vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Managing access for federated users by using trusted profiles 

This tutorial guides you through the steps to automatically grant federated users access to your account based on external identity provider specifications. By completing this tutorial, you learn how to create a trusted profile, establish trust with federated users based on attributes that are defined in your corporate user directory, and define a policy to assign access to resources.

By using trusted profiles, you can establish a flexible, secure way for federated users to access the IBM Cloud® resources they need to do their job. All federated users that share certain attributes that are defined in your corporate user directory are mapped to a common profile and can share access to IBM Cloud resources. This common identity makes it possible to give the members of your organization that share access requirements automatic access to resources one time, rather than having to add each user to an account and then grant them access directly or by using access groups.

Let's say that Marla is the manager of a dev team at an airline company. The team is planning to run a new chatbot app for their HR website on an IBM Cloud Kubernetes Service cluster. Marla wants the team to have access to IAM-enabled services in test environments so developers can do their daily work. Marla also wants to make sure that the team isn't unintentionally doing operations work in production environments. In this case, Marla would create two trusted profiles: one called Chatbot Dev (test) and one called Chatbot Ops (prod). Marla manages many developers and it usually takes significant time out of her day to assign access to team members individually. With trusted profiles, Marla can automatically grant federated users access to the resources they need without having to invite them to an account and assign access one at a time. This tutorial uses fictitious identity provider attributes that might be different from your corporate user directory.



 Before you begin 



* Make sure you're assigned the following access:



* Administrator role in the account to create a trusted profile
* Administrator role on the specific resources to which you are assigning access



* Enable authentication from an external identity provider.
Using the distributed Akamai platform, you get unparalleled scalability and resiliency with thousands of servers in over 50 countries. The Akamai Intelligent Platform stands between your infrastructure and your users, and it acts as first level of defense for sudden surges in traffic. Akamai Intelligent Platform also is a reverse proxy that listens and responds to requests on ports 80 and 443 only, which means that traffic on other ports is dropped at the Edge without being forwarded to your infrastructure.





 How do I use the IBM Cloud console to give other users permission to create or manage a CDN? 

The account's Master user can provide other users with permission to create and manage a CDN.

From the IBM Cloud console main page, follow these steps to edit permissions:



* Select the Manage tab.
* Select Access (IAM).
* Click the Users tab in the navigation pane.
* Click the wanted User.
* Select the Classic infrastructure tab.
* From the Permissions tab, expand the Services category.
* Select Manage CDN Account.
* Click the Save button.



From the legacy console main page, follow these steps to edit permissions:



* Select the Account tab.
* Select Users > User List.
* Click the wanted Username.
* Select the Portal Permissions tab.
* Select the Services tab.
* Select Manage CDN Account.
* Click the Edit Portal Permissions button.







 Why is the Create button not shown or disabled on the [Content Delivery Network](https://cloud.ibm.com/catalog/infrastructure/cdn-powered-by-akamai) page? 

If you are the account's Master user, you must upgrade the account for the Create button to appear or be enabled on this page. From the IBM Cloud console page, follow these steps as the account's Master user:



* Open the navigation pane by clicking the triple bar icon in the upper left of the web page.
* Select Classic Infrastructure.
* Click the Upgrade Account button and follow the instructions.
AC-2 (1) - Automated System Account Management 



  Control requirements 

AC-2 (1) - 0
:   The organization employs automated mechanisms to support the management of information system accounts.





  Implementation guidance 

See the resources that follow to learn more about how to implement this control.



*  [Audit logging of application provider events and SIEM](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit-provider)
*  [Audit logging of IBM Cloud events](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-audit)
*  [IBM Cloud account setup](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-setup)







  NIST supplemental guidance 

The use of automated mechanisms can include, for example: using email or text messaging to automatically notify account managers when users are terminated or transferred; using the information system to monitor account usage; and using telephonic notification to report atypical system account usage.
7. Ensure all operator actions are executed through a bastion host 

Requirement: Ensure all interactive operator actions can only be run through a bastion host in your dedicated edge or management plane which is properly isolated from your workload plane. Enable recording of bastion sessions for auditing.

Purpose & value: A bastion host is a server in your edge or management plane that allows a secure connection to other resources in your edge, management, and workload planes. Using a bastion host for executing operator actions minimizes the chances of penetration from an external source. Session logging allows tracking of all activities that are performed through the bastion host in the event a potential security issue must be investigated.

Implementation guidance:



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-bastion)



Most Relevant Controls:



Table 7. Related controls for bastion host

 Family Control 

 Access Control (AC) [AC-6 (9) Least Privilege | Auditing Use of Privileged Functions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6.9) <br>[AC-17 Remote Access](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-17) 
 Audit and Accountability (AU) [AU-14 Session Audit](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-14) 
 Identification and Authentication (IA) [IA-2 (1) Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2.1) 







 8. Capture audit events and forward to a SIEM
[Learn more](https://cloud.ibm.com/docs/atracker?topic=atracker-iam).

Your user ID needs account management permissions to manage Activity Tracker Event Routing configurations in the account.

Users must have the following [IAM roles](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources) to manage the Activity Tracker Event Routing account settings.



Table 1. Required IAM roles to manage the Activity Tracker Event Routing account settings.

 Role Minimum scope Minimum required roles Action 

 atracker.setting.get Account Administrator <br>Editor <br>Viewer <br>Operator Get setting information 
 atracker.setting.update Account Administrator Update settings 



Users must have the following [IBM Cloud® Activity Tracker Event Routing IAM roles](https://cloud.ibm.com/docs/account?topic=account-assign-access-resources) to work with targets. Users with regional IAM scope will be limited to access targets in their authorized region.



Table 2. Required IAM roles

 Role Minimum scope Minimum required roles Action 

 atracker.target.read Region Administrator <br>Editor <br>Viewer <br>Operator Read (view) information about a target 
 atracker.target.create Region Administrator <br>Editor Create a target 
 atracker.target.update Region Administrator <br>Editor Update a target 
 atracker.target.delete Region Administrator <br>Editor Delete a target 
 atracker.target.list Account Administrator <br>Editor <br>Viewer <br>Operator List all targets 



Choose one of the following options to grant your user permissions:



* [Using the console to assign access](https://cloud.ibm.com/docs/account?topic=account-account-servicesconsole-acct-mgmt)
* [Using the CLI to assign access](https://cloud.ibm.com/docs/account?topic=account-account-servicesusing-the-cli-to-assign-access)
CIS CLI reference 

IBM Cloud® Internet Services has several families of commands that are available from the command line interface (CLI). Find the full set of commands for IBM Cloud Internet Services (CIS) within each set, including Create, Delete, Update, and so on.



 Before you begin 



1. Download the [IBM CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-startedgetting-started).
2. Log in to IBM Cloud.

ibmcloud login -a
3. Install the CIS CLI plug-in.

ibmcloud plugin install cis
4. Set the context instance.

ibmcloud cis instance-set <instance-name>



To see a list of plug-ins and which versions are installed, run this command.

ibmcloud plugin list

The list returns whether the CLI has any updates available. Run the following command to update the CIS CLI plug-in.

ibmcloud plugin update cis

To learn about installing and configuring the IBM Cloud CLI, visit [Getting started with the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).





 Access application 



 ibmcloud cis access-app-create 

Create an access application for a given DNS domain (Enterprise plan only).

ibmcloud cis access-app-create DNS_DOMAIN_ID --name NAME --domain DOMAIN [--session-duration SESSION_DURATION] [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Create an access application for domain 31984fea73a15b45779fa0df4ef62f9b.
[https://aws.amazon.com/compliance/soc-faqs/](https://aws.amazon.com/compliance/soc-faqs/)





 Industry and Regulatory Compliance 

AWS Security Controls:

[https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)

IBM Maximo Application Suite Dedicated environments are ISO-27001 certified. This certificate is publicly available and can be viewed / downloaded via the link below.

ISO-27001:

[https://www.ibm.com/downloads/cas/EEO0NVLK](https://www.ibm.com/downloads/cas/EEO0NVLK)

Details regarding specific Industry and Regulatory compliance can be found in the IBM Enterprise & Technology Security Community (this is accessible to IBMers only).

All IBM Maximo Application Suite Dedicated servers are hardened using Center for Internet Security (CIS) Benchmarks. For further details, please visit: [https://www.cisecurity.org/cis-benchmarks/](https://www.cisecurity.org/cis-benchmarks/)

An IBM SaaS-wide central health checking service is used to automatically maintain baseline (hardened) configurations of systems against standard IBM policy.

IBM Maximo development follow IBM Secure Engineering practices for application development. IBM Secure Engineering is outlined publicly at the following link: [https://www.ibm.com/security/secure-engineering/index.html](https://www.ibm.com/security/secure-engineering/index.html)

IBM Maximo developers are required to follow secure coding practices, and complete education in the SANS top 25 and OWASP top 10. In addition, static (source) and web application scanning using IBM (HCL) AppScan product suite must be performed. These products check for SANS Top 25 and OWASP top 10 issues. Any vulnerabilities found by these scans must be resolved before product release or submitted through IBM's Product Security Incident Response Team (PSIRT) process for resolution via defect (IBM Authorized Program Analysis Report or APAR).
Check whether DevSecOps Toolchain passes dynamic code scan to identify vulnerabilities in deployed artifacts CM-3(2)(0), CM-4(0), CM-4(1)(0), CM-7(1)(a), CM-7(b), RA-5(1)(0), RA-5(2)(0), RA-5(3)(0), RA-5(a), RA-5(b), RA-5(c), RA-5(d), SA-10(e), SA-15(a), SA-3(a), SA-3(d), SA-8(0), SI-10(0), SI-2(2)(0), SI-2(a), SI-2(b), SI-2(c), and SI-2(d) Rule was added 
 Check whether Secrets Manager arbitrary secrets are rotated at least every # days IA-5(g) Rule was added 
 Check whether Secrets Manager user credentials are rotated at least every # days IA-5(g) Rule was added 
 Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s) RA-5(b) and RA-5(3)(0) Rule was added 
 Check whether a security group other than the default for Virtual Private Cloud is attached to all endpoints CM-1 Rule was removed 
 Check whether Container Registry Vulnerability Advisor scans for critical or high vulnerabilities in the system at least every # day(s) CM-8(3)(a) Rule was removed 







 Version 1.1.0 

Version 1.1.0 of the IBM Cloud for Financial Services profile has been updated to include all 565 controls that have been identified as required to ensure that you are compliant with the IBM Cloud for Financial Services reference architecture. As part of that update we've introduced the concept of "Manual assessments". When results are returned, you will see a new status: user_evaluation_required - this indicates that the control must be evaluated manually by your organization as the control check is either not yet or cannot be automated.

Additionally, the phrasing of 42 controls was updated for grammar purposes.
Manager As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources. 







 Transit Gateway 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use transit.gateway for the service name.

Platform roles

Actions



Table 154. Platform roles - Transit Gateway
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users. 
 Editor As an editor, you can perform all platform actions except for managing the account and assigning access policies. 
 Operator As an operator, you can perform platform actions required to configure and operate service instances, such as viewing a service's dashboard. 
 Viewer As a viewer, you can view service instances, but you can't modify them. 







 IBM Cloud Platform User Management Service 

Review the available platform and service roles and the actions mapped to each to help you assign access. If you're using the CLI or API to assign access, use user-management for the service name.

Platform roles

Actions



Table 155. Platform roles - IBM Cloud Platform User Management Service
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.

 Role Description 

 Administrator As an administrator, you can view, invite, and update users. You can also view and update user profile settings. 
 Editor As an editor, you can view, invite, and update users. You can also view and update profile settings. 
 Operator As an operator, you can view users in the account and view profile settings. 
 Viewer As a viewer, you can view users in the account and view profile settings. 







 VMware Solutions on VPC
* UI
* API







 Managing metrics 

After you set up your Hyper Protect Crypto Services instance, you can manage Monitoring metrics by using the service API.



 Managing metrics settings 

Metrics for Hyper Protect Crypto Services instances are an extra policy, with which, you can receive the operational metrics for your Hyper Protect Crypto Services instance. When you enable this policy, Monitoring can be used to monitor any operations that are performed on the resources in your Hyper Protect Crypto Services instance.

Before you enable operational metrics for your Hyper Protect Crypto Services instance, keep in mind the following considerations:



* When you enable metrics for your Hyper Protect Crypto Services instance, metrics are only reported after the time that the policy is enabled.

Once your metrics policy is enabled, you will see operational metrics for all API requests that occur in your instance after the policy is activated. You will not be able to view any metrics prior to the time that the policy is enabled.
* You need to provision a Monitoring instance first in order to see the metrics.

You need to [provision a Monitoring instance](https://cloud.ibm.com/docs/Monitoring-with-Sysdig?topic=Monitoring-with-Sysdig-provision) that is located in the same region as the Hyper Protect Crypto Services instance that you want to receive operational metrics for. After you provision the Monitoring instance, you need to [enable platform metrics](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-operational-metricsconfigure-monitoring).





 Enabling metrics for your Hyper Protect Crypto Services instance with the console 

After you create a Hyper Protect Crypto Services instance, provision a Monitoring instance, and enable platform metrics, complete the following steps to enable a metrics policy:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4.
Managing origin certificates 

Origin certificates are free TLS certificates issued by IBM Cloud® Internet Services that encrypt traffic between your origin server and your users. Order free TLS certificates to install on your origin server.

CIS origin certificates are only valid for use in CIS.



 Ordering an origin certificate 

To order an origin certificate, provide a Certificate Signing Request (CSR) or select a private key type for CIS to generate a key and CSR.

Specify up to 100 hostnames (including wildcards) on your origin that the certificate protects. Wildcards only provide one level of coverage. Use multiple wildcards on the same certificate for broader coverage (for example, .yourdomain.com and .yoursubdomain.yourdomain.com). CIS Origin Certificates do not permit IP addresses.

Specify the expiration. The default certificate expiration is 15 years; the shortest expiration is seven days.

The private key is only available immediately after ordering a certificate if the private key and CSR were generated by CIS.





 Installing an origin certificate on your server 



 Apache HTTPD 



1. Order an origin certificate.
2. Copy the private key and origin certificate in PEM format into separate files to the directory on your server where you keep key and certificate files.
3. Locate your Apache configuration file. Typically, the filenames are httpd.conf or apache2.conf and the locations are /etc/httpd/ or /etc/apache2/. However, your configuration file might vary, especially if you use a special interface to manage your server. Refer to Apache's [DistrosDefaultLayout](https://cwiki.apache.org/confluence/display/HTTPD/DistrosDefaultLayout) for a complete list of default installation layouts. The following command is one way to search for the SSL configuration file on linux.

grep -i -r "SSLCertificateFile" /etc/httpd/
4. Locate the <VirtualHost> block to configure.
CM-1 - Configuration Management Policy and Procedures 



  Control requirements 

The organization:

CM-1 (a)
:   Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:



1.  A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2.  Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and



CM-1 (b)
:   Reviews and updates the current:



1.  Configuration management policy [IBM Assignment: at least annually]; and
2.  Configuration management procedures [IBM Assignment: at least annually].







  NIST supplemental guidance 

This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the CM family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.