vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Follow the instructions in [enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=uivrf).









 Set the IAM permissions 

Set up account access (Cloud Identity and Access Management (IAM)):



* Create an IBM Cloud [API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key). The user who owns this key must have the Administrator role.

Service ID API keys are not supported for the Red Hat OpenShift Container Platform on VPC landing zone deployable architecture.
* For compliance with IBM Cloud Framework for Financial Services, users in your account are required to use [multi-factor authentication (MFA)](https://cloud.ibm.com/docs/account?topic=account-account-getting-startedaccount-gs-mfa).
* [Set up access groups](https://cloud.ibm.com/docs/account?topic=account-accoungetting-startedaccount-gs-accessgroups).

User access to IBM Cloud resources is controlled by using the access policies that are assigned to access groups. For IBM Cloud Financial Services validation, do not assign direct IAM access to any IBM Cloud resources.

Select All Identity and Access enabled services when you assign access to the group.





 Verify access roles 

IAM access roles are required to install this deployable architecture and create all the required elements.

You need the following permissions for this deployable architecture:



* Create services from IBM Cloud catalog.
* Create and modify IBM Cloud VPC services, virtual server instances, networks, network prefixes, storage volumes, SSH keys, and security groups of this VPC.
* Create and modify Power® Systems Virtual Server services, virtual server instances, networks, storage volumes, ssh keys of this Power® Systems Virtual Server.
* Create and modify IBM Cloud direct links and IBM Cloud Transit Gateway.
* Access existing Object Storage services.



For information about configuring permissions, contact your IBM Cloud account administrator.





 Access for IBM Cloud projects
Understanding user roles and resources 

IBM® Key Protect for IBM Cloud® supports a centralized access control system that leverages IBM Cloud® Identity and Access Management to help you assign your users the correct roles and access for your account, service instances, encryption keys, and key rings.

Because Key Protect is a key management system that, by its nature, involves encrypting important and often confidential data, it is vital that the permissions structure over the account, service instances, encryption keys, and key rings is both powerful and flexible. To this end, IBM Cloud® Identity and Access Management roles can be assigned in varying combinations, depending on the level of administration in question.

These varying kinds of access are analogous to many kinds of life situations. A person might be the founder and CEO of a company and yet only be a regular member of a local club, and likewise have no authority at all to write traffic tickets. In a similar way, Key Protect roles are assigned within the context of a specific part of Key Protect, although to make things simpler, Key Protect does define "default" roles over certain resources unless specified otherwise (which we'll discuss in more detail later).

There are two main areas of administration for almost all IBM Cloud products: the account (also known as the "platform"), and the service instances owned by the account. A large bank, for example, might have only one account (controlled by executive leadership) and separate service instances for each of the organizational units within the bank (for example, one unit might manage bank accounts while another manages loans). While it is likely that users with rights at the account level will also have rights over the various instances (and perhaps, though not always, the other way around), note that the names given to account roles are different than those for the roles within the service instances, reflecting this difference between account roles and service instance roles. For more information on those roles, their names, and their permissions, check out [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions).



 How IAM access works 

After you set up and organize resource groups in your account, you can take advantage of a couple of strategies to streamline the access management process:

Access groups
After you enter the password, the system prompts which account and region that you want to use:

ibmcloud login --sso
3. Create a load balancer:

ibmcloud is load-balancer-create nlb-test public --subnet 0896-b1f24514-89dc-4afd-b0e2-5489a43cf45c --family network --route-mode true

Sample output:

Creating load balancer vnf under account CNS Development Account - netsvs as user ibm@us.ibm.com...

ID r014-c7cadd8e-9e8b-4965-bee3-5d9ff95b3512
Name vnf
CRN crn:v1:bluemix:public:is:us-east-2:a/be636a7a6e4d4b6296bedf669ce8f757::load-balancer:r014-c7cadd8e-9e8b-4965-bee3-5d9ff95b3512
Family Network
Routing Mode Enabled true
Host name c7cadd8e-us-east.lb.appdomain.cloud
Subnets ID Name
0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024 nlb-subnet

Public IPs
Private IPs
Provision status create_pending
Operating status offline
Is public false
Listeners
Pools ID Name

Resource group ID Name
42c4f51adc3147b4b4049ad9826c30a1 Default

Created 2021-09-14T17:54:24.584-05:00
Security groups supported false
4. Wait until the NLB is in an active state, then run the following command:

ibmcloud is load-balancer r014-c7cadd8e-9e8b-4965-bee3-5d9ff95b3512 

Sample output:
IBM Cloud Pay-As-You-Go and Subscription accounts are automatically set up with an IBM Cloud infrastructure account that allows access to classic infrastructure resources. The API key that you set is used to order infrastructure resources from this infrastructure account, such as new worker nodes or VLANs.

You can find the current API key owner by running [ibmcloud ks api-key info --cluster <cluster>](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_api_key_info). If you find that you need to update the API key that is stored for a region, you can do so by running the [ibmcloud ks api-key reset --region <region>](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_api_key_reset) command. This command requires the IBM Cloud Kubernetes Service admin access policy and stores the API key of the user that executes this command in the account.

Be sure that you want to reset the key and understand the impact to your app. The key is used in several different places and can cause breaking changes if it's unnecessarily changed.

Before you begin:



* If the account owner does not set up the API key, [ensure that the user who sets the API key has the correct permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsowner_permissions).
* Consider using a functional ID user for the API key owner instead of a personal user. In case the person leaves the team, the functional ID user remains the API key owner.
* [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



To set up the API key to access the IBM Cloud infrastructure portfolio:



1. Create an API key for the region and resource group that the cluster is in.



1.
* UI
* CLI
* API
* Terraform







 Creating an enterprise 

You create an IBM Cloud® enterprise from an existing Subscription account. When an existing subscription account is used, an enterprise and an enterprise account are created. The account that you use to create the enterprise and the new enterprise account are permanently added to the enterprise, but this account does not become the parent account.



 Before you begin 

To create an [IBM Cloud enterprise](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise), you must be the account owner or have the Administrator role on the Billing account management service in a Subscription account.

The Subscription account that you use to create the enterprise is permanently moved into the enterprise. Moving the account into the enterprise has the following impacts:



* Billing for the account transitions to being [managed by the enterprise](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-enterprise). After the transition, users in the account can't access billing and payment information, such as invoices, payments, or subscriptions, for future billing periods. To view or manage billing, users need to be invited to the enterprise account and be given access to the Billing service in that account.
* Users and access permissions within the account are not changed. Access within the account is separate from the enterprise, and users don't automatically get access within the enterprise when the account is added. However, billing information is no longer available within the account regardless of access permissions.
* Resources within the account are not changed. Users with the correct access permissions can continue to view usage information for resources in the account.



Before you can create an enterprise by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started).
[A screen capture of the account selector in the console menu bar. The account selector displays the account name and account number, and you select the current account to display a list of other accounts that you can access.](https://cloud.ibm.com/images/account-faq.svg)

Figure 1. Account selector

You can view your role in each account on the [Users page](https://cloud.ibm.com/iam/users). The 'owner' tag next to a user name indicates the account owner. If you are the owner of the account, the 'self' tag is also listed next to your name. If you see only your name that is listed and you are not the account owner, the account owner has restricted the user list. For more information, see [Controlling user visibility](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting).Contact [IBM Cloud Support](https://cloud.ibm.com/unifiedsupport/supportcenter) to determine the account owner.

You can also find your accounts from the CLI by running the ibmcloud account list command. This command lists the account that you own and any other accounts that are affiliated with your IBMid.
* Can I view my account ID, account type, and account number?

Go to the [Account settings](https://cloud.ibm.com/account/settings) page in the console to view your account ID and type. The account ID is a 32 character, unique account identifier. The IBM Cloud console menu bar lists all of the accounts that are affiliated with your IBMid, including the accounts that you own. The account selector displays the account name and account number.
* How can I join accounts?

The account owner, organization manager, or a user with the correct permissions can invite you to join their account.



* If you're new to IBM Cloud®, you receive an email that contains all the information you need.
* As an existing member of IBM Cloud®, you can accept the invitation in your notifications, by email, or by using the CLI to onboard to the new account.
An account is preselected by the UI during login. After a user is logged in, the dashboard has an option to switch accounts. Selecting a different account generates additional access and refresh token events.
6. The IAM Identity Service checks the current tokens. If the user is authorized to work in the new account, the IAM Identity Service returns a new access token and a new refresh token that are bound to the new account.
7. At this point in the process, the IAM Identity Service generates an Activity Tracker Event Routing event with action iam-identity.user-refreshtoken.login. This event is available in the new account.







 User requests to run an action in the IBM Cloud UI 

In this scenario, a user is already logged in successfully to your account and runs an action on a service in your account.



* If the user's access and refresh tokens have expired, the user needs to log in through the IBM Cloud UI to continue working through the UI. An Activity Tracker Event Routing event with action iam-identity.user-refreshtoken.login is generated.
* When the user runs an action through the IBM Cloud UI, a cookie is generated. At this point in the process, an Activity Tracker Event Routing event with action iam-identity.user-identitycookie.login is generated in the account.







 User logs in from the CLI by using an API key 

When a user successfully logs in to your account through the IBM Cloud CLI by using an API key, the following steps are taken:



1. To initiate log in request using the CLI, the IBM Cloud CLI must be installed. [Learn more](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2. Log in to the IBM Cloud by using an API key. Run the following command: [ibmcloud login --apikey](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login). The API key is forwarded to the IAM Identity Service.
IBMCLOUD_CR_PROFILE=trusted_profile_id_or_crn ibmcloud login --vpc-cri

For more information about logging in as a VPC VSI compute resource, see [Logging in as a Virtual Server Instance Compute Resource Identity](https://cloud.ibm.com/docs/cli?topic=vpc-cri-login).

Accept invitation to join a new account:

ibmcloud login -c TargetedAccountID --accept







 ibmcloud logout 

Log out of the CLI:

ibmcloud logout



 Prerequisites 

None.







 ibmcloud regions 

View the information for all regions on IBM Cloud:

ibmcloud regions



 Prerequisites 

Use the ibmcloud api command to set an API endpoint.







 ibmcloud target 

Set or view the target account or region:

ibmcloud target [-r REGION_NAME | --unset-region] [-c ACCOUNT_ID] [-g RESOURCE_GROUP | --unset-resource-group]



 Prerequisites 



* Use the ibmcloud api command to set an API endpoint.
* Use the ibmcloud login command to log in. If you are logging in with a federated ID, use the --sso option to authenticate with a one time passcode, or use the --apikey option to authenticate with an API key.







 Command options 

-c ACCOUNT_ID
: The ID of the target account. Optional.

-r REGION
: The name of the target region, for example, us-south or eu-gb. Optional.

-g RESOURCE_GROUP
: The name of the target resource group. Optional.

--unset-region
: Clear the targeted region.

--unset-resource-group
: Clear the targeted resource group.

If none of the options are specified, the current account and region are displayed.





 Examples 

Set the current account:

ibmcloud target -c MyAccountID

Switch to a new region:
Logging in with a Compute Resource Token 

You can use a trusted profile to set up fine-grained authorization for applications that are running in compute resources. As a result, you aren't required to create service IDs or API keys for the compute resources. The IBM Cloud CLI supports logging in and authenticating to IBM Cloud using a IBM Cloud Kubernetes Service compute resource. For instructions about logging in as a Virtual Server Instance for VPC compute resource using the IBM Cloud CLI, see [Logging in as a Virtual Server Instance Compute Resource Identity](https://cloud.ibm.com/docs/cli?topic=cli-vsi-cri-login).

For more information about managing trusted profiles and establishing trust with compute resources, see [Establishing trust with compute resources](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=uicreate-profile-compute).



 Using the CLI to log in 

To use the IBM Cloud CLI Kubernetes Service compute resource login feature, you must give application pods that run in your IBM Cloud Kubernetes Service cluster access to IBM Cloud services. For more information, see [Authorizing pods in your cluster to IBM Cloud services with IAM trusted profiles](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identity&interface=ui). For Red Hat OpenShift clusters, see [Authorizing pods in your OpenShift cluster to IBM Cloud services with IAM trusted profiles](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identity&interface=ui).



 Using a Compute Resource Token to log in with the CLI 

When you use the compute resource token option to log in with a service account projected token, you specify the compute resource token parameter to enter at login.

You can log in with a compute resource token with the CLI in any of the following ways:



* Call the Compute Resource token directly:



1. Specify the --cr-token option with the ibmcloud login command, and provide the content of the compute resource token.
2.
If preferred, a [Service ID's HMAC credentials](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-uhc-hmac-credentials-main) can be used instead of your API key. Run ibmcloud cos config hmac to input the HMAC credentials, and then switch the authorization method by using ibmcloud cos config auth.

If you choose to use token authentication with your own API key, you don't need to provide any credentials as the program authenticates you automatically.

At any time, to switch between HMAC and IAM authentication, you can type ibmcloud cos config auth. For more information about authentication and authorization in IBM Cloud, see the [Identity and Access Management documentation](https://cloud.ibm.com/docs/account?topic=account-iamoverview).







 Enable tracing in the command line interface 

Tracing can be enabled by setting IBMCLOUD_TRACE environment variable to true (case ignored). When trace is enabled, additional debugging information is printed to the terminal.

On Linux/macOS terminal:

export IBMCLOUD_TRACE=true

On Windows prompt:

SET IBMCLOUD_TRACE=true

To disable tracing, set the IBMCLOUD_TRACE environment variable to false (case ignored).





 Command index 

Each operation has an explanation of what it does, how to use it, and any optional or required parameters. Unless specified as optional, any listed parameters are mandatory.

The CLI plug-in doesn't yet support the full suite of features available in Object Storage. Aspera High-Speed Transfer, Immutable Object Storage, creating Key Protect buckets, or Bucket Firewalls cannot be used by the CLI.





 Abort a multipart upload 



* Action: Abort a multipart upload instance by ending the upload to the bucket in the user's IBM Cloud Object Storage account.
* Usage:ibmcloud cos multipart-upload-abort --bucket BUCKET_NAME --key KEY --upload-id ID [--region REGION] [--output FORMAT]
Managing user access 

Access to IBM Cloud® Code Engine service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the Code Engine service in your account must be assigned an access policy with an IAM role defined. The policy determines what actions a user can perform within the context of the service or instance that you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.

Policies enable access to be granted at different levels.

Roles define the actions that a user or service ID can run. There are different types of roles in the IBM Cloud:



* Platform management roles enable users to perform tasks on Code Engine resources at the platform level, for example assign user access for Code Engine, create or delete service IDs, create projects, and assign policies for Code Engine to other users.
* Service access roles enable users to be assigned varying levels of permission for calling the Code Engine API.



Code Engine uses both the Platform and Service management roles. You can set policies about who can create a project at the platform level, and then use the service roles to manage interaction with the project itself.

Want to learn more about IAM key concepts? Check out [What is IBM Cloud Identity and Access Management?](https://cloud.ibm.com/docs/account?topic=account-iamoverview).



 How do I know which access policies are set for me? 

You can see which access policies are set for you in the [IBM Cloud® Identity and Access Management (IAM)](https://cloud.ibm.com/iam/overview) console. Be sure to check [access policies](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources) that apply for your user, and any access policies that are assigned to any [access groups](https://cloud.ibm.com/docs/account?topic=account-groups) that include your user.

To view IAM information about your user access,



1.
Setting an alternative account owner 

As the owner of an account with classic infrastructure, you can set a [trusted profile](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile) as the alternative account owner. The alternative account owner has the highest level of classic infrastructure permissions and more capabilities. An alternative account owner ensures that you always have a secure way to manage account ownership if the primary account owner leaves your organization or isn't available.

Only accounts with classic infrastructure can set an alternative account owner.



 Granting alternative account owner access 

Alternative account owner access grants the following assignments:



* Administrator and manager roles on All Identity and Access enabled services
* Administrator role on All Account Management services
* A classic infrastructure flag that indicates the trusted profile is the alternative account owner



You can set only one trusted profile as the alternative account owner. A trusted profile with alternative account owner access can't be modified after creation. If you create an additional alternative account owner, an error occurs. For more informaiton, see [troubleshooting](https://cloud.ibm.com/docs/account?topic=account-ts_alt-owner).

To set a trusted profile as the alternative account owner, complete the following steps.



1. Go to Manage > Access (IAM) in the IBM Cloud console.
2. Select Trusted profiles.
3. Click Create.
4. Set the Alternative account owner access toggle to Yes.
5. Click Continue.
6. Define which federated users can apply the trusted profile. For more information, see [Establishing trust with federated users](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=uicreate-profile-federated-ui).
7. Click Continue.
8. Review the policies and permissions that the trusted profile is assigned.
9. Click Create.



The trusted profile with alternative account owner access is indicated by alt owner in the trusted profiles table.