vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* UI
* CLI
* API
* Terraform







 Assigning access to IBM Cloud Metrics Routing 

Access to IBM Cloud® Metrics Routing configuration resources for users and applications in your account is controlled by IBM Cloud® Identity and Access Management (IAM). Every user or application that accesses the IBM Cloud Metrics Routing service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to IBM Cloud Metrics Routing.

You can assign access to IBM Cloud Metrics Routing by using any of the following methods:



* Access policies per user
* Access groups

Access groups are used to streamline access management by assigning access to a group once, then you can add or remove users as needed from the group to control their access.

An access group can be created to organize a set of users, service IDs, and trusted profiles into a single entity that makes it easy for you to assign access. You can assign a single policy to the group instead of assigning the same access multiple times for an individual user or service ID.For more information, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).

To organize a set of users and service IDs into a single entity that makes it easy for you to manage IAM permissions, use access groups. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID.
* Trusted profiles

You can use trusted profiles to grant different IBM Cloud® identities access to resources in your account. Automatically grant federated users access to your account with conditions based on SAML attributes from your corporate directory. Or, use trusted profiles to set up fine-grained authorization for applications that are running in compute resources. This way, you aren't required to create service IDs or API keys for the compute resources. You can also establish trust with IBM Cloud services or service IDs in another account to grant cross-account access. For more information, see [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile).
IAM and Activity Tracker action by API method 

When you use Red Hat® OpenShift® on IBM Cloud® such as through the command line or console, the service calls application programming interface (API) methods to complete your requests. In IBM Cloud IAM, each API operation is associated with an IAM action that the user must have an access role to use the API operation. You can keep track of the requests that you make with an IBM Cloud Activity Tracker instance.

Review the following list of IBM Cloud Identity and Access Management (IAM) actions and IBM Cloud Activity Tracker events that correspond to each API method in Red Hat OpenShift on IBM Cloud.

For more information, see the following topics.



* [Red Hat OpenShift on IBM Cloud API docs](https://containers.cloud.ibm.com/global/swagger-global-api//)
* [User access permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference)
* [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/openshift?topic=openshift-at_events).





 Account 

Review the following account API methods, their corresponding actions in IBM Cloud IAM, and the events that are sent to IBM Cloud Activity Tracker for Red Hat OpenShift on IBM Cloud.



Account API methods, IAM actions, and Activity Tracker events.

 API Method Description IAM action for the API Event sent to Activity Tracker 

 DELETE/v1/credentials Remove IBM Cloud infrastructure account credentials from your Red Hat OpenShift on IBM Cloud account. containers-kubernetes.cluster.create containers-kubernetes.account.delete 
 GET/v1/addons List available add-ons that you can enable in a cluster. N/A N/A 
 GET/v1/config List configuration values for your IBM Cloud account. containers-kubernetes.cluster.read N/A 
 GET/v1/credentials View the IBM Cloud infrastructure account credentials that are set for your Red Hat OpenShift on IBM Cloud account. containers-kubernetes.cluster.read N/A
* CLI
* API







 Retrieving IAM access tokens 

To use the Activity Tracking API, you must use an IBM Cloud® Identity and Access Management (IAM) access token. Each token is valid only for one hour, and after a token expires, you must request a new one if you want to continue using the API.



 Retrieving an access token for the current session by using the IBM Cloud CLI 

You can use the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started) to generate your IAM access token.

Complete the following steps to generate an access token for the current session:



1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).

ibmcloud login

If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
2. Run the following command to retrieve your Cloud IAM access token.

ibmcloud iam oauth-tokens | grep IAM | cut -d : -f 2 | sed 's/^ //'

The following truncated example shows a retrieved IAM token.

IAM token: Bearer eyJraWQiOiIyM...







 Retrieving an access token by using an API key and the IBM Cloud CLI 

You can also retrieve your access token programmatically by creating a [service ID API key](https://cloud.ibm.com/docs/iam?topic=iam-serviceidapikeys) for your application, and then exchanging your API key for an IBM Cloud IAM token.



1. Log in to IBM Cloud with the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
The RabbitMQ Management plug-in UI has a tab for user creation and management available to the admin user on your deployment.

Users who are created directly in RabbitMQ do not appear in Service Credentials, but you can [add them there](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-connection-stringsadding-users-to-_service-credentials_) if you choose. These users will not be integrated with IAM controls, even if added to Service Credentials.





 The ibm user 

If you log in to the management UI with your admin account, you might have noticed a user that is named ibm. The ibm user is the internal administrative account that manages replication, metrics, and other functions that ensure the stability of your deployment. It has the same permission levels and tags as the provided admin user. Changes to the ibm account are not advised and can disrupt the availability of your deployment.
They are used to identify a user, service ID, trusted profile, or resource. The IAM ID is included in the token when used in the console, CLI, or API. Access policies are defined by using IAM IDs since it is the identity that can be verified in the IAM token.

To find your IAM ID, go to Manage > Access (IAM). You can see your IAM ID in the My user details section. To view other users' IAM IDs, go to Manage > Access (IAM) > Users, then select a user's name from the list and click Details.



 User API keys 

IBM Cloud API keys are credentials that are associated with a user's identity. The access that the user is assigned can be from policies across multiple accounts that the user is a member of. User API key credentials can be used to make API and CLI calls. The user API key can be used directly or used to generate a token.

For more information about using an API key associated with your user identity, see [Managing user API keys](https://cloud.ibm.com/docs/account?topic=account-userapikey).





 Federating users to IBM Cloud 

IBM Cloud offers two ways for you to federate your corporate identity provider (IdP), which simplifies login by giving your employees access to IBM Cloud with their company username and password. You can [federate with IBMid](https://ibm.box.com/v/IBMid-Federation-Guide), or you have the option to create an IBM Cloud App ID service instance and use that as a way to federate users into an IBM Cloud account. For more information, see [Enabling authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).

Both federation options require that the user is a member of the account, or has access to the account by a trusted profile to be able to complete operations. If trusted profiles are not configured, the account owner or administrator must invite individual IBMids into the IBM Cloud account. Only if the invited IBMid accepts the invitation is the user added the account as an active user.
To make sure that your context-based restrictions rules don't brake an access flow, set the rule to report-only mode for at least 30 days before you enable the rule. This way, you can monitor the impact of the rule on your access flows, such as when access is denied or allowed and for which identities. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).
* What is IBM Cloud Identity and Access Management?

Identity and Access Management (IAM) enables you to securely authenticate users for platform services and control access to resources across the IBM Cloud platform. A set of IBM Cloud services is enabled to use Cloud IAM for access control. They are organized into resource groups within your account to enable giving users quick and easy access to more than one resource at a time. Cloud IAM access policies are used to assign users, service IDs, and trusted profiles access to the resources within your account. For more information, see [IBM Cloud Identity and Access Management](https://cloud.ibm.com/docs/account?topic=account-iamoverview).
* What is an IAM-enabled service?

An IAM-enabled service must be in a resource group and access to the service is given by using IAM access policies. When you create an IAM-enabled service from the catalog, you must assign it to a resource group. For more information, see [Managing resources](https://cloud.ibm.com/docs/account?topic=account-manage_resource)

IBM Cloud Kubernetes Service is the only exception; it’s IAM-access controlled, but is always assigned to the default resource group. Therefore, you aren’t given the option to choose one when you create it from the catalog. And, it can’t be assigned to any other resource group.
* What is an IAM access policy?

An IAM access policy is how users, services IDs, trusted profiles, and access groups in an account are given permission to work with a specific IAM-enabled service or resource instance, manage a resource group, or complete account management tasks.
* Use the IAM token (or APIKey, which gets the token) that is mapped to the associated database user



IAM authentication is performed as the authentication mechanism. Permissions are not controlled by IAM. Permissions are controlled by database level privileges of the associated user.



 Console access 

Console access is controlled by IAM. An IAM user can be assigned access by the IAM interface to all Db2 service instances, all Db2 service instances in a resource group, or a specific service instance. Within these parameters, IAM users can be assigned platform and service-level access.



Table 1. Roles and console permissions

 Role User mgmt SQL editor/tables Monitoring info Settings (includes scale, backup, DR, etc.) Info panels 

 IAM - Platform - Viewer No No (unless mapped to Db2 user) Yes No Yes 
 IAM - Platform - Operator No No (unless mapped to Db2 user) Yes Yes Yes 
 IAM - Platform - Editor No No (unless mapped to Db2 user) Yes Yes Yes 
 IAM - Platform - Administrator Yes No (unless mapped to Db2 user) Yes Yes Yes 
 Non-IAM, but autheticate with JDBC Only "Change password" Yes No No Yes 







 Service action mapping 

Service action access is also controlled by IAM Roles. An IAM user can be assigned access by the IAM interface to all Db2 service instances, all Db2 service instances in a resource group, or a specific service instance. Within these parameters, IAM users can be assigned or revoked access from specific service actions.



Table 2. Roles and service actions

 Role Manage-users Scale Clone Restore DR Settings Backup Monitor View settings 

 IAM - Platform - Viewer No No No No No No No Yes Yes 
 IAM - Platform - Operator No Yes No Yes Yes Yes Yes Yes Yes 
 IAM - Platform - Editor No Yes Yes Yes Yes Yes Yes Yes Yes 
 IAM - Platform - Administrator Yes Yes Yes Yes Yes Yes Yes Yes Yes 



For more information about user management, see [Database user management](https://www.ibm.com/docs/en/db2oc?topic=features-database-user-management)
Trusted profiles 

IBM Cloud® Monitoring supports IBM Cloud® Identity and Access Management (IAM) trusted profiles to grant federated users access to your account with conditions based on SAML attributes from your corporate directory. Trusted profiles can also be used to set up fine-grained authorization for applications that are running in compute resources. This way, you aren't required to create service IDs or API keys for the compute resources.

If you are using a trusted profile, the email address associated with the trusted profile cannot be used when configuring [notifications.](https://cloud.ibm.com/docs/monitoring?topic=monitoring-notifications)

See [Creating trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile) for information on setting up trusted profiles that can be used with IBM Cloud Monitoring.
Update your accounts Identity and Access (IAM) log in sessions from [Settings page](https://cloud.ibm.com/iam/settings). For more information, see [Managing user's log in session durations](https://cloud.ibm.com/docs/account?topic=account-iam-work-sessions).





 25 February 2021 

Controlling access to resources by using tags
: You can now create tags to control access to your resources and your team's projects can grow without requiring updates to your IAM policies. Incorporating tags into access policies gives you the ability to share a resource across multiple projects and you can change access by simply changing the tags on a resource. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).





 08 February 2021 

New notifications experience
: A more detailed [Notification preferences page](https://cloud.ibm.com/user/notifications) is now available for you to customize your preferences for receiving email notifications. You receive only one email per event unless you subscribe to them, or you can subscribe to specific incidents from the Status page on an ad hoc basis. For more information, see [Setting email preferences for notifications](https://cloud.ibm.com/docs/account?topic=account-email-prefs).

Based on which preferences the account owner or administrator sets, users in the account can view all IBM Cloud incidents, maintenance, announcements, and security bulletins on the [Notifications page](https://cloud.ibm.com/notifications). They can filter the list by selecting a specific type of event, or by using keyword searches. For more information, see [Viewing notifications](https://cloud.ibm.com/docs/get-support?topic=get-support-viewing-notifications).





 01 February 2021 

Managing product availability in catalogs by location
: As the account owner or administrator, you can manage access to products in both the IBM Cloud catalog and the private catalogs in your account based on the location in which the products are deployed.
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0aGVfYmVzdCI6I8...",
"created_at": "2022-08-08T14:10:15Z",
"expires_at": "2022-08-08T15:10:15Z",
"expires_in": 3600
}

For more information about trusted profiles, see [Using a trusted profile to call IAM-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-trusted-profile-metadata).





 Create a trusted profile for the instance 

Trusted profiles for compute resource identities help you assign an IBM Cloud® IAM identity to an IBM Cloud® resource, such as a virtual server instance. You can call any IAM-enabled service from an instance without having to manage and distribute IAM secrets to the instance. You can create a trusted profile when you generate an IAM token from an instance identity access token and link it to the instance. For more information, see [Using a trusted profile to call IAM-enabled services](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-trusted-profile-metadata).





 Retrieve instance metadata from your running virtual server instance 

Use the instance metadata service to get metadata about the instance, initialization information, SSH keys, and placement groups.



 Retrieve instance initialization information 

Make a GET "http://169.254.169.254/metadata/v1/instance/initialization" call to retrieve initialization information for the instance.

This request:



* Calls the API to retrieve the instance identity access token.
* Uses the token to access the metadata service.
* Extracts the user data from the JSON payload by using jq.



You're making an unsecured request that is then secured by a proxy. The proxy intercepts the request by watching for the instance IP.
From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select a table row, and click the ⋯ icon to open a list of options for that user. Then select Manage Access from the drop down list.
3. Here you can see all of the IAM information for this user, including the Access groups they belong to. To specifically see the access policies for this user, click the Access policies tab.



An account owner or user with the appropriate privileges can see all of the policies assigned to this user, including any fine-grained access over keys.









 Viewing keys with the API 

You can retrieve the contents of your keys by using the Key Protect API.



 Retrieving a list of keys 

For a high-level view, you can browse keys that are managed in your provisioned instance of Key Protect by making a GET call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys



1. [Retrieve your authentication credentials to work with keys in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).
2. View general characteristics about your keys by running the following curl command.

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys" -H "accept: application/vnd.ibm.collection+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "x-kms-key-ring: <key_ring_ID>" -H "correlation-id: <correlation_ID>"

Replace the variables in the example request according to the information in Table 1. For more information about optional parameters available when viewing collections of keys, including the ability to search your keys, see the [API documentation regarding the List keys method](https://cloud.ibm.com/apidocs/key-protectgetkeys).





Table 1.
* UI
* CLI
* API
* Terraform







 Managing authorizations to grant access between services 

Use IBM Cloud® Identity and Access Management (IAM) to create or remove an authorization that grants IBM Cloud Metrics Routing access to the IBM Cloud Monitoring service.

Many of the capabilities of IAM are focused on managing and enforcing user and application access to IBM Cloud resources. However, you might encounter other scenarios in which you need to provide one service with access to a user's resource in another service. This type of access is called an authorization.

In an authorization, the source service is the service that is granted access to the target service. The roles that you select define the level of access for the source service. The target service is the service that you are granting permission to be accessed by the source service based on the roles that you assign. A source service can be in the same account where the authorization is created or in another account. The target service is always in the account where the authorization is created. You can view whether the source service is located in the current account or another account by viewing the Source account column for the specific authorization on the [Authorizations](https://cloud.ibm.com/iam/authorizations) page in the IBM Cloud console.



 Permissions to manage authorizations 

You must have access to the target service to manage authorization between services.

The autorization that you define for the IBM Cloud Metrics Routing service requires that you have Administrator role for the IBM Cloud Monitoring service.

The following table outlines the permissions that are needed on the target service to be able to define an authorization:



Table 1. Actions on the target service that are required to manage authorizations

 Action Administrator Operator Editor Viewer 

 View all authorizations that are configured in the account ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/dad8f28785f0dc036aaae4b777787e73db9ff0d4/icons/checkmark-icon.svg) 
 Create authorizations !
This template uses IAM Identity auditing events to monitor any activity reported with the service credential that is used to upload objects into a bucket when the archiving feature is enabled.

For more information, see [IAM Identity auditing events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iam).



When you configure your IBM Cloud account, you have different ways in which you can configure where auditing events are stored. You must deploy this template in each Activity Tracker instance where you store Cloud Object Storage events that are generated by buckets that you use to configure archiving, and in the instance where you store global events.





 Deploying the archiving templates 

Complete the following steps to deploy the archiving template objects in 1 Activity Tracker instance:



 Step 1. Launch the template library 

The Activity Tracker hosted event search offering template library offers multiple tiles that group predefined views, dashboards, and screens by area. One of them is the Track Archiving template.

Complete the following steps to launch the Activity Tracker template library:



1. [Log in to your IBM Cloud account](https://cloud.ibm.com/login).

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. Click the Menu icon ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/icons/icon_hamburger.svg) > Observability.
3. Select Activity Tracker.

The list of Activity Tracker instances is displayed.

There is 1 instance per region.
4. Select the Activity Tracker instance in the region where you want to deploy the template. Then, click Open Dashboard.







 Step 2. Get information to customize template objects 

To get the information on the Activity Tracker instance, complete the following steps:



1.