vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing IAM access for toolchains 

Access to toolchains for users in your account is controlled by IBM Cloud® Identity and Access Management (IAM). Every user that accesses the toolchains in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to determine the best way to assign access to toolchains.

The access policy that you assign users in your account determines what actions a user can perform within the context of the toolchain that you select. The allowable actions are customized and defined by the toolchain as operations that are allowed to be performed. Each action is mapped to an IAM platform or role that you can assign to a user.

If a specific role and its actions don't fit the use case that you want to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

IAM access policies enable access to be granted at different levels. Some of the options include the following:



* Access across all instances of the service in your account



Review the following tables that outline what types of tasks each role allows for when you're working with the toolchain service. Platform management roles enable users to perform tasks on service resources at the platform level, for example, assign user access to the service, create or delete instances, and bind instances to applications. Service access roles enable users access to toolchain and the ability to call the toolchain's API. For information about the actions that are mapped to each role, see [IAM roles and actions - Toolchain](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionstoolchain).

Platform roles

Service roles



Table 1. IAM platform roles

 Platform role Description of actions 

 Viewer View toolchains and delivery pipelines. 
 Operator Run toolchains and delivery pipelines. 
 Editor Manage the toolchains, which include creating and deleting toolchains along with performing all platform actions except for managing the account and assigning access policies.
[Manual DNS providers](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificatesorder-public-cert-manual-ui) If your DNS provier is not IBM Cloud Internet Services or IBM Cloud Domain Name Registration, you can connect your Secrets Manager to your DNS provider manually. 





 Granting service access to CIS 

If you manage your domains in Cloud Internet Services (CIS), you must assign access to Secrets Manager so that it can validate the ownership. To authorize Secrets Manager to manage a CIS instance and its domains, you can [create an authorization between the services](https://cloud.ibm.com/docs/account?topic=account-serviceauth).

If you're working with a CIS instance that is located in another account, you can also use an API key to manage access. For more information, see [Granting service access by using an API key](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificatesauthorize-cis-another-account).



 Granting service access to CIS 

You can grant Secrets Manager the ability to access your CIS instance and all of its domains by creating a service authorization between the services.

To create a service authorization, you can use the Access (IAM) section of the console.

Zoom

![The figure shows a simplified IAM dashboard with numbered steps for creating an authorization between Secrets Manager and Cloud Internet Services. The steps are described in the following text.](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/secrets-manager/images/create-service-auth.svg)

Figure 1. Creating a service authorization between Secrets Manager and CIS



1. In the console, click Manage > Access (IAM), and select Authorizations.
2. Click Create.
3. Select a source account for the authorization.
4. Select a source and target service for the authorization.



1.
* CLI
* API







 Managing routes using the V2 API 

You can manage routes in your account by using the IBM Cloud® Activity Tracker Event Routing CLI, Activity Tracker Event Routing REST API, and Terraform scripts. A route defines the rules that indicate what auditing events are routed in a region and where to route them.

The version of the API running in your account can be determined by running the [ibmcloud atracker init version](https://cloud.ibm.com/docs/atracker?topic=atracker-v2api) command.



 Understanding how routes work in your account 

Note the following information about routes:



* Routes are global under an account and are evaluated in all regions where IBM Cloud® Activity Tracker Event Routing is deployed.
* Routes may be accessed from any regional Activity Tracker Event Routing API endpoint.
* You can define up to 4 routes for an account.
* By default, the account has 0 routes configured.
* You can configure up to 4 rules for each route.
* You can configure up to 8 locations for each rule.
* You can configure up to 3 targets (target_ids) for each rule.
* Routes are processed independently. If you have multiple routes with rules that match the same event, that event will be sent to multiple targets.
* Rules are processed in order. The first matching rule (for example, location) an event matches will be used to process the event. Once an event has been processed it will not be processed by a subsequent rule within that route's definition. If you want to specify a default rule for all events that were not processed by other rules you would specify the rule ("locations" : [""]) as the final rule in your rules definition for the route.
* If an event doesn't match any rule and no default target is configured, the event will be dropped and not routed to any target.
* Any update to a rules configuration must include all location rules. An update will discard the existing rule set and replace it with the specified configuration.



After you configure a route, it might take up to 1 hour for the configuration to be enabled.
Getting help and support for CIS 

If you experience an issue or have questions when using CIS, you can use the following resources before you open a support case.



*  Review [FAQs](https://cloud.ibm.com/docs/cis?topic=cis-faq) in the product documentation.
*  Review [Troubleshooting](https://cloud.ibm.com/docs/cis?topic=cis-troubleshoot-your-cis-network-connection) to diagnose and resolve common issues.
*  Check the status of the IBM Cloud platform and resources by going to the [Status page](https://cloud.ibm.com/status).
*  Review [Stack Overflow](https://stackoverflow.com/search?q=cis+ibm-cloud) to see whether other users ran into the same problem. If you're using the forum to ask a question, tag your question with ibm-cloud and cis so that it is seen by the IBM Cloud development teams.



If you still can't resolve the problem, you can open a support case. For more information, see [Creating support cases](https://cloud.ibm.com/docs/get-support?topic=get-support-open-case).



  Providing support case details for CIS 

To ensure that the support team has all of the details for investigating your issue to provide a timely resolution, you must provide detailed information about your issue. Review the following tips about the type of information to include in your support case for issues with CIS.

Provide the following details:



1.  Provide your CRN:



*  In the UI, go to the Overview page
*  In the CLI, run ibmcloud resource service-instances --long



2.  Provide your Domain name or ID.
3.  Depending on the issue the following information might also be helpful:



*  Account ID: Log into [https://cloud.ibm.com](https://cloud.ibm.com) and go to View Profile > Billing
*  Instance ID: Run the CLI command ibmcloud resource service-instances --long
*  Geo location
Managing organizations 

You can use the IBM® Blockchain Platform console to create a formal organization definition that is known as a Membership Services Provider (MSP). Your organization's MSP definition allows other members of the blockchain consortium to verify the identity of your nodes and applications. Your MSP definition also contains your organization's admin certificates.

You can also use the console to manage which organizations are members of your channel. The administrator of the ordering service can use the organizations tab to add members to the blockchain [consortium](https://cloud.ibm.com/docs/blockchain?topic=blockchain-glossaryglossary-consortium). Members of the channel can then use the console to add members to new or existing channels.

Zoom

![IBM Blockchain Platform console organizations tab](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/console_organizations_tab.png)

Figure 1. You can use the organizations panel to create, import, and manage organization MSP definitions

Target audience: This topic is designed for network operators who are responsible for creating, monitoring, and managing the blockchain network.



 Understanding MSPs 

The IBM Blockchain Platform is based on Hyperledger Fabric and builds permissioned blockchain networks. Participants need to be known to the network before they can submit transactions and interact with the assets on the ledger. Fabric recognizes identity through a group of invited organizations at the channel level. Organizations in the consortium are able to issue valid credentials to their members and let them become participants in the network. The participants can then operate blockchain nodes and submit transactions from client applications.

Each organization in a network needs to operate a Certificate Authority to create all of the identities for the admins and nodes that belong to your organization. These public-private keys pairs are issued by the CA and used by the members of your organization to sign and verify their actions. When an organization joins a channel, the public key of the CA associated with that organization allows other organizations to verify that your peers and applications are valid participants.
It runs the static scans and dynamic scans on the Application Source Code, detect secrets in Git repos, Bill Of Materials (BOM) check, CIS check, and Vulnerability Advisor scan. After scanning and running checks on artifacts and source repositories, the pipeline creates a new incident issue or updates the existing incident issues in the incident repository. Finally, using these issues and the results, the pipeline collects evidence and summarizes the evidence, so the Security and Compliance Center Center can update the compliance status of the found artifacts.

The CC pipeline uses the [async sub pipeline](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-async-stagesasync-stages-setup-triggers) that runs in parallel to the main pipeline run to optimize pipeline run time and improve pipeline resiliency.

This tutorial uses a staging environment as an example to configure and showcase the continuous compliance (CC) toolchain.

The CC toolchain implements the following best practices:



* Runs a static code scanner at pre-defined intervals on the application repositories that are provided to detect secrets in the application source code and vulnerable packages that are used as application dependencies.
* Scan the container image for security vulnerabilities.
* Any incident issue that is found during the scan or updated is marked with a due date.
* Generate a summary.json file and store in IBM Cloud Object Storage at the end of every run that summarizes the details of the scan.



Let's get started with the creation and exploration of the CC toolchain.





 Step 1: Start the CC toolchain setup 

Start the CC toolchain configuration by using one of the following options:



* Click Create toolchain.

[!
IA-5 - Authenticator Management 



 Control requirements 

The organization manages information system authenticators by:

IA-5 (a)
: Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, or device receiving the authenticator;

IA-5 (b)
: Establishing initial authenticator content for authenticators defined by the organization;

IA-5 (c)
: Ensuring that authenticators have sufficient strength of mechanism for their intended use;

IA-5 (d)
: Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;

IA-5 (e)
: Changing default content of authenticators prior to information system installation;

IA-5 (f)
: Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;

IA-5 (g)
: Changing/refreshing authenticators [IBM Assignment: 90 days for user passwords and 365 days for system-to-system authenticators];

IA-5 (h)
: Protecting authenticator content from unauthorized disclosure and modification;

IA-5 (i)
: Requiring individuals to take, and having devices implement, specific security safeguards to protect authenticators; and

IA-5 (j)
: Changing authenticators for group/role accounts when membership to those accounts changes.





 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Consumer accounts for application provider workloads](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumer)
* [Handling and securing secrets](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).
Troubleshooting your CIS network connection 

Use the following methods to gather information that can help you to troubleshoot your network connection.



  Determine if your data is passing through your IBM Cloud Internet Services connection 

IBM Cloud® Internet Services (CIS) uses HTTP headers, which it can read, add, or modify. The header lets us trace how a request was routed, using a CF-Ray number. The CF-Ray number can be found by a curl command or with a Google Chrome plugin in called "Claire".

To know whether data has passed through CIS, locate the Ray ID which is present on every packet.



  Unix command line tools 



*  curl for HTTP: $ curl -vso /dev/null http://example.com
*  dig for DNS: $ dig www.example.com
*  traceroute for network: $ traceroute example.com



For example, the terminal command curl -svo /dev/null YOUR_URL_HERE. -L results in the following:

CF-RAY: 1ca349b6c1300da3-SJC







  Perform a traceroute? 

To see whether a route goes through your CIS pathway, you can perform a dig in a Terminal window for Mac or Linux or use nslookup in the Windows command prompt for Windows.

If the packet has a CF-Ray value, then it has traveled through CIS.

The traceroute command shows the entire path that an IP request has taken.

The Support team makes use of these commands to assist you.
To control who on your team has access to specific secrets, you can create secret groups that map to [Identity and Access Management (IAM)](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam) access policies in your IBM Cloud account. And, you can use [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-at-events) to track how users and applications interact with your Secrets Manager instance.
* Are community plug-ins for Vault supported by Secrets Manager?

Currently, Secrets Manager offers foundational capabilities that don't exist in upstream Vault but are required to support operations for Secrets Manager as a managed service. These capabilities include a set of secrets engines to support secrets of various types in Secrets Manager, and an IBM Cloud Auth method that handles authentication between Vault and your IBM Cloud account.

Secrets Manager will continue to align with upstream Vault capabilities and plug-ins as it extends its support for more secrets engines in coming quarters. Keep in mind that plug-ins or components that are offered by the open source Vault community might not work with Secrets Manager, unless they are written against a [secret type](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secretsecret-types) that Secrets Manager currently supports.
* Can I manage IBM Cloud secrets by using an on-premises Vault?

If you're looking to manage IBM Cloud secrets through the full Vault native experience, you can use the stand-alone IBM Cloud plug-ins for Vault. These open source plug-ins can be used independently from each other so that you can manage IBM Cloud secrets through your on-premises Vault server.



* To set up authentication between Vault and your IBM Cloud account, you can use the [IBM Cloud Auth Method plug-in for Vault](https://github.com/ibm-cloud-security/vault-plugin-auth-ibmcloud).
Satellite Connector Agent Image <br><br> * Test and publish updates to the Satellite Connector Agent Image in the IBM Cloud Container Registry.<br> * Monitor and update the software inside the container image for CVE.<br><br><br> You are responsible for updating the Satellite Connector Agent Image to new versions published to the IBM Cloud Container Registry. 







 Change management 

Change management includes tasks such as deployment, configuration, operating system upgrades, security patching, configuration changes, deletion, and version updates.



Table 3. Responsibilities for change management

 Task IBM responsibilities Your responsibilities 

 Satellite Location <br><br> * Provide an interface to initiate change management activities, such as to delete locations.<br><br><br> <br><br> * Update the hosts that are assigned to the location control plane, and ensure the control plane has [enough compute resources to run](https://cloud.ibm.com/docs/satellite?topic=satellite-location-sizingcontrol-plane-attach-capacity).<br> * Before you [delete any locations](https://cloud.ibm.com/docs/satellite?topic=satellite-host-removelocation-remove-console), remove all associated hosts and clusters. Save any backup information that you want to keep about the location before you delete the location.<br><br><br>
Managing IAM access for Security and Compliance Center 

Access to the IBM Cloud® Security and Compliance Center is controlled by Cloud Identity and Access Management (IAM). Every user that accesses the Security and Compliance Center in your account must be assigned an access policy, with a defined platform IAM role. The policy determines which actions that a user can perform within the context of the Security and Compliance Center.

Policies enable access to be granted at different levels. Some options include the following actions:



* Access to manage profiles and controls
* Access to view security and compliance posture and results
* Access to manage event notifications





 Roles and permissions 

After you define the level of access that a user might need, you can assign them a platform access role. Review the following tables that outline which roles are required to perform actions within the Security and Compliance Center.

The following tables list the platform access roles that are required to manage collectors, credentials, scopes, validations, and profiles in your accounts.



Table 1. IAM user roles and actions

 Action Description Minimum required role 

 compliance.admin.settings-read View Security and Compliance Center settings for your account. Viewer 
 compliance.admin.settings-update Update Security and Compliance Center settings for your account. Administrator 
 compliance.admin.test-event-send Send a test event to a connected Event Notifications service instance. Administrator 
 compliance.posture-management.attachments-create Create an attachment. Editor<br><br>[1] 
 compliance.posture-management.attachments-delete Delete an attachment. Editor<br><br>[2] 
 compliance.posture-management.attachments-read View the available attachments in your account. Viewer<br><br>[3] 
 compliance.posture-management.attachments-update Update an attachment. Editor<br><br>[4] 
 compliance.posture-management.control-libraries-create Create a control library. Editor 
 compliance.posture-management.control-libraries-delete Delete a control library. Editor 
 compliance.posture-management.control-libraries-read View the available control libraries in your account. Viewer
* CLI
* API







 Managing targets 

You can manage IBM Cloud® Activity Tracker Event Routing targets in your account by using the Activity Tracker Event Routing CLI, the Activity Tracker Event Routing REST API, and Terraform scripts. A target is a resource where you can collect auditing events.



 Understanding how targets work in your account 

Note the following information about targets:



* You can define up to 16 targets in each account. Each account can have up to 2 default targets.
* A target defines a resource where auditing events are collected. [Routes](https://cloud.ibm.com/docs/atracker?topic=atracker-route_v2) define how auditing events that are generated in the account are routed to the targets that you configure.
* You can define a target in any of the supported locations where Activity Tracker Event Routing is available. For more information, see [Locations](https://cloud.ibm.com/docs/atracker?topic=atracker-regions).
* Targets are created within a region but are visible across regions. That is, all targets can be accessed by any IBM Cloud® Activity Tracker Event Routing API endpoint.
* You can use private and public endpoints to manage targets. For more information about the list of ENDPOINTS that are available, see [Endpoints](https://cloud.ibm.com/docs/atracker?topic=atracker-endpoints).



* You can manage targets from the private network using an API endpoint with the following format: https://private.REGION.atracker.cloud.ibm.com
* You can manage targets from the public network using an API endpoint with the following format: https://REGION.atracker.cloud.ibm.com
* You can disable the public endpoints by updating the account settings. For more information, see [Enforcing private endpoints](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-mng-endpoints).









 Target types 

You can configure any of the following target types:



Table 1. List of targets
"updated_by": "geetha_sathyamurthy@in.ibm.com",
"status_code": "PENDING",
"status_message": "Triggered deployment"
}





 Next steps 

The next step is to [create an agent assignment policy](https://cloud.ibm.com/docs/schematics?topic=schematics-policy-manage) for the newly deployed agent. The agent assignment policy is used by Schematics to dynamically route the Git repo download jobs, Workspace or Terraform jobs, and Action or Ansible jobs to an agent.

You can check out the [agent FAQ](https://cloud.ibm.com/docs/schematics?topic=schematics-faqs-agent&interface=ui) for any common questions related to an agent.

When the agent is no longer required, it can be removed following the steps in [delete an agent](https://cloud.ibm.com/docs/schematics?topic=schematics-delete-agent-overview&interface=ui).