vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Secrets Manager creates the secret and validates it against your defined IAM access policies.
3. Later, a developer wants to access the contents of your storage bucket. The developer sends a request to retrieve the value of your IAM credential.
4. Secrets Manager validates the request and generates a single-use API key that the developer can use to authenticate to Cloud Object Storage. After the API key reaches the end of its lease, the API key is revoked automatically.





 Before you begin 

Before you get started, be sure that you have [Administrator platform access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesassign-new-access) so that you can provision services, create access groups, and customize access policies for others. You also need the following prerequisites:



* [Download and install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli).
* [Install the Secrets Manager CLI plug-in](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-cli).
* [Download and install jq](https://stedolan.github.io/jq/).

jq helps you slice and filter JSON data. You use jq in this tutorial to grab and use stored environment variables.







 Step 1: Set up your environment 

To work with Secrets Manager and Cloud Object Storage, you need to create instances of both services in your IBM Cloud account. You also need to configure permissions so that you can run operations against both services.

In this step, you set up an access environment by creating an access group, a service ID, and an IBM Cloud API key. At the end of the tutorial, you can easily remove both instances if you no longer need them.

You can have only one Secrets Manager service instance in your IBM Cloud account.



 Create Secrets Manager and Cloud Object Storage instances 

Start by creating test instances of Secrets Manager and Cloud Object Storage in your IBM Cloud account.



1.
These credentials are used to determine infrastructure permissions, even if an [IBM Cloud IAM API key](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_api_key_info) exists for the resource group and region. If the user whose credentials are stored does not have the required permissions to order infrastructure, then infrastructure-related actions, such as creating a cluster or reloading a worker node can fail.

You can't set multiple credentials for the same IBM Cloud Kubernetes Service resource group and region.

Before you use this command, make sure that the user whose credentials are used has the required [IBM Cloud Kubernetes Service and IBM Cloud infrastructure permissions](https://cloud.ibm.com/docs/containers?topic=containers-usersusers).

ibmcloud ks credential set classic --infrastructure-api-key API_KEY --infrastructure-username USERNAME --region REGION [-q]

Minimum required permissions
: Administrator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

--infrastructure-username USERNAME
: Required: IBM Cloud infrastructure account API username. The infrastructure API username is not the same as the IBMid. To view the infrastructure API username, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keys).

--infrastructure-api-key API_KEY
: Required: IBM Cloud infrastructure account API key. To view or generate an infrastructure API key, see [Managing classic infrastructure API keys](https://cloud.ibm.com/docs/account?topic=account-classic_keys).

--region REGION
: Specify a region in IBM Cloud Kubernetes Service: jp-osa, jp-tok, au-syd, eu-de, eu-gb, us-east, or us-south.

-q
: Optional: Do not show the message of the day or update reminders.



 Example credential set classic command
Authenticating with service credentials 

You can generate a new set of credentials for cases where you want to manually connect an app or external consumer to an IBM Cloud service. Credentials are provided in JSON format. The JSON snippet lists credentials, such as the API key and secret, and the connection information for the service.

Services that are managed by IBM Cloud® Identity and Access Management (IAM) can generate a resource key, also known as a credential. Credentials are service-specific and vary based on how each service defines the credentials they need to generate. A credential might contain a username, password, hostname, port, and a URL.

Click Service credentials to view the existing credentials with the Key name and Date created or create a new credential.

For more information about adding and viewing a service credential, see [Adding and viewing credentials](https://cloud.ibm.com/docs/account?topic=account-service_credentials).
Authenticating with service credentials 

You can generate a new set of credentials for cases where you want to manually connect an app or external consumer to an IBM Cloud service. Credentials are provided in JSON format. The JSON snippet lists credentials, such as the API key and secret, as well as connection information for the service.

Services that are managed by IBM Cloud® Identity and Access Management (IAM) can generate a resource key, also known as a credential. Credentials are service-specific and vary based on how each service defines the credentials they need to generate. A credential might contain a user name, password, host name, port, and a URL.

Click Service credentials to view the existing credentials with the Key name and Date created or create a new one.

For more information on adding and viewing a service credential, see [here](https://cloud.ibm.com/docs/account?topic=account-service_credentials).
Review the default values for Region and Resource-Group and update, if required.
6. Select the instance of the Secrets Manager service that you want to use.
7. Click Create Integration.





 Applying secrets 

After your Secrets Manager tool integration is configured, you can use it to apply secrets anywhere that they are needed by the toolchain. This tool integration and the Secrets dialog box support both the Arbitrary and the IAM credentials secret types.

You can use Arbitrary secrets to store any predefined secret value, or to store dynamically minted IBM Cloud API keys by using the Secrets dialog box. You must create IAM credentials secrets directly within your Secrets Manager service instance. After you create these secrets, you can select IAM credentials secrets to use them within your toolchain by using the Secrets dialog box on any secure field. The Secrets dialog box displays both the Arbitrary and the IAM credentials secret types, with the secret type appended to the secret name in brackets.



 Using arbitrary secrets that are stored in Secrets Manager 

You must save third-party secrets, such as a Slack webhook or an Artifactory API token, in Secrets Manager before you create a new toolchain. You can mint and store IBM-managed secrets, such as IBM Cloud API keys in Secrets Manager, as Arbitrary secret types while you work with your toolchain by using the Secrets dialog. However, you must mint IAM credentials secrets directly in Secrets Manager before you can select these types of secrets within your toolchain by using the Secrets dialog box.

The following example applies an Arbitrary secret type that is stored in Secrets Manager to an IBM Cloud API key that is required by the [Delivery Pipeline tool integration](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipeline). You can follow the same steps to apply secrets to any of the Continuous Delivery tool integrations that require secret values.



1. Click the key icon to retrieve secrets from secure stores such as Secrets Manager for the IBM Cloud API key.
2. In the Provider field, specify the provider and the name of the Secrets Manager tool integration that you use to manage your toolchain secrets.
By selecting an access group from your IBM Cloud account, you determine the scope of access to assign to the service ID and the API key. The API key is dynamically generated and associated with your new IAM credential. This step ensures that your IAM credentials are scoped with the preferred level of permissions in your IBM Cloud account. You can assign up to 10 access groups.



If you used an existing service ID, the API key that was generated by Secrets Manager is automatically locked. If you selected an access group, both the new service ID and API key that Secrets Manager created for the secret are automatically locked. Each time you that [retrieve an IAM credentials secret](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-access-secrets&interface=apiget-secret-value-api) by using the API, the API key and the service ID that Secrets Manager generates are locked, even if you manually unlock them before retrieving the secret.







 Creating IAM credentials from the CLI 

To create a dynamic service ID and API key by using the Secrets Manager CLI plug-in, run the [ibmcloud secrets-manager secret-create](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clisecrets-manager-cli-secret-create-command) command. For example, the following command creates an IAM secret with a lease duration of 12 hours.

ibmcloud secrets-manager secret-create
This release includes the following updates:



* Added the service_id string parameter as a request body option to the [Create a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret) method. You can use this field to create IAM credentials with an existing service ID from your account, so that only an API key is generated when the secret is read or accessed.
* Added the api_key_id string parameter to the response details of the [Create a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret) and [Get secret metadata](https://cloud.ibm.com/apidocs/secrets-managerget-secret-metadata) methods.
* Added the service_id_is_static boolean parameter to the response details of the [Create a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2create-secret) and [Get secret metadata](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-secret-metadata) methods. This parameter indicates whether an IAM credential secret was created by using an existing service ID.
* Added the [List versions of a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2list-secret-versions) method that can be used to obtain version history information for a secret.
* Added payload_available and downloaded boolean parameters to the response details of the [Get a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-secret), [Get secret version metadata](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-secret-version-metadata), [List versions of a secret](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2list-secret-versions) methods.
If anyone or any application has access to the credentials, they can effectively do whatever they want with the service instance. For example, they might create spurious data, or delete valuable information. Protect these credentials carefully.

IBM Cloudant has two authentication methods available at provisioning time, either Use only IAM or Use both legacy credentials and IAM. You can see the details about your legacy credentials only if the Use both legacy credentials and IAM authentication method is chosen. The credentials display on the Service credentials tab for your instance. For more information, see the [IAM guide](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-managing-access-for-cloudant) and [legacy authentication](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-managing-access-for-cloudant) document for details about using either style of authentication.

The service credentials include the following fields, as well as designating the fields that are only shown if you select the Use both legacy credentials and IAM option:



Table 1. Service credential fields

 Field Purpose Legacy-auth enabled 

 username The username that is required for applications to access the service instance. 
 password The legacy credentials password that is required for applications to access the service instance. X 
 host The hostname that is used by applications to locate the service instance. X 
 port The HTTPS port number for accessing the service instance on the host. It's 443 as only HTTPS access is allowed by IBM Cloudant. X 
 url The HTTPS URL to access the IBM Cloudant instance. X (If the Use both legacy credentials and IAM option is chosen, it also includes the embedded legacy username and password.) 
 apikey The IAM API key. 
 iam_apikey_description Description of the IAM API key. 
 iam_apikey_name ID of the IAM API key. 
 iam_role_crn The IAM role that the IAM API key has. 
 iam_serviceid_crn The CRN of the service ID. X 



To create an application that can access your service instance, you need these credentials.
Getting started with Secrets Manager 

This tutorial focuses on storing and managing a username and password in IBM Cloud® Secrets Manager. With Secrets Manager, you can create, lease, and centrally manage secrets that are used in IBM Cloud services or your custom-built applications. Secrets are stored in a dedicated Secrets Manager instance, built on open source HashiCorp Vault.

Looking for a different secret type? You can also [create Identity and Access Management (IAM) credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials) to access an IBM Cloud resource, or you can [add arbitrary secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-arbitrary-secrets) that can hold structured or unstructured data.



 Before you begin 

Before you begin, be sure to [create a Secrets Manager service instance](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance) in your IBM Cloud account. To complete this tutorial, you need the [Manager service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).





 Step 1: Choose a type of secret 

You can get started with Secrets Manager by choosing the type of

secretthat is required by the resource that you want to access. For this tutorial, complete the following steps to select a secret that contains a username and password.



1. In the console, go to Menu![Menu icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/icon_hamburger.svg)> Resource List.
2. From the list of services, select your instance of Secrets Manager.
3. In the Secrets table, click Add.
4. Select the User credentials tile.

You're all set to enter the details of your new secret.
"auth": null
}









 Config 



 Set the configuration of a secret type 

Configures a secrets engine that serves as the backend for a specific type of secret. You can set the configuration for the following secret types: iam_credentials

IAM credentials



Table 10. IAM secrets engine request parameters

 Request parameters Description 

 api_key An IBM Cloud API key that can create and manage service IDs. The API key must be assigned the Editor platform role on the Access Groups Service and the Operator platform role on the IAM Identity Service. 





 Example request 

Configure the iam_credentials secrets engine.

curl -X PUT "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/iam_credentials/config/root" -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"api_key": "<API_KEY>"
}'





 Example response 

A request to configure the iam_credentials secrets engine returns the following response:

{
"request_id": "f7ac2068-6b07-7602-76af-093e354a444a",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": null,
"wrap_info": null,
"warnings": null,
"auth": null
}







 Get the configuration of a secret type 

Retrieves the configuration of a secrets engine.



 Example request 

Get the configuration of iam_credentials secrets engine.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/iam_credentials/config/root" -H 'X-Vault-Token: {Vault-Token}'





 Example response
To provision an instance as Use both legacy credentials and IAM, run the following command:

ibmcloud resource service-instance-create "Instance Name" cloudantnosqldb Standard us-south -p {"legacyCredentials": true}





 Service credential JSON examples for each option 

The choice between Use only IAM and Use both legacy credentials and IAM access control affects how credentials are delivered to your application when you bind and generate service credentials. When you generate credentials within the primary IBM Cloud IAM interface, API keys are shown in that interface when generated.

You can also generate credentials from the Service Credentials section of a service instance. Generating service credentials this way creates a service credentials JSON blob that can be pasted into applications with all the details that are needed to access the service instance.

Next, you can see what the service credential JSON looks like and what each value means.

When you select Use only IAM, the service credentials that are generated contain only IAM values, and look like the following example.

{
"apikey": "MxVp86XHkU82Wc97tdvDF8qM8B0Xdit2RqR1mGfVXPWz",
"iam_apikey_description": "Auto generated apikey during resource-key [...]",
"iam_apikey_name": "auto-generated-apikey-050d21b5-5f[...]",
"iam_role_crn": "crn:v1:bluemix:public:iam::::serviceRole:Manager",
"iam_serviceid_crn": "crn:v1:staging:public:iam-identity::[...]",
"url": "https://76838001-b883-444d-90d0-46f89e942a15-bluemix.cloudant.com",
Usually, they either consist of a combination of user identity (ID) and password or just a single API key. Often, it is possible to specify the set of privileges for the credentials, e.g., to allow read-only access or scope what can be accessed, modified, or even created and deleted. The credentials are then imported or configured for a dependent service or application to access that resource. Even though access is possible, set up requires some (manual) work and overall they are only loosely coupled or integrated.

Within IBM Cloud, some compute services including [Code Engine](https://cloud.ibm.com/docs/codeengine?topic=codeengine-service-binding) and [Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-service-binding) allow the automatic creation and configuration of credentials, the so-called service binding.





 Service-to-service authorization 

A tighter integrated approach for one service accessing another one is to [establish service-to-service authorizations (s2s authorization)](https://cloud.ibm.com/docs/account?topic=account-serviceauth). You create an IBM Cloud Identity and Access Management (IAM) policy that authorizes a source service to access a target service. Because the authentication is accomplished by identifying the source service requesting access, no credentials in the form of passwords or API keys are needed. Both authentication and authorization are handled automatically because of the created IAM policy.



 Cross-account authorizations 

IAM supports establishing service-to-service authorizations between a source service in another IBM Cloud account and a target in the current one. Therefore, it allows sharing resources across accounts by creating an IAM authorization policy. Such policies can be created in many ways, including [in the browser console](https://cloud.ibm.com/iam/authorizations/grant) as shown below, utilizing the CLI or by executing Terraform code.

In the following examples, a specific Object Storage instance in the source account is granted the Reader role for that identified Key Protect instance in the current account.

Zoom

!
"version_id" : "7bf3814d-58f8-4df8-9cbd-f6860e4ca973",
"version_alias" : "current",
"locks" : "lock-3", "lock-4" ],
"payload_available" : true
}, {
"version_id" : "5bf89b0c-df55-c8d5-7ad6-8816951c6784",
"version_alias" : "previous",
"locks" : "lock-example-1", "lock-example-2" ],
"payload_available" : true
} ]
}









 Configurations 

Create and manage configurations so that you can work with specific types of secrets.



 ibmcloud secrets-manager configuration-create 

Add a configuration to the specified secret type.

Use this operation to define the configurations that are required to create public certificates (public_cert), private certificates (private_cert) and IAM Credentials secrets (iam_credentials).

You can add multiple configurations for your instance as follows:



* A single configuration for IAM Credentials.
* Up to 10 CA configurations for public certificates.
* Up to 10 DNS configurations for public certificates.
* Up to 10 Root CA configurations for private certificates.
* Up to 10 Intermediate CA configurations for private certificates.
* Up to 10 Certificate Template configurations for private certificates.



ibmcloud secrets-manager configuration-create --configuration-prototype CONFIGURATION-PROTOTYPE



 Command options 

--configuration-prototype ([ConfigurationPrototype](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-cli-plugin-secrets-manager-clicli-configuration-prototype-example-schema))
: The details of your configuration. Required.

Provide a JSON string option or specify a JSON file to read from by providing a filepath option that begins with a @, e.g. --configuration-prototype=@path/to/file.json.





 Example
* UI
* CLI
* API
* Terraform







 Connecting third-party certificate authorities 

With IBM Cloud® Secrets Manager, you can connect to a third-party certificate authority by adding a configuration to your instance.

A certificate authority (CA) is the entity that signs and issues your SSL/TLS certificates. By adding a CA configuration, you can specify the authority that you want to use when you [order public certificates](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-public-certificatesorder-public-certificates) through Secrets Manager.

You can define up to 10 certificate authority configurations per instance. To view a list of configurations that are available for your instance, go to the Secrets engines > Public certificates page in the Secrets Manager UI.

You can define up to 10 certificate authority configurations per instance. To obtain a list of configurations that are available for your instance, you can use the [List configurations](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2get-secret-config-element) API.



 Before you begin 

Before you get started, be sure that you have the required level of access. To manage engine configurations for your instance, you need the [Manager service role or higher](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam).



 Supported certificate authorities 

You can integrate the following certificate authorities with your Secrets Manager service instance.

Let's Encrypt



Table 1. Prerequisites - Let's Encrypt

 Prerequisites 

 Before you connect Let's Encrypt, be sure that you:<br><br><br><br> * Obtain the private key that's associated with your Automatic Certificate Management Environment (ACME) account. <br> The ACME protocol makes it possible to automatically obtain browser trusted certificates without human intervention. Before you can request Let's Encrypt certificates through Secrets Manager, you must have an ACME account.