vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* UI
* CLI
* API
* Terraform







 Storing key-value secrets 

You can use IBM Cloud® Secrets Manager to store and manage key-value secrets, including complex JSON documents, that are used to access protected systems that are inside or outside of IBM Cloud.

A key-value secret is a type of application secret that can be used to hold sensitive data that is structured as a JSON object. After you create the secret, you can use it to connect your application to a protected resource, such as a database or a third-party app. Your secret is stored securely in your dedicated Secrets Manager service instance, where you can centrally manage its lifecycle.

You can store multiple versions per key and access the history and metadata of your key-value secret with Secrets Manager. For more information, see [Managing key-value secrets with Vault](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv).

To learn more about the types of secrets that you can manage in Secrets Manager, see [What is a secret?](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secret)



 Before you begin 

Before you get started, be sure that you have the required level of access. To create or add secrets, you need the [Writer service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).





 Creating key-value secrets in the UI 

To add a key-value secret by using the Secrets Manager UI, complete the following steps.



1. In the IBM Cloud console, click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, click Add.
4.
Depending on the type of secret, automatic rotation takes place immediately on the date and time that you set, or it might need to complete a few extra steps before a new version of the secret can be created.



Table 1. Describes how Secrets Manager evaluates manual rotation by secret type

 Type Rotation description 

 [Private certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificatescreate-certificates) The existing certificate value is replaced with new certificate content. The time-to-live (TTL) of the renewed certificate is set according to the [certificate template](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificatescreate-certificates) that was selected when the certificate was first created.<br><br>After the time-to-live (TTL) or validity period of a private certificate exceeds the validity period of its issuing certificate authority, the certificate can no longer be rotated automatically. 
 [Public certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificatesorder-certificates) Public certificates move to the Active, Rotation pending status to indicate that the request to renew the certificate is being processed. Secrets Manager uses DNS validation to verify that you own the domains that are listed as part of the certificate. This process can take a few minutes to complete. If the validation completes successfully, a new certificate is issued and its status changes back to Active. If the validation doesn't complete successfully, the status of the certificate changes to Active, Rotation failed. 
 [User credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-user-credentials) The existing password value is replaced with a randomly generated 32-character password that contains uppercase letters, lowercase letters, digits, and symbols. The username value does not change. 
 [IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials) The Service ID's API key value is replaced with a new API key. The previous API key remains available for the remaining time in the defined TTL. 









 Scheduling automatic rotation in the UI
For example, the Implicit flow uses redirect URIs to obtain tokens, which the Authorization + PKCE flow circumvents by using an XHR request instead. Because of the security flaws, the Implicit flow is no longer recommended or considered safe due to the following reasons:



* The Implicit flow returns tokens as part of the URL - as a query parameter or in the hash fragment. By doing so, the tokens can be intercepted and tokens can be accessed. The tokens might be saved in a user's browser history or logs. The history or logs might be stored in a cloud service and sent to multiple devices, which also heightens the risk.
* The Implicit flow is susceptible to a [redirect URI attack](https://datatracker.ietf.org/doc/html/rfc6749), which means that an attacker might replace an approved redirect URI with a destination of their choice. If there is a redirect URI attack, users follow the changed link to authorize their client. After authorization, they are redirected to the attackers URI, which gives the attacker access to the user's legitimate tokens.



The previous examples are just a few of the important issues. For more information, see [OAuth 2.0 security best current practice](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-13.).







 Before you begin 

Before you get started, be sure that you have the following prerequisites.



* An instance of the App ID service.
* Your [redirect URIs](https://cloud.ibm.com/docs/appid?topic=appid-managing-idpadd-redirect-uri) set in the App ID service dashboard.
* A single-page application. If you don't have one and you want to try out the flow, try downloading the sample application from the overview page of the App ID dashboard.







 Creating application credentials with the GUI 

Your credentials are used to connect your application to App ID. To create your credentials, register your app with App ID.
FAQs for Secrets Manager 

FAQs for IBM Cloud® Secrets Manager might include questions about secrets or credentials. To find all FAQs for IBM Cloud, see the [FAQ library](https://cloud.ibm.com/docs/faqs).



 What is a secret? 

A secret is a piece of sensitive information. For example, a secret might be a username and password combination or an API key that you use while you develop your applications. To keep your applications secure, it is important to regulate which secrets can access what and who has access to them.

In addition to the static secrets described, there are other types of secrets that you might work with in the Secrets Manager service. To learn more about secret types, check out [Types of secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secretsecret-types).





 What is a secret group? 

A secret group is a means to organize and control access to the secrets that you store within Secrets Manager. There are several different strategies that you might use to approach secret groups. For more information and recommendations, see [Best practices for organizing secrets and assigning access](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-best-practices-organize-secrets).





 What is an IAM credential? 

An IAM credential is a type of dynamic secret that you can use to access an IBM Cloud resource that requires IAM authentication. When you create an IAM credential through Secrets Manager, the service creates a service ID and an API key on your behalf. For more information about creating and storing IAM credentials, see [Creating IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials).





 What happens when I rotate my secret? 

When a secret is rotated, a new version of its value becomes available for use. You can choose to manually add a value or automatically generate one at regular intervals by enabling automatic rotation.
3000638 - Check whether Toolchain service access is managed only by IAM access groups
3000621 - Check whether Secrets Manager has no more than users with the IAM administrator role
3000630 - Check whether Secrets Manager has no more than service IDs with the IAM administrator role
3000631 - Check whether Secrets Manager has at least users with the IAM manager role
3000632 - Check whether Secrets Manager has at least service IDs with the IAM manager role
3000637 - Check whether Secrets Manager service access is managed only by IAM access groups
3000706 - Check whether App ID user data is encrypted
3000305 - Check whether Event Streams is accessible through public endpoints
3000306 - Check whether Event Streams is accessible only by using private endpoints
3000307 - Check whether Event Streams network access is restricted to a specific IP range
3000703 - Check whether App ID redirect URIs are using HTTPS only
3000704 - Check whether App ID redirect URIs are not using localhost or 127.0.0.1
3000705 - Check whether App ID redirect URIs are not using wildcards ()
3000708 - Check whether App ID Cloud Directory users aren't able to update their own accounts
3000709 - Check whether App ID Cloud Directory users aren't able to update their own accounts
3000712 - Check whether App ID anonymous authentication is disabled
3000713 - Check whether App ID anonymous authentication is disabled
3000714 - Check whether App ID advanced password policies are enabled
3000715 - Check whether App ID avoid password reuse policy is enabled
3000718 - Check whether App ID avoid password reuse policy is enabled
3000719 - Check whether App ID password expiration policy is enabled
3000720 - Check whether App ID prevent username in password policy is enabled
3000723 - Check whether App ID multifactor authentication (MFA) is enabled for Cloud Directory users
3000724 - Check whether App ID access tokens are configured to expire within minutes
3000802 - Check whether Kubernetes Service is accessible only by using private endpoints
3000804 - Check whether Kubernetes Service clusters are enabled with IBM Cloud Monitoring
Projects also leverage Schematics workspaces to store the Terraform state for each configuration and to run the automation. These workspaces are in the region and resource group that you specify when you create the project. The Schematics workspace is also tagged with the project name, making it easier to identify that workspace among other ones.

Don't delete or directly modify these workspaces. This can cause projects to lose track of the configuration state that can lead to creation of duplicate resources and other issues. To prevent users from modifying workspaces, administrators on the Projects service should not grant users access to the Schematics service.





 Trusted profiles 

Trusted profiles authorize cross-account access for applications. Because trusted profiles can generate temporary service ID API keys that exist only during the lifecycle of the operation, projects use them as the secure and compliant way to authorize a configuration to deploy. Unlike other authentication methods, trusted profiles don't require key rotation. [Create a trusted profile](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-projectcreate-projects-tp) that can manage API keys for the service ID in your account, which deploys deployable architecture.





 Secrets Manager 

With Secrets Manager, you can create and centrally manage secrets that are used in IBM Cloud deployable architectures. Secrets are an easy and compliant way to store sensitive information, like API keys, SSH keys, database credentials, and more. Create a [Secrets Manager service instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui) in your project home account that you can use for all projects within that account.

Secrets Manager can also be used to store API keys that are used to authorize a project to deploy resources into an account, although there are other options too. For more information, see [Using an API key or secret to authorize a project to deploy an architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-authorize-project).





 Project costs 

While there is no charge for a project, there can be costs for any resources created by a deployable architecture.
"last_update_date": "2020-12-15T22:41:14Z",
"name": "another-arbitrary-secret-in-group",
"secret_group_id": "339c026a-ac0f-1ea1-3d43-99adf871b49a",
"secret_type": "arbitrary",
"state": 1,
"state_description": "Active"
}
],
"secrets_total": 2
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Get secret metadata 

Retrieve the metadata of a secret, such as its name, description. To retrieve the actual value of a secret, use [Get a secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-apivault-get-secret).



 Example requests 

Get metadata for an arbitrary secret.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/{secret_id}/metadata" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Get metadata for an arbitrary secret in an existing secret group.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/secrets/groups/{group_id}/{secret_id}/metadata" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Get metadata for a kv secret. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-manage-kv).

curl -X GET 'https://{instance_id}.
* [CVE-2021-22898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22898)
* [CVE-2021-22925](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22925)
* [CVE-2018-20673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673)
* [CVE-2021-36084](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36084)
* [CVE-2021-36085](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36085)
* [CVE-2021-36086](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36086)
* [CVE-2021-36087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36087)
* [CVE-2021-33560](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33560)
* [CVE-2019-13750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13750)
* [CVE-2019-13751](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13751)
* [CVE-2020-27618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27618)
* [CVE-2020-29562](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29562)
* [CVE-2020-6096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6096)
* [CVE-2021-27645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27645)
* [CVE-2021-3326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326)
* [CVE-2021-35942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942)
* [CVE-2021-3998](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3998)
* [CVE-2021-3999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3999)
* [CVE-2022-23218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23218)
* [CVE-2022-23219](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23219)
External Secrets is also available as an OpenShift operator.

Secrets Manager



* 45 minutes
* 2023-06-15



[Part 2: Create a GitHub issue when your certificates are about to expire](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-2)Part 2: Create a GitHub issue when your certificates are about to expire

This tutorial is part 2 of a 3-part tutorial series that guides you through setting up alerts for your expiring secrets.

Secrets Manager



* 15 minutes
* 2023-03-01



[Part 1: Enable notifications for Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-1)Part 1: Enable notifications for Secrets Manager

This tutorial is part 1 of a 3-part tutorial series that guides you through setting up alerts for your expiring secrets.

Secrets Manager



* 10 minutes
* 2023-03-01



[Part 3: Send your notifications to a Slack channel](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-tutorial-expiring-secrets-part-3)Part 3: Send your notifications to a Slack channel

This tutorial is part 3 of a 3-part tutorial series that guides you through setting up alerts for your expiring secrets.

Secrets Manager



* 15 minutes
* 2023-03-01



[Scalable web application on Kubernetes](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-scalable-webapp-kubernetes)Scalable web application on Kubernetes

This tutorial walks you through how to run a web application locally in a container, and then deploy it to a Kubernetes cluster created with Kubernetes Service. As an optional step you can build a container image and push the image to a private registry.
For more information about the command options, see [ibmcloud secrets-manager secret-version-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-version-create-command).





 Rotating user credentials 

To rotate a user credential secret by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-version-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-version-create-command) command. For example, the following command rotates a secret and assigns new-password as its new version.

ibmcloud secrets-manager secret-version-create 
--secret-id=SECRET_ID 
--secret-version-prototype='{"password": "new-password", "custom_metadata": {"anyKey": "anyValue"}, "version_custom_metadata": {"anyKey": "anyValue"}}'

To have the service generate and assign a random password to your credential, you can pass an empty string on the password field. For example, { "password": ""}. Secrets Manager replaces the existing value with a randomly generated 32-character password that contains uppercase letters, lowercase letters, digits, and symbols.

The command outputs the value of the secret, along with other metadata. For more information about the command options, see [ibmcloud secrets-manager secret-version-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-version-create-command).





 Rotating imported certificates
* [CVE-2020-13434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434)
* [CVE-2020-13435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13435)
* [CVE-2020-13630](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13630)
* [CVE-2020-13631](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13631)
* [CVE-2020-13632,](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13632,)
* [CVE-2020-3810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3810)
* [usn-4357-1](https://ubuntu.com/security/notices/USN-4357-1/)
* [usn-4359-1](https://ubuntu.com/security/notices/USN-4359-1/)
* [usn-4376-1](https://ubuntu.com/security/notices/USN-4376-1/)
* [usn-4377-1](https://ubuntu.com/security/notices/USN-4377-1/)
* [usn-4394-1](https://ubuntu.com/security/notices/USN-4394-1/)
}'

Rotate a username_password secret in the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/username_password/secrets/{secret_id}/rotate" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -d '{
"password": "new-password"
}'

Rotate an imported_cert secret in the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/imported_cert/secrets/{secret_id}/rotate" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -d '{
"certificate": "new-certificate",
"private_key": "new-private-key",
"intermediate": "new-intermediate-certificate"
}'





 Example responses 

A request to rotate a kv secret in the default secret group returns the following response:

{
"request_id": "e00000b-0000-0ad1-beb0-00000d0000",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"created_by": "iam-ServiceId-9ca2000007-f0000d-400000e-8b02-ed6b000000",
"creation_date": "2022-01-25T19:22:04Z",
* [CVE-2016-10228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228)
* [CVE-2019-13012](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13012)
* [CVE-2019-18276](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276)
* [CVE-2019-25013](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25013)
* [CVE-2019-2708](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2708)
* [CVE-2019-3842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3842)
* [CVE-2019-9169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169)
* [CVE-2020-13434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13434)
* [CVE-2020-13543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13543)
* [CVE-2020-13584](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13584)
--groups ([]string)
: Filter secrets by groups.

You can apply multiple filters by using a comma-separated list of secret group IDs. If you need to filter secrets that are in the default secret group, use the default keyword.

Usage: To retrieve a list of secrets that are associated with an existing secret group or the default group, use ..?groups={secret_group_ID},default.

The list items must match regular expression /^([0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}|default)$/.





 Examples 

ibmcloud secrets-manager all-locks --limit=1 --offset=0 --search=exampleString --groups=exampleString









 Policies 

Define rotation policies for secrets.



 ibmcloud secrets-manager policy-update 

Create or update one or more policies, such as an [automatic rotation policy](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-automatic-rotation), for the specified secret. To remove a policy, keep the resources block empty.

ibmcloud secrets-manager policy-update --secret-type SECRET-TYPE --id ID --metadata METADATA --resources RESOURCES [--policy POLICY]



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: username_password, iam_credentials, public_cert, private_cert.

--id (string)
: The v4 UUID that uniquely identifies the secret. Required.

The value must match regular expression /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/.
* [CVE-2020-8231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231)
* [CVE-2020-8284](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8284)
* [CVE-2020-8285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8285)
* [CVE-2020-8286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8286)
* [CVE-2020-8927](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8927)
* [CVE-2020-9948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9948)
* [CVE-2020-9951](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9951)
* [CVE-2020-9983](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9983)
* [CVE-2021-3326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326)
* [RHSA-2021:1581](https://access.redhat.com/errata/RHSA-2021:1581)
* [RHSA-2021:1585](https://access.redhat.com/errata/RHSA-2021:1585)