vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing IAM access for Secrets Manager 

Access to IBM Cloud® Secrets Manager service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the Secrets Manager service in your account must be assigned an access policy with an IAM role. The policy determines which actions a user can perform within the context of Secrets Manager.

IAM access policies enable access to be granted at different levels. Some of the options include the following actions:



* Access across all Secrets Manager service instances in your account
* Access to an individual Secrets Manager instance in your account
* Access to a specific resource within a Secrets Manager instance, such resource type secret-group





 IAM roles and actions for Secrets Manager 

Review the following [platform and service roles](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles) that you can use to assign access to Secrets Manager service instances. Each role maps to specific Secrets Manager actions that a user can complete within an account or an individual instance.

If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

Platform roles

Service roles

Actions



Table 1. Platform roles - Secrets Manager
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Viewer As a viewer, you can view Secrets Manager service instances, but you can't modify them. 
 Operator As an operator, you can complete platform actions that are required to configure and operate Secrets Manager service instances, such as the ability to view a Secrets Manager dashboard. 
 Editor As an editor, you can create, modify, and delete Secrets Manager service instances, but you can't assign access policies to other users. 
 Administrator As an administrator, you can complete all platform actions for Secrets Manager, including the ability to assign access policies to other users.
You need the [Reader service role](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) to list secrets.





 Command options 

-format
: Prints the output in the format that you specify. Valid formats are table, json, and yaml. The default is table. You can also set the output format by using the VAULT_FORMAT environment variable.





 Examples 

Retrieve a list of available user credential secrets in the default secret group.

vault read -format=json ibmcloud/username_password/secrets

Retrieve a list of arbitrary secrets that are assigned to a specified secret group.

vault read -format=json ibmcloud/arbitrary/secrets/groups/9ab2250f-a369-4e07-ade7-d417d63ad587





 Output 

The command returns the following output:

{
"request_id": "65689e3a-7cc6-990e-4f0e-8480edd244ed",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"secrets": [
{
"created_by": "iam-ServiceId-b7ebcf90-c7a9-495b-8ce8-bbf33cb95ca0",
"creation_date": "2020-10-06T05:31:05Z",
"crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/791f5fb10986423e97aa8512f18b7e65:e415e570-f073-423a-abdc-55de9b58f54e:secret:1cf95413-4c10-a5fa-e824-b5106375b129",
"expiration_date": "2020-12-31T23:59:59Z",
* [CVE-2020-24332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24332)
* [CVE-2020-24977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
* [CVE-2020-28196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196)
* [CVE-2020-29361](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29361)
* [CVE-2020-29362](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29362)
* [CVE-2020-29363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29363)
* [CVE-2020-8231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231)
* [CVE-2020-8284](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284)
* [CVE-2020-8285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285)
* Use IAM to add a service-to-service authorization policy from the toolchain to the Secrets Manager service instance. In the authorization policy, the toolchain is the source service, and the Secrets Manager instance is the target service. Make sure that the policy grants the Viewer and SecretsReader roles.



For more information about service-to-service authorization policies, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth).

For an example of how to configure a service-to-service authorization policy from a toolchain to a secret store service instance with Terraform, see [Specifying secret references with Terraform](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_security&interface=terraformcd_secrets_references_terraform).





 When I use Terraform or the API to configure a Key Protect, Secrets Manager, or App Configuration tool integration, why does the configuration fail? 

The tool integration refers to a Key Protect, Secrets Manager, or App Configuration service instance that does not exist.

 What’s happening 

When you use Terraform or the API to create or update a Key Protect, Secrets Manager, or App Configuration tool integration, the configuration fails with the There was a problem with the provided service parameters, please check that they are valid error message.

 Why it’s happening 

The tool integration is configured with the name or ID of a Key Protect, Secrets Manager, or App Configuration service instance that cannot be found or accessed. If you are using Terraform to manage both the service instance and the tool integration, Terraform might attempt to create, or update the tool integration before it creates the service instance.

 How to fix it
* [CVE-2020-8284](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284)
* [CVE-2020-8285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285)
* [CVE-2020-8286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8286)
* [CVE-2020-8927](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8927)
* [CVE-2020-9948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9948)
* [CVE-2020-9951](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9951)
* [CVE-2020-9983](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9983)
* [CVE-2021-3326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326)
* [RHSA-2021:1581](https://access.redhat.com/errata/RHSA-2021:1581)
* [RHSA-2021:1585](https://access.redhat.com/errata/RHSA-2021:1585)
* [RHSA-2021:1586](https://access.redhat.com/errata/RHSA-2021:1586)
If you see HTTP 4XX errors in the logs, make sure that the API key in your action code has the correct level of access. For JWT signature errors, verify that the Event Notifications destination ID in the action code corresponds with your Cloud Functions webhook.







 Next steps 

Great job! In part 2 of this tutorial series, you learned how to set up a Cloud Functions action that takes your incoming notification content and uses it to open an issue in your GitHub repository. From now on, a GitHub issue is created each time that a certificate in your Secrets Manager service instance expires or is about to expire. In part 3, you create another Functions action that sends your notifications to Slack.



* [Part 3: Send your notifications to a Slack channel](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-3)
"name" : "lock-example-1",
"secret_group_id" : "d8371728-95c8-4c12-b2af-1af98adb9e41",
"secret_id" : "0cf4addb-7a90-410b-a3a7-a15bbe2b7909",
"secret_version_alias" : "current",
"secret_version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"updated_at" : "2022-10-05T21:33:11Z"
} ],
"next" : {
"href" : "https://us-south.secrets-maanger.cloud.ibm.com/88b75b20-aa21-4174-85c9-1feb3cc93c9a/api/v2/secrets/0cf4addb-7a90-410b-a3a7-a15bbe2b7909/versions/7bf3814d-58f8-4df8-9cbd-f6860e4ca973/locks?offset=150&limit=50"
},
"offset" : 100,
"total_count" : 1
}







 ibmcloud secrets-manager secret-version-locks-bulk-create 

Create a lock on the specified version of a secret.

A lock can be used to prevent a secret from being deleted or modified while it's in use by your applications. A successful request attaches a new lock to your secret, or replaces a lock of the same name if it already exists. Additionally, you can use this operation to clear any matching locks on a secret by using one of the following optional lock modes:



* remove_previous: Removes any other locks with matching names if they are found in the previous version of the secret.
* [CVE-2018-14882](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14882)
* [CVE-2018-19519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19519)
* [CVE-2018-14467](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14467)
* [CVE-2018-16451](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16451)
* [CVE-2018-14464](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14464)
* [CVE-2018-14463](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14463)
* [CVE-2018-14468](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14468)
* [CVE-2018-14879](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14879)
* [CVE-2018-14462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14462)
* [CVE-2018-14881](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14881)
If the targeting is configured, then entityAttributes should be provided for the rule evaluation. An attribute is a parameter that is used to define a segment. The SDK uses the attribute values to determine whether the specified entity satisfies the targeting rules, and returns the appropriate property value.







 Get secret property 

Explicit method for getting the secret references stored in App Configuration.

const secretPropertyObject = appConfigClient.getSecret(propertyId, secretsManagerObject);

Where,



* propertyID: propertyID is the unique string identifier, by using this you are able to fetch the property that will provide the necessary data to fetch the secret.
* secretsManagerObject: secretsManagerObject is a Secrets Manager client object that is used for getting the secrets during the secret property evaluation. For more information on how to create a Secrets Manager client object, see [here](https://cloud.ibm.com/apidocs/secrets-manager?code=node).







 Evaluate a secret property 

Use the secretPropertyObject.getCurrentValue(entityId, entityAttributes) method to evaluate the value of the secret property. The output of this method call is different from getCurrentValue started by using feature and property objects. This method returns a Promise that either resolves with the response from the Secrets Manager or rejects with an Error. The resolved value is the actual secret value of the evaluated secret reference. The response contains the body, the headers, the status code, and the status text. If using async or await, use try or catch for handling errors.

const entityId = 'john_doe';
const entityAttributes = {
city: 'Bangalore',
country: 'India',
};
try {
const res = await secretPropertyObject.getCurrentValue(entityId, entityAttributes);
console.log(JSON.stringify(res, null, 2)); // view entire response.
Consider the following service limits as you use Secrets Manager.



 Account limits 

The following limits apply per IBM Cloud account.



Table 1. Secrets Manager limits per account

 Resource Limit 

 Secrets Manager service instances Trial plan: 1 per IBM Cloud account at any time <br>Standard plan: No limit on number of instances per account 







 Instance limits 

The following limits apply to Secrets Manager service instances.



Table 2. Secrets Manager limits per instance

 Resource Limit 

 Configurations for secrets engines Public certificates engine:<br><br><br><br> * 10 third-party CA configurations<br> * 10 DNS provider configurations<br> * 10 certificate templates<br><br><br><br>Private certificates engine:<br><br><br><br> * 10 root certificate authorities<br> * 10 intermediate certificate authorities<br> * 10 certificate templates<br><br><br> 
 Secret groups 200 per instance 
 Total secrets No limit per instance 







 Resource limits 

Review the following table to understand the limits that apply to secrets of different types.



 Limits for secret groups 

The following limits apply to secret groups.



Table 4. Secret group limits

 Attribute Limit 

 Name 2 - 64 characters 
 Description 2 - 1024 characters 
 Labels 2 - 30 characters<br><br>30 labels per secret group 
 Total secrets – 







 Limits for arbitrary secrets 

The following limits apply to arbitrary secrets.



Table 5. Arbitrary secret limits

 Attribute Limit 

 Name 2 - 256 characters<br><br>The name of the secret can contain only alphanumeric characters, dashes, and dots. It must start and end with an alphanumeric character. 
 Description 2 - 1024 characters 
 Secret value / payload 1 MB 
 Labels 2 - 30 characters<br><br>30 labels per secret 
 Versions For auditing purposes, the service retains the metadata of up to 50 versions for each secret, which you can review as part of a secret's [version history](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-version-history). 
 Locks 1000 
 Custom metadata 10 KB 
 Version custom metadata 10 KB
An SSH secret is also used as a Git repository access secret. As a result, the --source that you specify must use the SSH protocol, such as git@github.com:myprivaterepo/builds.git. The value for --source must not use the http or https format.
* Because the branch name of the repository is not specified with the --commit option, Code Engine automatically uses the default branch of the specified repository.
* Code Engine automatically determines whether your source resides in a repo or on a local workstation, based on the value of the --source option.



The following table summarizes the options that are used with the buildrun submit command in this example. For more information about the command and its options, see the [ibmcloud ce buildrun submit](https://cloud.ibm.com/docs/codeengine?topic=codeengine-clicli-buildrun-submit) command.



Table 4. Command description

 Option Description 

 --name The name of the build run. Use a name that is unique within the project. This value is required.<br><br><br><br> * The name must begin and end with a lowercase letter.<br> * The name must be 63 characters or fewer and can contain lowercase alphanumeric characters and hyphens (-).<br><br><br> 
 --image The location of the image registry. The format of the location must be REGISTRY/NAMESPACE/REPOSITORY or REGISTRY/NAMESPACE/REPOSITORY:TAG where TAG is optional. If TAG is not specified, the default is latest. 
 --registry-secret The registry secret that is used to access the registry when you create the container image. Run the secret create --format registry command to create a registry secret. The registry secret is used to authenticate with a private registry. 
 --source The URL of the Git repository or the path to the local source that contains your source code; for example, git@github.com:myprivaterepo/builds.git.
[The image shows the Event Notifications screen in the Secrets Manager UI.](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/event-notifications-connected.svg)

Figure 2. Sending a test event to Event Notifications



1. In the IBM Cloud console, go to your Secrets Manager instance.
2. Go to Settings > Event Notifications, and click Send test event.
3. Check the GitHub repository that you defined in the Functions action to verify the results.

If the Functions action completed successfully, you see a GitHub issue created that is similar to the following example:

Test issue

This is a test notification from SecretsManager.

If you have an existing certificate in your Secrets Manager instance that expires soon, a GitHub issue is created similar to the following example:

Test issue

The following certificate(s) expire on Thu Mar 10 2022:

Domain(s): example.com
Secret ID: 538f7d7e-bef8-2b9a-704f-f4a897219df6
Secret name: example-certificate
4. Optional. Check your Cloud Functions activations logs if you encounter issues.

From the [Cloud Functions activations dashboard](https://cloud.ibm.com/functions/dashboard), you can check to see your activated action. Notification successfully forwarded to Slack! is displayed in the response details if the code runs successfully.

If you see HTTP 4XX errors in the logs, make sure that the API key in your action code has the correct level of access. For JWT signature errors, verify that the Event Notifications destination ID in the action code corresponds with your Cloud Functions webhook.







 Next steps 

Great job! In part 2 of this tutorial series, you learned how to set up a Cloud Functions action that takes your incoming notification content and uses it to open an issue in your GitHub repository.
: You can now configure Secrets Manager to securely manage secrets that are part of your Continuous Delivery toolchain.

For more information, check out the [announcement blog](https://www.ibm.com/cloud/blog/manage-secrets-in-continuous-delivery-with-ibm-cloud-secrets-manager).





 22 March 2021 

Manage secrets over a private network connection
: You can now create a private instance of Secrets Manager so that you can manage application secrets over a private network connection.

For more information, see [Securing your connection to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection).

Reuse API keys for IAM credential secrets
: By default, IAM credential secrets are generated and deleted each time that the secret is read or accessed. By using the reuse_api_key parameter in the API, or the Reuse IAM credentials option in the UI, you can control whether the associated service ID API key can be reused until the secret expires.

For more information, see [Creating IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentialsiam-credentials-ui).

Analyze Secrets Manager logs with IBM Log Analysis
: Secrets Manager is now integrated Log Analysis so that you can diagnose issues and analyze logs that are generated by your Secrets Manager service instance.

For more information, see [Viewing logs for Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-logs).

London, Tokyo, and Washington DC availability
: Secrets Manager is now available in the London (eu-gb), Tokyo (jp-tok), and Washington DC (us-east) regions.

For more information, see [Regions and endpoints](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-endpoints).





 15 February 2021 

Now available: Secrets Manager Java SDK
: You can now use the IBM Cloud Secrets Manager Java SDK to connect to your Secrets Manager service instance.
* [CVE-2022-42915](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42915)
* [CVE-2022-42916](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42916)
* [CVE-2021-43618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43618)
* [CVE-2018-16860](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16860)
* [CVE-2019-12098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12098)
* [CVE-2021-3671](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671)
* [CVE-2022-3116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3116)
* [CVE-2022-35737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35737)
* [CVE-2022-41916](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41916)
* [CVE-2013-4235](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235)
Creating and running your Function when using secrets and configmaps 

In Code Engine, secrets and configmaps can be consumed by your Function by using environment variables.

Both secrets and configmaps are key-value pairs. When mapped to environment variables, the NAME=VALUE relationships are set such that the name of the environment variable corresponds to the "key" of each entry in those maps, and the value of the environment variable is the "value" of that key.

Your Function can use environment variables to fully reference a configmap (or secret) or reference individual keys in a configmap (or secret).

For more information, see [referencing secrets by using environment variables](https://cloud.ibm.com/docs/codeengine?topic=codeengine-secretsecret-ref) and [referencing configmaps by using environment variables](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configmapconfigmap-ref).







 Considerations for Functions quotas 

When you work with applications, functions, and batch jobs, these resources run within the context of a Code Engine project. Resource quotas are defined on a per project basis, and limits apply for applications, functions, and batch jobs.

For more information about Code Engine limits, see [Limits and quotas for Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-limits).
* [CVE-2021-33930](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33930)
* [CVE-2021-33938](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33938)
* [CVE-2021-3200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3200)
* [CVE-2021-3445](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3445)
* [CVE-2021-22946](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22946)
* [CVE-2021-22947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22947)
* [CVE-2021-22876](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22876)
* [CVE-2021-22898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22898)
* [CVE-2021-22925](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22925)
* [CVE-2018-20673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673)
--H "Authorization: Bearer {iam_token}" --H "Accept: application/json" --H "Content-Type: application/json" --d '{
"restore_from_version": "previous",
"custom_metadata": {
"metadata_custom_key": "metadata_custom_value"
},
"version_custom_metadata": {
"custom_version_key": "custom_version_value"
}
}' 
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/secrets/{id}/versions"

Currently, you can restore only one version back for IAM credentials and public certificate secrets. A secret version can be restored only if the defined time-to-live (TTL) or lease duration was not reached.

A successful response returns the value of the secret, along with other metadata. For more information about the required and optional request parameters, see the [API reference](https://cloud.ibm.com/apidocs/secrets-manager).