 event-notifications.sources.list GET /event-notifications/v1/instances/{instanceID}/sources Manager, Administrator, Event-Source-Manager, Channel Editor Get all sources of Event Notifications instance 
 event-notifications.topics.create POST /event-notifications/v1/instances/{instanceID}/topics Manager, Writer, Administrator Create Topic for Event Notifications instance 
 event-notifications.topics.read GET /event-notifications/v1/instances/{instanceID}/topics/{topicID} Manager, Reader, Writer, Administrator, Channel-Editor Get Topic for Event Notifications instance 
 event-notifications.topics.update PUT /event-notifications/v1/instances/{instanceID}/topic/{topicID} Manager, Writer, Administrator Update Topic for Event Notifications instance
curl -X GET https://us-south.appid.cloud.ibm.com/management/v4/<tenantID>/users/export --header "Accept: application/json" --header "Authorization: Bearer <IAMToken>"



User import command variables

 Variable Description 

 tenantID The service tenant ID can be found in your service credentials. You can find your service or application credentials in the App ID dashboard. 
 iam-token Your IAM token. 



Example response:

{
"itemsPerPage": 2,
"totalResults": 2,
"requestOptions": {},
"users": [
{
"id": "7ae804f3-0ed3-45f0-bc6b-1c6af868e6d6",
"name": "{{site.data.keyword.appid_short_notm}} Google User profile",
"email": "your@mail.com",
"identities":
{
"provider": "google",
"id": "105646725068605084546",
"idpUserInfo": {
"id": "105646725068605084546",
"email": "your@mail.com",
"picture": "profilePic.jpg"
}
}
],
"attributes": {
"points": 150
},
"roles": "admin"]
{
"id": "1439d777-185d-4be1-8f4a-c4e8142b87ea",
"name": "{{site.data.keyword.appid_short_notm}} Facebook User profile",
"email": "mail@mail.com",
"identities":
{
"provider": "facebook",
"id": "100195207128541",
For details, see [Account Access Report](https://cloud.ibm.com/docs/account?topic=account-access-report).





 How can I monitor bucket changes in the public cloud without using the cloud functions? 

You must use cloud functions to get notifications for object changes.





 How can I monitor Object Storage resources? 

Use the Activity Tracker service to capture and record Object Storage activities and monitor the activity of your IBM Cloud account. Activity Tracker is used to track how users and applications interact with Object Storage.





 Does an object in a bucket get overwritten if the same object name is used again in the same bucket? 

Yes, the object is overwritten.





 How do I get bucket information without using the web console? 

Use the Object Storage Resource Configuration API to get bucket information. For details, see [COS configuration](https://cloud.ibm.com/apidocs/cos/cos-configurationreturns-metadata-for-the-specified-bucket) and [COS Integration](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-mm-cos-integration).





 How can I manage service credentials for Object Storage instances? 

When a service credential is created, the underlying Service ID is granted a role on the entire instance of Object Storage. For details, see [Managing Service credentials](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-service-credentials).





 Why are parts of my credentials hidden or not viewable? 

There may be an issue where the viewer does not have sufficient roles to view the credential information. For more information, see [the account credentials documentation](https://cloud.ibm.com/account?topic=account-service_credentials&interface=uiviewing-credentials-ui).





 Is there a way to enable Key Protect on a Object Storage bucket after the bucket is created? 

No, it is not possible to add Key Protect after creating a bucket. Key Protect can only be added while creating the bucket.





 How can I move data into archive tier?
Additional details about the resource display including when the resource was created and by whom.

For classic infrastructure services, you can get similar information by using the [Audit log](https://cloud.ibm.com/docs/account?topic=account-audit-log).
* What are IBM Cloud Context-based restrictions?

As an account owner or administrator, you can define and enforce access restrictions for IBM Cloud® resources based on the network location of access requests by enabling context-based restrictions. For more information, see [What are context-based restrictions?](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).
* How do you use Context-based restrictions and IAM policies together?

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials.

Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure.
* What's the difference between Context-based restrictions and allowed IP addresses?

Context-based restrictions enforce access restrictions at the individual service level and access is evaluated when a user attempts to access a resource. Allowed IP address restrict access at the account level, which is evaluated at login.
* How can I make sure that my rule doesn't break an access flow?

As an administrator, you manage users, applications, and workflows that depend on having the right access when they need it. To make sure that your context-based restrictions rules don't brake an access flow, set the rule to report-only mode for at least 30 days before you enable the rule. This way, you can monitor the impact of the rule on your access flows, such as when access is denied or allowed and for which identities. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).
* What is IBM Cloud Identity and Access Management?