vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Granting user permissions to a user or service ID 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud. Complete the following steps to grant a user or service ID the minimum permissions to work with the IBM Log Analysis service:



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Log Analysis service. Contact the account administrator. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an access group 

Complete the following steps to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.



You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]





 Step 2. Add permissions to view events 

After you set up your group, you can assign a common access policy to the group.

Any policy that you set for an access group applies to all entities, users and service IDs, within the group.

You can assign the policy by using the UI or through the command line.
* UI
* API







 Auditing access policies 

To reduce the number of policies in the account and keep only the minimum access that is necessary for each user, you can identify the infrequently used access policies. You can determine whether to remove them, or in some cases, you might expect an infrequently used policy.

IAM captures authorization information for each policy. This information includes the last time that the policy was used to grant a permit and a running count of its use.



 Managing inactive policies in the console 

The inactive policies report shows policies that haven't permitted access in the last 30 days or longer. Policies that have never permitted access are not included.

To view inactive policies, you need the Editor role or higher on the AM Insight service, the IAM Access Management service, or on All Account Management services.

To manage inactive policies in the console, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Inactive policies.
2. Determine whether you can remove the inactive policies in the report.
3. To delete inactive policies, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/action-menu-icon.svg) > Remove.



When you delete a policy, it's no longer included for authorization evaluations. IAM keeps a copy of all deleted policies for 10 days. During this time period, you can list and restore them at any time. To restore a deleted policy, see [Restoring deleted policies by using the API](https://cloud.ibm.com/docs/account?topic=account-iam-audit-policies&interface=apiiam-audit-policies-restore).





 Exporting user access policy reports 

You can export an access policy report for each user in your account if you are the account owner, have the Editor role or higher on the User Management service, or have the Editor role or higher on the IAM Access Management service.
Granting permissions to view data within the context of a team in Workload Protection 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and consistently control access to all cloud resources in the IBM Cloud. Teams provide an isolated workspace in a Monitoring Workload Protection instance for a user or group of users to have access to metrics in a defined scope.

IAM can map a combination of teams and roles so that a user only has access to a specific set of metrics and can take a defined set of actions within the product.

Teams provide additional security by only allowing users to see metrics that are related to the infrastructure where their apps are deployed, as opposed to the entire infrastructure of the account. For example, in a Kubernetes cluster, you could grant a group of developers access to only see reports from scanned images from 1 kubernestes.namespace where their application is deployed.

In a IBM Cloud Monitoring Workload Protection instance, you can define 1 or more teams. A team provides an isolated workspace for a user or group of users to have access to metrics with a defined scope.

A IBM Cloud Monitoring Workload Protection instance includes the Secure operations teams.

By default, users are granted access to the Secure operations team or to the team that is configured as the default team by the instance administrator.



* An admin of the service can configure multiple teams, and change the default team.
* Each team has their own set of custom resources that they can use to monitor the data in scope for the team.
* Users in a team have access to the data that is included in the scope defined by the team administrator.



[Learn more about teams](https://cloud.ibm.com/docs/monitoring?topic=monitoring-teams).

For a user to monitor data within the context of a team, you must grant the user a policy for the IBM Cloud Monitoring Workload Protection service. The policy specifies the team and the service permissions for the user so the user can work with the data in scope for that team.

The following table shows the user roles that you can grant a user to work with the IBM Cloud Monitoring Workload Protection service:



Table 1. List of user roles

 User role IAM service role 

 ROLE_USER reader
3000268 - Check whether Kubernetes Service has at least users with the IAM manager role
3000269 - Check whether Kubernetes Service has at least service IDs with the IAM manager role
3000270 - Check whether Certificate Manager has at least users with the IAM manager role
3000271 - Check whether Certificate Manager has at least service IDs with the IAM manager role
3000113 - Check whether Cloudant service access is managed only by IAM access groups
3000272 - Check whether Databases for Redis service access is managed only by IAM access groups
3000273 - Check whether Databases for PostgreSQL access is managed only by IAM access groups
3000274 - Check whether Databases for MongoDB service access is managed only by IAM access groups
3000275 - Check whether Databases for Elasticsearch service access is managed only by IAM access groups
3000276 - Check whether Databases for etcd service access is managed only by IAM access groups
3000277 - Check whether Key Protect service access is managed only by IAM access groups
3000278 - Check whether Kubernetes Service access is managed only by IAM access groups
3000279 - Check whether Databases for EnterpriseDB service access is managed only by IAM access groups
3000114 - Check whether Cloud Object Storage buckets are enabled with IBM Activity Tracker
3000115 - Check whether Cloud Object Storage buckets are enabled with IBM Cloud Monitoring
3000116 - Check whether Cloud Object Storage bucket resiliency is set to cross region
3000301 - Check whether IBM Activity Tracker is provisioned in multiple regions in an account
3000302 - Check whether IBM Activity Tracker trails are integrated with LogDNA logs
3000303 - Check whether IBM Activity Tracker logs are encrypted at rest
3000304 - Check whether IBM Cloud Monitoring has no more than users with the IAM administor role
3000308 - Check whether IBM Activity Tracker has no more than users with the IAM administrator role
3000309 - Check whether IBM Activity Tracker has no more than service IDs with the IAM administrator role
3000310 - Check whether IBM Cloud Monitoring has no more than service IDs with the IAM administrator role
ibmcloud iam service-id-create <SERVICE_ID_NAME> [-d, --description DESCRIPTION]
3. [Assign an access policy](https://cloud.ibm.com/docs/iam?topic=iam-serviceidpolicy) for the service ID.

You can assign access permissions for your service ID [by using the IBM Cloud console](https://cloud.ibm.com/docs/iam?topic=iam-serviceidpolicyaccess_new).

To learn how roles map to specific actions, see [Managing IAM access for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam).
4. Create a [service ID API key](https://cloud.ibm.com/docs/iam?topic=iam-serviceidapikeys).

ibmcloud iam service-api-key-create <API_KEY_NAME> <SERVICE_ID_NAME> [-d, --description DESCRIPTION] [--file FILE_NAME]

Replace SERVICE_ID_NAME with the service ID name.

Save your API key by downloading it to a secure location.



* I cannot find auditing events in my account. Where can I find them?

In IBM Cloud, auditing events are generated automatically with the exception of some services that require additional configuration or a specific service plan. For more information about these services, see [Enabling Activity Tracker events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-events-opt-in).

There are 2 ways by which you can access the auditing events in your account:



* Option 1: You can see auditing events through IBM Cloud Activity Tracker hosted event search. This is the default option. For more information, see [Getting started tutorial](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).
* Option 2: You can configure IBM Cloud Activity Tracker Event Routing in your account.
IAM Access 

To manage targets, ensure you have the [correct IAM permissions to configure IBM Cloud Metrics Routing](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-iam).

To allow the IBM Cloud Metrics Routing service to send metrics to your Monitoring destinations, you must have a service to service authorization configured in the account where the target is located. For more information, see [Managing authorizations to grant access between services](https://cloud.ibm.com/docs/metrics-router?topic=metrics-router-iam-service-auth).





 IAM permissions 

The following table lists the IAM actions, their scope and the roles required to manage routes.



Table 2. IAM action scopes and roles for managing targets

 Task IAM Action IAM Policy scope IAM Roles 

 Create a target metrics-router.target.create Region Administrator <br>Editor 
 List all targets metrics-router.target.list Account Administrator <br>Editor <br>Operator <br>Viewer 
 Get details of a target metrics-router.target.read Region Administrator <br>Editor <br>Operator <br>Viewer 
 Modify a target metrics-router.target.update Region Administrator <br>Editor 
 Delete a target metrics-router.target.delete Region Administrator <br>Editor 



When you use the CLI, notice that you need the metrics-router.target.list role to create, read, update, or delete a target.





 Auditing events 

The following table lists the IAM actions, their scope and the roles required to manage routes.



Table 3. Activity Tracker auditing event action

 Task Activity Tracker auditing event action 

 Create a target metrics-router.target.create 
 List all targets metrics-router.target.list 
 Get details of a target metrics-router.target.read 
 Modify a target metrics-router.target.update 
 Delete a target metrics-router.target.delete 







 CLI prerequisites
You can see which access policies are set for you in the [IBM Cloud® Identity and Access Management (IAM)](https://cloud.ibm.com/iam/overview) console. Be sure to check [access policies](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources) that apply for your user, and any access policies that are assigned to any [access groups](https://cloud.ibm.com/docs/account?topic=account-groups) that include your user.

To view IAM information about your user access,



1. Go to [Access IAM users](https://cloud.ibm.com/iam/users).
2. Click your name in the user table.
3. Click the Access policies tab to see your access policies.



To view IAM information about access groups for your user,



1. Go to [Access IAM groups](https://cloud.ibm.com/iam/groups).
2. Click the name of an access group to view information about the group.
3. Click the Access tab to see your access policies assigned to the group.







 Managing access by using access groups 

To manage access or assign new access for users by using access groups, you must be the account owner, administrator, or editor on all Identity and Access enabled services in the account, or the assigned Administrator or Editor for the IAM Access Groups Service.

Choose any of the following actions to manage access groups in the IBM Cloud:



* [Creating an access group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag).
* [Assigning access to a group](https://cloud.ibm.com/docs/account?topic=account-groupsaccess_ag).



For more information about IAM commands, see the [IAM CLI reference docs](https://cloud.ibm.com/docs/account?topic=cli-ibmcloud_commands_iam).





 Managing access by assigning policies directly to users
An account administrator can grant specific users access to Cloud Shell and its features, such as File upload and download and Web preview, even if Cloud Shell settings are disabled at the account level.

The IAM policy can be applied to specific locations with different roles. The roles are used to control the access of specific Cloud Shell features.

The IAM policy takes priority and is active only if the Cloud Shell account setting is disabled. If the Cloud Shell account setting is enabled and the IAM policy is set, the IAM policy has no effect. In that scenario, all users in account can access Cloud Shell.

To assign Cloud Shell access to a particular user, complete the following steps:



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Users.
2. On the Users page, select the user that you want to assign the role to.
3. On the individual user's page, click the Access polcies tab, and then click Assign access.
4. For the service, select IBM Cloud Shell. Then, click Next.
5. Scope the access to Specific resources. Select a location to enable the features in. Then, click Next.
6. Select one or more roles to assign to the user. For example, if you want to enable the File Upload and File Download features for the user, select the File Manager role. For more information, see [IAM roles](https://cloud.ibm.com/docs/account?topic=account-userrolesiamusermanrol).
7. Click Review.
8. Click Add to add your policy configuration to your policy summary.
9. Click Assign.



When the user logs in to their IBM Cloud account, the user now has access to Cloud Shell and the file management features within Cloud Shell.
Managing service access 

With Event Notifications and IBM Cloud® Identity and Access Management, IBM Cloud Identity and Access Management (IAM) account owners can manage user access in your account.

As an account owner, you can set policies within your account to create different levels of access for different users. For example, certain users can have Read only access to one instance, but Write access to another. You can decide who is allowed to create, update, and delete instances of Event Notifications.

Event Notifications service has adopted IAM so App secret is not generated for new instances. Instead, you must use the [API keys instead](https://cloud.ibm.com/docs/account?topic=account-manapikey).



 User roles 

The scope of an access policy is based on a user's assigned role.

Policies enable access to be granted at different levels. Some of the options are as follows:



* Access across all instances of the service in your account
* Access to an individual service instances in your account
* Access to a specific resource within an instance
* Access to all IAM-enabled services in your account



Platform management roles enable users to perform tasks on service resources at the platform level. For example, roles can be assigned to determine who can create or delete IDs, create instances, and bind instances to apps. The following table classifies actions as they are assigned to platform management roles.



Table 1. Platform management roles and permissions

 Platform role Permissions Example actions 

 Viewer View Event Notifications instances. You can see a Cloud Directory user's data or the identity provider configuration. 
 Editor View and bind Event Notifications instances. You can bind applications to an instance of Event Notifications. 
 Operator Create, delete, edit, suspend, resume, view, or bind Event Notifications instances. You can create or delete an Event Notifications instance from the catalog. 
 Administrator All management actions for all services in the account. You can perform all operator actions and the ability to assign policies to other users. 



The following table details actions that are mapped to service access roles. Service access roles enable users to access Event Notifications and also call the Event Notifications API.



Table 2.
metrics-router.route.read Account Administrator <br>Editor <br>Viewer <br>Operator 
 metrics-router.route.create Account Administrator <br>Editor 
 metrics-router.route.update Account Administrator <br>Editor 
 metrics-router.route.delete Account Administrator <br>Editor 
 metrics-router.route.list Account Administrator <br>Editor <br>Viewer <br>Operator 







 Settings 

The following table lists the IAM actions, their scope and the roles required to manage settings.



Table 7. IAM action scopes and roles for managing settings

 Action IAM Policy scope IAM roles 

 metrics_router.setting.get Accoount Administrator <br>Editor <br>Operator <br>Viewer 
 metrics_router.setting.update Account Administrator 









 Assigning access to IBM Cloud Metrics Routing 

You can assign access to IBM Cloud Metrics Routing by using any of the following methods:



* Access policies per user
* Access groups

Access groups are used to streamline access management by assigning access to a group once, then you can add or remove users as needed from the group to control their access.

An access group can be created to organize a set of users, service IDs, and trusted profiles into a single entity that makes it easy for you to assign access. You can assign a single policy to the group instead of assigning the same access multiple times for an individual user or service ID.For more information, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).

To organize a set of users and service IDs into a single entity that makes it easy for you to manage IAM permissions, use access groups. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID.
* Trusted profiles

You can use trusted profiles to grant different IBM Cloud® identities access to resources in your account. Automatically grant federated users access to your account with conditions based on SAML attributes from your corporate directory. Or, use trusted profiles to set up fine-grained authorization for applications that are running in compute resources.
How do I know which IAM access policies are set for me? 

You can check which access policies are set for you in the [IBM Cloud UI](https://cloud.ibm.com/) console.



1.  Go to [Access IAM users](https://cloud.ibm.com/iam/users).
2.  Click your name in the user table.
3.  Click the Access policies tab to see your access policies.
4.  Click the Access groups tab to see the access groups where you are a member. Check the policies for each group.
If you are not the credentials owner, but you are assigned the Editor or Administrator IBM Cloud IAM platform access role for the [User Management service](https://cloud.ibm.com/docs/account?topic=account-account-services), you can update the restricted IP addresses for the credentials owner.



1. Identify what user credentials are used for the cluster's region and resource group infrastructure permissions.



1. Check the API key for a region and resource group of the cluster.

ibmcloud ks api-key info --cluster <cluster_name_or_ID>

Example output

Getting information about the API key owner for cluster <cluster_name>...
OK
Name Email
<user_name> <name@email.com>
2. Check if the infrastructure account for the region and resource group is manually set to use a different IBM Cloud infrastructure account.

ibmcloud ks credential get --region <us-south>

Example output if credentials are set to use a different account. In this case, the user's infrastructure credentials are used for the region and resource group that you targeted, even if a different user's credentials are stored in the API key that you retrieved in the previous step.

OK
Infrastructure credentials for user name <1234567_name@email.com> set for resource group <resource_group_name>.

Example output if credentials are not set to use a different account. In this case, the API key owner that you retrieved in the previous step has the infrastructure credentials that are used for the region and resource group.

FAILED
No credentials set for resource group <resource_group_name>.: The user credentials could not be found. (E0051)



2. Get the Worker Zones and VPCs that your cluster is created in.

ibmcloud ks cluster get -c <cluster>

Example output

...
Worker Zones: us-south-1, us-south-2, us-south-3
Ingress Subdomain: vpc-prod.us-south.containers.appdomain.cloud
Ingress Secret: vpc-prod
Creator: -
Granting permissions to work with the Monitoring service 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and consistently control access to all cloud resources in the IBM Cloud.

Complete the following steps to grant a user or service ID permissions to work with the IBM Cloud Monitoring service:



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Monitoring service. The account owner can grant user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an access group 

Complete the following steps to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.



You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]





 Step 2. Add permissions to view Monitoring instances in the Observability UI 

After you set up your group, you can assign a common access policy to the group. You must add permissions to view Monitoring instances in the Observability UI, to manage the instance in the IBM Cloud, or both.

Any policy that you set for an access group applies to all entities, users, and service IDs, within the group.

You can assign the policy by using the UI or through the command line.

When you define the policy, you need to select a platform role.