vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing access with IAM 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud. Access to IBM Cloud Activity Tracker service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM).

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by Activity Tracker Event Routing as operations that are allowed to be performed on the service. An action is mapped to an IAM platform or service role that you can assign to a user.

For more information about the steps to assign IAM access, see [Managing access to resources](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources).



* When you assign policies to users by using a CLI command or API call, use atracker.
* When you assign policies to users through the UI, use Activity Tracking.



To organize a set of users and service IDs into a single entity that makes it easy for you to manage IAM permissions, use access groups. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID.



 Managing access by using access groups 

To manage access or assign new access for users by using access groups, you must be the account owner, administrator, or editor on all Identity and Access enabled services in the account, or the assigned administrator or editor for the IAM Access Groups Service.

Choose any of the following actions to manage access groups in the IBM Cloud:



* [Creating an access group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag).
* [Assigning access to a group](https://cloud.ibm.com/docs/account?topic=account-groupsaccess_ag).







 Managing access by assigning policies directly to users 

To manage access or assign new access for users by using IAM policies, you must be the account owner, administrator on all services in the account, or an administrator for the particular service or service instance.
The actions are then mapped to IAM user roles. [Learn more about the IAM user roles for the IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iamservice).

You might have users across different geographies. However, to comply with EU law, only EU personnel can see and access log data from your EU-supported infrastructure, apps, and services. To restrict access to users, you can configure an access group, and define policies that restrict access to those users to the Frankfurt instance only.

For more information, see [Managing access with IAM](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-iam).





 Step 6. Exporting logs 

In an IBM Cloud Activity Tracker instance, you can configure and control whether users can export data. [Learn more](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-export_config).

Users can export data through the UI or by using the Export API:



* Users can export data to a local file or to a terminal by using the export API and a service key. [Learn more](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-export_api).



* Users with manager permissions to administer the Frankfurt Activity Tracker instance can create and view service keys.
* Users with manager or Standard-Member permissions to work with the Frankfurt Activity Tracker instance can view active service keys, and therefore, can export data locally.
* Users with user permissions to work with the Frankfurt Activity Tracker instance cannot see service keys. Therefore, these users cannot use the export API to download data.
* Service keys are only used to export data from an auditing instance by using the Export API.



* Users can request the export of data through the UI. [Learn more](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-export).







 Step 7. Archiving logs
Auditing events for account, IAM, catalog management 

As a security officer, auditor, or manager, you can use the IBM Cloud® Activity Tracker service to track how users and applications interact with an IBM Cloud® account, the IBM Cloud catalog, private catalogs, and with IBM Cloud Identity and Access Management (IAM).

To get started with monitoring your user's actions, see [Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-startedgetting-started).



 Account management events 

You can track the following events:



* Managing an account by creating an account, updating information, activating an account, or creating a Subscription account
* Adding or removing users
* Creating organizations







 IAM events 

You must create an instance of the Activity Tracker service in the Frankfurt (eu-de) region to start tracking IAM events. When you create the instance, you can track the following events:



* Managing access groups by creating and deleting groups or adding and removing users
* Creating, updating, or deleting service IDs
* Creating, updating, or deleting API keys
* Creating, updating, or deleting access policies
* Creating, updating, or deleting trusted profiles
* Logging in to IBM Cloud by using an API key, authorization code, passcode, password, or an API key associated with a service ID
* Logging in to IBM Cloud by using a trusted profile. For more information, see [Monitoring login sessions for trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-monitor).



For more information, see [IAM events](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-at_events_iam).





 Catalog management events 

You can track the following events:



* Viewing or updating account settings
* Viewing or updating a catalog
* Listing all products in a catalog
* Listing all products in an account
* Creating, updating, viewing, or deleting a product
3000011 - Check whether API keys are not created in IAM during the initial setup of IAM users
3000015 - Check whether IAM users are attached to at least one access group
3000016 - Check whether IAM policies for users are attached only to groups or roles
3000030 - Check whether IAM policies for service IDs are attached only to groups or roles
3000017 - Check whether multifactor authentication (MFA) is enabled at the account level
3000021 - Check whether there are no more than IAM administrators configured per account
3000027 - Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
3000022 - Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)
3000028 - Check whether permissions for service ID creation are limited and configured in IAM settings for the account owner
3000029 - Check whether IAM-enabled services have no more than users with the IAM administrator role
3000031 - Check whether Identity and Access Management (IAM) is enabled with audit logging
3000032 - Check whether IAM-enabled services have no more than service IDs with the IAM administrator role
3000033 - Check whether Hyper Protect Crypto Services have at least users with the IAM manager role
3000038 - Check whether account has no more than service IDs with admin privileges
3000034 - Check whether Hyper Protect Crypto Services have at least service IDs with the IAM manager role
3000035 - Check whether account service access is managed only by IAM access groups
3000041 - Check whether Cloud Shell is enabled in account settings
3000101 - Check whether Cloud Object Storage is enabled with encryption
3000102 - Check whether Cloud Object Storage is enabled with customer-managed encryption and Bring Your Own Key (BYOK)
3000229 - Check whether Certificate Manager certificates that are generated by the service are renewed automatically before they expire
3000103 - Check whether Cloud Object Storage is accessible only through HTTPS
3000104 - Check whether Cloudant is accessible only through HTTPS
3000105 - Check whether Cloud Object Storage is accessible only by using private endpoints
RBAC, groups and IAM integration 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and consistently control access to all cloud resources in the IBM Cloud. Groups provide an isolated workspace in an IBM Cloud Activity Tracker instance for a user or group of users to have access to auditing events in a defined scope.

IAM can map a combination of groups and roles so that a user only has access to a specific set of auditing events and can take a defined set of actions within the product.

Groups provide additional security by only allowing users to see a subset of auditing events, as opposed to all auditing events that are generated in the account. For example, you could grant a group of users access to only see auditing events that are related to development services in the account.

In an Activity Tracker instance, you can define 1 or more groups.



* A group provides an isolated workspace for a user or group of users to have access to auditing events with a defined scope.
* An administrator of the service can configure multiple groups.



By default, when you grant a user access to work with the Activity Tracker service, the user can see all auditing events.



* A user can be a member of 1 or more groups.
* Users in a group have access to the data that is in scope of the group.



For a user to monitor data within the context of a group, you must grant the user a policy for the IBM Cloud Activity Tracker service. The policy specifies the group and the service permissions for the user so the user can work with the data in scope for that group.

You can grant any of the following IAM service roles:



* Standard-member: A standard-member role allows a user to monitor data through views, dashboards, screens, and alerts, and to manage resources such as dashboards, and alerts that are in scope for the group.
* Reader: A reader role allows a user to monitor data through views, dashboards, screens, and alerts that are in scope for the group.
* Manager: The manager role is an instance level role that grants administrative permissions. If you grant this role in a policy for a group, you are granting admin permissions over the instance to the users that belong to that group.
Monitoring login sessions 

You can review, manage, and revoke your user's active login sessions. You might want to end a session if a login-related credential, such as a refresh token or an IAM cookie is compromised. You can end the active login session that's associated with that credential.

If you are the account owner or assigned the administrator role for the IAM Identity service, you can update the login session settings for all user sessions in the account. For more information about configuring the settings, see [Managing user login sessions](https://cloud.ibm.com/docs/account?topic=account-iam-work-sessions).

You can review and end your own user sessions from your Profile page. In the IBM Cloud console, go to the Avatar icon ![Avatar icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/i-avatar-icon.svg) > Profile > Sessions.

You can also monitor logins for trusted profiles. For more information, see [Monitoring login sessions for trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-monitor).



 Reviewing user login sessions 

To review current login sessions, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. Select a name from the list.
3. Click View sessions in the User details section.







 Ending user login sessions 

When you end an active session, it logs out the user and requires credentials to be entered again. Complete the following steps to end a login session:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Users.
2. Select a name from the list.
3. Click View sessions in the User details section.
4. Identify the row with the session details that you want to end.
IAM and Activity Tracker actions by API method 

When you use IBM Cloud® Container Registry through the command line or console, the service calls application programming interface (API) methods to complete your requests.

You might need certain permissions to call these API methods, and you can track the requests that you make with an IBM Cloud Activity Tracker instance.

Review the following list of Cloud Identity and Access Management (IAM) actions and IBM Cloud Activity Tracker events that correspond to each API method in Container Registry.

For more information, see the following topics:



* [Container Registry API documentation](https://cloud.ibm.com/apidocs/container-registry)
* [Vulnerability Advisor for Container Registry API documentation](https://cloud.ibm.com/apidocs/container-registry/va)
* [Auditing events for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-at_events)
* [Managing IAM access for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam)





 Container Registry 

Review the following account API methods, their required actions in IBM Cloud IAM, and the events that are sent to IBM Cloud Activity Tracker for Container Registry.



 Authorization API methods 



Table 1. Auth

 Action Method IAM ACTION AT ACTION 

 Get authorization options for the targeted account. GET /api/v1/auth container-registry.auth.get container-registry.auth.get 
 Update authorization options for the targeted account. PATCH /api/v1/auth container-registry.auth.set container-registry.auth.set 







 Image API methods 



Table 2. Images

 Action Method IAM ACTION AT ACTION 

 List images. GET /api/v1/images container-registry.image.list container-registry.image.list 
 Delete more than one image. POST /api/v1/images/bulkdelete container-registry.image.delete container-registry.image.bulkdelete 
 List images by digest. POST /api/v1/images/digests container-registry.image.list container-registry.image.list
Granting administration permissions to a user or service ID 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud. Complete the following steps to grant a user or service ID administration permissions to work with the IBM Cloud Activity Tracker service:

For example, as an administrator of the service, you can provison and remove instances of the service, grant other users permissions to work with the service, archive logs to an IBM Cloud Object Storage (COS) instance, and more. [Learn more](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-iamiam).



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Activity Tracker service. Contact the account administrator. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an access group 

Complete the following steps to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.



You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_policy_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]





 Step 2. Add permissions to manage events 

After you set up your group, you can assign a common access policy to the group.
Managing IAM access for IBM Cloud Metrics Routing 

Access to IBM Cloud® Metrics Routing configuration resources for users and applications in your account is controlled by IBM Cloud® Identity and Access Management (IAM). For example, every user that accesses the IBM Cloud Metrics Routing service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to IBM Cloud Metrics Routing.

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by the IBM Cloud Metrics Routing as operations that are allowed to be performed on the service. Each IAM action is mapped to an IAM platform role that you can assign to a user.

IBM Cloud Metrics Routing is a platform service. Therefore, when you assign a policy to a user to work with IBM Cloud Metrics Routing, you are assigning IAM platform roles.



 IAM actions 

The IBM Cloud Metrics Routing service provides the following IAM actions:



 Targets 

The following table lists the IAM actions that are generated when you manage targets:



Table 1. IAM actions for managing targets

 Action Description 

 metrics-router.target.create Create a new Monitoring target. 
 metrics-router.target.list List all targets defined under a region. 
 metrics-router.target.read Retrieve a target and its details by specifying the ID of the target. 
 metrics-router.target.update Update a target details by specifying the ID of the target. 
 metrics-router.target.delete Delete a target by specifying the ID of the target. 







 Routes 

The following table lists the IAM actions that are generated when you manage routes:



Table 2. IAM actions for managing routes

 Action Description 

 metrics-router.route.create Create a route with rules that define how to route metrics data to targets. 
 metrics-router.route.list List routes. 
 metrics-router.route.read Retrieve a route and its details by specifying the ID of the route.
IAM and Activity Tracker action by API method 

When you use IBM Cloud® Kubernetes Service such as through the command line or console, the service calls application programming interface (API) methods to complete your requests. In IBM Cloud IAM, each API operation is associated with an IAM action that the user must have an access role to use the API operation. You can keep track of the requests that you make with an IBM Cloud Activity Tracker instance.

Review the following list of IBM Cloud Identity and Access Management (IAM) actions and IBM Cloud Activity Tracker events that correspond to each API method in IBM Cloud Kubernetes Service.

For more information, see the following topics.



* [IBM Cloud Kubernetes Service API docs](https://containers.cloud.ibm.com/global/swagger-global-api//)
* [User access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_reference)
* [IBM Cloud Activity Tracker events](https://cloud.ibm.com/docs/containers?topic=containers-at_events).





 Account 

Review the following account API methods, their corresponding actions in IBM Cloud IAM, and the events that are sent to IBM Cloud Activity Tracker for IBM Cloud Kubernetes Service.



Account API methods, IAM actions, and Activity Tracker events.

 API Method Description IAM action for the API Event sent to Activity Tracker 

 DELETE/v1/credentials Remove IBM Cloud infrastructure account credentials from your IBM Cloud Kubernetes Service account. containers-kubernetes.cluster.create containers-kubernetes.account.delete 
 GET/v1/addons List available add-ons that you can enable in a cluster. N/A N/A 
 GET/v1/config List configuration values for your IBM Cloud account. containers-kubernetes.cluster.read N/A 
 GET/v1/credentials View the IBM Cloud infrastructure account credentials that are set for your IBM Cloud Kubernetes Service account. containers-kubernetes.cluster.read N/A
Granting user permissions to a user or service ID 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud. Complete the following steps to grant a user or service ID the minimum permissions to work with the IBM Cloud Activity Tracker service:



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Activity Tracker service. Contact the account administrator. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an access group 

Complete the following steps to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.



You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]





 Step 2. Add permissions to view events 

After you set up your group, you can assign a common access policy to the group.

Any policy that you set for an access group applies to all entities, users and service IDs, within the group.

You can assign the policy by using the UI or through the command line.
In the IBM Cloud console, go to Manage > Access (IAM), and select your name on the Users page. Then, depending on the access you're looking for, open the different tabs:



* To determine what access you have through the access groups you are assigned, select Access and view the Access groups table.
* To see IAM access policies that are assigned to you, select Access and view the Access policies table.







 What actions are mapped to each IAM role? 

When you invite a new user or assign a user IAM access, you can view the actions that are associated with each role. Click the numbers listed next to each role to view a list of all actions that are mapped to a specific role. By reviewing the mapping of actions to roles, you can confidently know what access you're assigning.





 How do I request access to a resource? 

The account owner can update your access to any resource in the account, or you can contact any user who is assigned the administrator role on the service or service instance.





 How do I find the IAM ID for a user or myself? 

In the IBM Cloud console, go to Manage > Access (IAM), and select Users. Then, select your name or another user's name from the list. You can find the IAM ID for that user along with their email address on the User details page.





 How do I identify platform management roles and service access roles for a user? 



1. In the IBM Cloud® console, click Manage > Access (IAM), and then select Users.
2. Select your name or another user's name from the list.
3. Click Access to view the permissions that are associated with the user.



The owner tag is listed for the owner of the account. This user is assigned the administrator role on the service or service instance.





 How do I find and manage API Keys for a user or myself? 

In the IBM Cloud console, go to Manage > Access (IAM) > API keys to view and manage API keys that you have access to.