vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"eu-de":"https://eu-de.schematics.cloud.ibm.com"
}
}
}

Example Provider Block

provider "ibm" {

endpoints_file_path= "endpoints.json"
}
* Are sensitive values in the state file encrypted?

Schematics encrypts the Terraform state file when stored and also in transit using TLS. Terraform does not separately encrypt senstive values. For more information, see [sensitive-data](https://developer.hashicorp.com/terraform/language/state/sensitive-data) in state file.
* Why do workspace variables defined by using CLI throw 400 errors?

The Schematics workspace list variables store value should always be a HCL string. The value field must contain escaped string for the variable store for the list, map, or complex variable. For more information, see [Providing values to Schematics for the declared variables](https://cloud.ibm.com/docs/schematics?topic=schematics-create-tf-configdeclare-variable).
* Can I update the Terraform version (TF_VERSION) using a JSON file?

Currently, the workaround to updating the TF_VERSION is to pass the TF_VERSION while updating the variable store. Schematics will auto detect what is specified in the Terraform version block in the TF files. This is the default behavior.

For more information, see [setting and changing the version](https://cloud.ibm.com/docs/schematics?topic=schematics-migrating-terraform-versionterraform-version-upgrade1x).
* Can start with a new Terraform state file on each job run?

No, you need to only create new workspace. For more information, see [Workspace job execution](https://cloud.ibm.com/docs/schematics?topic=schematics-job-downloadwks-job-execution).
* Can I import an existing Terraform state file?
* It is your responsibility to keep your desktop secure.
* It is your responsibility to encrypt the admin private key and keep it secure.









 Step 2: Configuring the audit log 

Complete the following to configure Log Analysis to trace audit logs:



1. Create a LogDNA service instance



* Create a logging service in the production environment in the us-south region.
* Get the ingestion key.



For more information about the LogDNA service, see [Configuring a Logging agent for Linux Ubuntu or Debian](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_agent_linux).
2. Monitor the Hyper Protect Virtual Servers instance via the LogDNA instance.



* Log in to the Hyper Protect Virtual Servers instance (either staging or production in any region).
* Configure the LogDNA agent on the Hyper Protect Virtual Servers instance



apt-get update
apt-get install -y git npm curl wget
npm install -g n
n lts
PATH="$PATH"
node -v

git clone https://github.com/logdna/logdna-agent.git
cd logdna-agent && npm install
node index.js -k <ingestion-key>
node index.js -d /data/log
node index.js -t logging
node index.js -s LOGDNA_APIHOST=api.us-south.logging.cloud.ibm.com
node index.js -s LOGDNA_LOGHOST=logs.us-south.logging.cloud.ibm.com
node index.js

For more information about how to set up monitoring in Hyper Protect Virtual Servers, see [Monitoring logs](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-monitoring).
3. Check for logs of the configuration status from the LogDNA dashboard.

The following actions are traced by the audit log:
SA-10 (c) <br><br> * Check whether DevSecOps Toolchain signs build artifacts to attest their provenance<br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 
 SA-10 (d) <br><br> * Check whether DevSecOps Toolchain deployment has approved change documentation including security impact analysis<br><br><br> 
 SA-10 (e) <br><br> * Check whether DevSecOps Toolchain scans build artifacts to identify vulnerabilities<br> * Check whether DevSecOps Toolchain verifies source code branch protection rules to enforce security policies<br> * Check whether DevSecOps Toolchain validates code against Center for Internet Security (CIS) Docker benchmarks to ensure container runtimes are configured securely<br> * Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts<br> * Check whether DevSecOps Toolchain scans source code and their dependencies to identify vulnerabilities<br> * Check whether DevSecOps Toolchain source code contains no secrets<br> * Check whether DevSecOps Toolchain passes static code scan to identify vulnerabilities in source code<br><br><br> 







 NIST supplemental guidance 

This control also applies to organizations conducting internal information systems development and integration. Organizations consider the quality and completeness of the configuration management activities conducted by developers as evidence of applying effective security safeguards. Safeguards include, for example, protecting from unauthorized modification or destruction, the master copies of all material used to generate security-relevant portions of the system hardware, software, and firmware. Maintaining the integrity of changes to the information system, information system component, or information system service requires configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes.
Select the encryption type, either customer-managed encryption or IBM-managed encryption (see [Table 2](https://cloud.ibm.com/docs/vpc?topic=vpc-create-ifvencrypt-custom-images)).
5. On the side panel, click Create custom image.







 Select the encryption type 

To complete your image from volume, select either IBM-managed encryption or customer-managed encryption. Table 2 describes these options as they appear in the UI.



Table 2. Encryption types

 Field Value 

 Encryption The default selection is No encryption. If you have not encrypted your image by using QEMU, use the default value, No encryption. If you are importing an image that you encrypted by using QEMU and your own passphrase, select the key management service where your customer root key (CRK) that protects your passphrase is stored. Select either Key Protect or Hyper Protect Crypto Services. 
 Encryption service instance For an encrypted image, select the specific instance of the key management service where your CRK that wraps your encryption passphrase is stored. 
 Key name Select the customer root key (CRK) that you used to wrap your encryption passphrase. 
 Key ID Shows the key ID that is associated with the data encryption key that you selected. 



For more information, see [Setting up your key management service and keys](https://cloud.ibm.com/docs/vpc?topic=vpc-create-encrypted-custom-imagekms-prereqs).





 View and use your image from volume 

When the image from a volume is created, it appears in the list of custom images.



1. In the [IBM Cloud console](https://cloud.ibm.com/login), go to the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Images.
2.
Note that the Image Key Synchronizer add-on also supports private keys that are first [wrapped by a root key that is stored in an IBM® Key Protect instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption).

Before you begin



1. Download and install the CLI clients for the following open source tools:



* [OpenSSL](https://www.openssl.org/source/), to generate an RSA key pair.
* [Docker Engine CLI](https://www.docker.com/products/container-runtime//download), to locally pull images from an image registry.
* [Skopeo](https://github.com/containers/skopeo/blob/main/install.md), to encrypt OCI container images.



2. [Access your Red Hat OpenShift cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-access_cluster). Note that encrypted images are supported only for Red Hat OpenShift version 4.5 and later.
3. Optional: When you create a public and private key pair for the image encryption, you can provide the private key directly in a secret, or first wrap the private key by using a Key Protect root key or a key management service (KMS). To prepare to wrap the private key:



1. [Install the Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli).
2. [Create a Key Protect service instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provisionprovision).
3. [Create a Key Protect root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keyscreate-root-keys).
4. Get the following values for your Key Protect instance:
: (Optional) Each image is listed in the format: repository@digest

--json
: (Optional) Outputs the list in JSON format.

--restrict RESTRICTION
: (Optional) Limit the output to display only images in the specified namespace or repository.

--include-ibm
: (Optional) Includes IBM-provided public images in the output. By default only private images are listed. You can view IBM-provided images in the global registry only.

--no-va
: (Optional) Excludes the security status (Vulnerability Advisor) results from the output. If you don't need the security status results as part of your ibmcloud cr image-digests output, you can use this option to increase performance.

--va
: (Optional) Includes the Vulnerability Advisor security status results in the output. Use this option to ensure that you are ready for [IBM Cloud Container Registry CLI plug-in version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_lists). You can use the --va option with the --restrict option to receive just the information that you require.





 Example 

Display all the images in the birds namespace, including untagged images, in the format repository@digest.

ibmcloud cr image-digests --restrict birds --quiet







 ibmcloud cr image-inspect 

Displays details about a specific image. You can reference the image that you want to inspect either by [digest](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_digest), repository@digest, or by [tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_tag),repository:tag.

ibmcloud cr image-inspect [--format FORMAT] IMAGE [IMAGE...]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).
ibmcloud cr image-list [--format FORMAT] [--quiet | -q ] [--restrict RESTRICTION] [--include-ibm] [--no-trunc] [--show-type] [--no-va] [--va]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

--format FORMAT
: (Optional) Format the output elements by using a Go template. For more information, see [Formatting and filtering the Container Registry CLI output](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_cli_list).

--quiet, -q
: (Optional) Each image is listed in the format: repository:tag

--restrict RESTRICTION
: (Optional) Limit the output to display only images in the specified namespace or repository.

--include-ibm
: (Optional) Includes IBM-provided public images in the output. By default only private images are listed. You can view IBM-provided images in the global registry only.

--no-trunc
: (Optional) Returns the image digest in its long format.

--show-type
: (Optional) Displays the image manifest type.

--no-va
: (Optional) Excludes the security status (Vulnerability Advisor) results from the output. If you don't need the security status results as part of your ibmcloud cr image-list output, you can use this option to increase performance.

--va
: (Optional) Includes the Vulnerability Advisor security status results in the output. Use this option to ensure that you are ready for [IBM Cloud Container Registry CLI plug-in version 1.0.0](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_lists). You can use the --va option with the --restrict option to receive just the information that you require.





 Example
Operator Lifecycle Manager 0.16.1-IKS-14 0.16.1-IKS-15 Updated image for [CVE-2021-42374](https://nvd.nist.gov/vuln/detail/CVE-2021-42374), [CVE-2021-42375](https://nvd.nist.gov/vuln/detail/CVE-2021-42375), [CVE-2021-42378](https://nvd.nist.gov/vuln/detail/CVE-2021-42378), [CVE-2021-42379](https://nvd.nist.gov/vuln/detail/CVE-2021-42379), [CVE-2021-42380](https://nvd.nist.gov/vuln/detail/CVE-2021-42380), [CVE-2021-42381](https://nvd.nist.gov/vuln/detail/CVE-2021-42381), [CVE-2021-42382](https://nvd.nist.gov/vuln/detail/CVE-2021-42382), [CVE-2021-42383](https://nvd.nist.gov/vuln/detail/CVE-2021-42383), [CVE-2021-42384](https://nvd.nist.gov/vuln/detail/CVE-2021-42384), [CVE-2021-42385](https://nvd.nist.gov/vuln/detail/CVE-2021-42385) and [CVE-2021-42386](https://nvd.nist.gov/vuln/detail/CVE-2021-42386). 
 Portieris admission controller v0.12.0 v0.12.1 See the [Portieris admission controller release notes](https://github.com/IBM/portieris/releases/tag/v0.12.1).
Gateway-enabled cluster controller 1444 1510 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712). 
 GPU device plug-in and installer a9461a8 eb817b2 Updated to use Go version 1.16.7. 
 IBM Cloud RBAC Operator 945df65 e3cb629 Updated to use Go version 1.16.7. 
 IBM Cloud File Storage for Classic plug-in and monitor 398 400 Updated to use Go version 1.16.7. Updated universal base image (UBI) to the latest 8.4-208 version to resolve CVEs. 
 Kubernetes API server auditing configuration N/A N/A Updated to support verbose[Kubernetes API server auditing](https://cloud.ibm.com/docs/containers?topic=containers-health-auditaudit-api-server). 
 Kubernetes NodeLocal DNS cache N/A N/A Increased memory resource requests from 5Mi to 8Mi to better align with normal resource utilization. 
 Load balancer and load balancer monitor for IBM Cloud Provider 1510 1550 Updated image for [CVE-2021-3711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3711) and [CVE-2021-3712](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3712).
GPU device plug-in and installer c1c6dd3 19bf25c Updated image for [CVE-2021-3449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449), [CVE-2021-3450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450), and [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305). 
 IBM Cloud Controller Manager v1.19.9-1 v1.19.10-1 Updated to support the Kubernetes 1.19.10 release and to use Go version 1.15.10. 
 IBM Cloud File Storage for Classic plug-in and monitor 389 390 Updated to use Go version 1.15.9 and for [CVE-2020-28851](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28851) and [CVE-2021-3121](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121). 
 IBM Cloud RBAC Operator 3dd6bbc b6a694b Updated image for [CVE-2021-3449](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449) and [CVE-2021-3450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450). 
 Key Management Service provider v2.2.5 v2.3.3 Updated to use Go version 1.15.11.
IBM Calico extension 1213 1257 Updated universal base image (UBI) to resolve: [CVE-2022-1304](https://nvd.nist.gov/vuln/detail/cve-2022-1304), [CVE-2016-3709](https://nvd.nist.gov/vuln/detail/CVE-2016-3709), [CVE-2022-42898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898). 
 IBM Cloud Block Storage driver and plug-in v2.3.3 v2.3.4 Update Go to version 1.18.8 and updated universal base image (UBI) to resolve CVEs. 
 IBM Cloud File Storage for Classic plug-in and monitor 420 421 Updated universal base image (UBI) to resolve [CVE-2022-42898](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898). Updated Go to version 1.18.8 
 Key Management Service provider v2.5.11 v2.5.12 Updated Go dependencies. 
 Load balancer and load balancer monitor for IBM Cloud Provider 2110 2325 Update Go to version 1.19.1 and update dependencies. 
 OpenVPN Operator image v1.4.11 v1.4.13 Updated the ansible operator base image to v1.25.2 to resolve CVEs. 
 Red Hat OpenShift on IBM Cloud Control Plane Operator v4.8.0-20221104 v4.8.0-20221205 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.8.0+20221205). 
 Red Hat OpenShift on IBM Cloud.
Security and Compliance Center account 

The Security and Compliance Center and its dependencies are deployed in the root account of the enterprise to allow the Security and Compliance Center to scan all of the enterprise.

The contents of this account are provisioned through infrastructure as code from the central administration account.

Zoom

![root account diagram. All of the information is conveyed in the surrounding text.](https://cloud.ibm.com/docs-content/v1/content/f18e964848e0337fedc42d43e246fa446f4b9646/enterprise-account-architecture/images/root.svg)

Figure 1. Enterprise root account

Scopes can be configured such that different profiles are used for the administration account group, each BU, or even each workload account if needed. The Security and Compliance Center should not be configured with scopes smaller than an account to ensure that controls related to account-level settings are properly covered.

To ensure security compliance enterprise wide, it is recommended that the Security and Compliance Center is configured to scan the entire enterprise, including accounts in the administration account group. Where possible, configure scopes at the account group level to ensure that new subaccounts are automatically covered by the Security and Compliance Center scans.

A significant number of users might need to view scan results. As these users need access to the enterprise root account, set up one or more access groups for viewing scan results. Alternatively, reports can be exported and shared outside of IBM Cloud.



Table 1. Components

 Component Quantity Description 

 Security and Compliance Center 1 A single instance of Security and Compliance Center that is configured to scan the entire enterprise 
 Cloud Object Storage 1 Used to store security and compliance center results 
 Event Notifications 1 Used to provide notifications for select Security and Compliance Center alerts 
 Trusted Profile 1 Used to authorize the central administration account to deploy the other components in this account 
 Business unit access groups n (1+ per BU) Used to authorize users from a business unit to view scan results 





 Rationale for centralizing the Security and Compliance Center 

The Security and Compliance Center is most valuable when all relevant resources are scanned with an appropriate profile.
* The IBM Cloud network ports are protected with firewalls, which serve as intrusion detection (IDS) and intrusion prevention (IPS) agents. Details regarding on IBM Cloud intrusion detection management is IBM Confidential information and covered under IBM Cloud SOC2 compliance (see compliance section below).
* All IBM TRIRIGA SaaS and TRIRIGA Application Suite Managed Service environments are configured for Anti-Malware (Anti-Virus) protection and Endpoint Detection and Response (EDR) technology with associated telemetry.



Status and alerts are monitored continuously.

IBM Trust Center - Enterprise IT Security and Trust: [https://www.ibm.com/trust/security](https://www.ibm.com/trust/security)





 Customer Access 



* IBM TRIRIGA Application Suite Managed Service are public internet based offerings. Customers connect to IBM Cloud using HTTPS encryption over the internet
* There is no direct link, peering or private cloud option available for the IBM TRIRIGA Application Suite Managed Service offering
* Every IBM TRIRIGA Application Suite Managed Service customer environment is delivered in a single tenant instance of the application, running on the Openshift platform.
* All IBM TRIRIGA Application Suite Managed Service customers use HTTPS (SSL) encryption (256 bit) at the browser level to access IBM hosted applications. Connections are SHA-2 and TLS v1.2 compatible
* IBM obtains and implements externally facing SSL certificates from a trusted Certificate Authority (CA)
* All databases use native AES-256 encryption (data is encrypted at rest)



Customers will not have direct access to the operating system, file system or web application server. Changes need to be requested through a Support ticket.



* Customers will not have DBAdmin or update access to any database. Updates need to be requested through a support ticket.







 Penetration and Vulnerability Testing 



* IBM’s Product Transformation Center (PTC) conducts penetration testing on IBM TRIRIGA Application Suite Managed Service offering annually.
* IBM performs external and internal vulnerability scanning and subsequent remediation in all IBM TRIRIGA Application Suite Managed Service environments on a quarterly basis per IBM IT Security Standards (ITSS). This includes Operating System, Middleware, Application and TCP/IP vulnerability scanning.
If you generate a checksum locally for your image before importing it, you can compare the two checksums to ensure that they are identical. For more information, see [Validating a custom image after importing (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-imagesvalidate-custom).

UI enhancements
: Default boot volume names are now appended with a millisecond timestamp.





 11 December 2020 

VPN logging and auditing
: The ability to monitor and audit your VPNs has been added to VPN for VPC. For more information, see [Using IBM Log Analysis to view VPN logs](https://cloud.ibm.com/docs/vpc?topic=vpc-using-log-analysis-to-view-vpn-logs).





 01 December 2020 

New SDK
: The [Node SDK](https://cloud.ibm.com/apidocs/vpc?code=node) is now generally available.







 November 2020 



 20 November 2020 

Support for ingress routing
: Ingress routing is included as part of custom routing tables, released on 30 October 2020. Ingress routing enables you to customize routes on incoming traffic to a VPC from traffic sources external to the VPC's availability zone (IBM Cloud Direct Link, IBM Cloud Transit Gateway, or another availability zone in the same VPC). For more information, see [About routing tables and routes](https://cloud.ibm.com/docs/vpc?topic=vpc-about-custom-routes).

Support for datapath log forwarding with Log Analysis
: Datapath log forwarding with IBM Log Analysis is now available for IBM Cloud Application Load Balancer for VPC. Data and health check logs are valuable for debugging, analysis, and maintenance purposes. With the datapath logging feature enabled, your load balancer forwards these logs to your account's IBM Log Analysis dashboard.