vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Controlling access to resources by using tags 

This tutorial guides you through the steps to centrally manage access to the resources in your account at scale. By completing this tutorial, you learn how to create an access management tag, add the tag to selected resources, and define a policy to assign access to resources based on the tags on those resources.

Access management tags are metadata that are added to resources to help organize access control relationships. They create flexible and easy to administer resource groupings. When you use tags to control access to your resources, your team's projects can grow without requiring updates to IAM policies.

Let's assume you are the lead of a project for your team that needs an IBM Cloud® Object Storage instance for storing sensitive, project-specific data for analytics. You only want the members of this project to have access to the service instance and work with the project data.

This tutorial applies to IAM-enabled resources only. You need to have an administrator role on the tagging service to create and delete access management tags. To attach and detach access management tags, you need at least an administrator role on the resources to which the tag is added.



 Before you begin 

If you are new to using IAM, check out the following resources to learn more about the features, concepts, and components of the access management system:



* See [What is IBM Cloud Identity and Access Management?](https://cloud.ibm.com/docs/account?topic=account-iamoverview) for an overview of the service.
* See [IAM access](https://cloud.ibm.com/docs/account?topic=account-userroles) for a description of how access management works by using access policies.
* Watch the video about [controlling access by using tags in IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-account_setuptwo-teams-projects) for an overview of how to use access management tags.







 Step 1: Create an access management tag 

Before you can add an access management tag to your Object Storage, you need to create it first.



1. Go to Manage > Account in the IBM Cloud console, and select Tags.
2.
Use regular expressions to find terms 

Define regular expressions that capture patterns of significance, such as that AB10045 is the syntax that is used for your order numbers.

Define regular expressions that can identify and extract information from fields in your collection.

For example, this regular expression finds occurrences of credit card numbers of a specific format and length.

4[0-9]{15}

The following regular expression finds occurrences of a US social security number.

(?!666|000|9d{2})d{3}-(?!00)d{2}-(?!0{4})d{4}

To add a regular expression, complete the following steps:



1. From the Teach domain concepts section of the Improvement tools panel, choose Regular expression.
2. Click Upload.
3. Optional: Specify a facet path to categorize any text that matches the regular expression. The text can be filtered by this facet later.

If you use a hierarchy of categories, add a period between category names in the facet path to represent the hierarchy. For example, if you are adding a regex that can recognize phone numbers, you might have a facet path such as international.europe.
4. Add the regular expression.



* Use a Java™ regular expression.

For more information, see the [Java documentation](https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html). Another useful resource is [Regex 101](https://regex101.com/).
* Keep the regular expression as short and understandable as possible.
* The best regular expressions resolve to a match or non-match quickly.
* Use common patterns. For example, use a(b|c|d) instead of (ab|ac|ad).
* The regular expression engine might fail if it backtracks because it can't make a negative match toward the end of the string and then attempts too many permutations. To prevent backtracks, consider using a possessive quantifier, such as (a+b)++c.



5.
* UI
* API







 Granting users access to tag resources and service IDs 

As the account owner, you might want to delegate some of the responsibility of tagging resources and service IDs. For users to attach tags to a resource or service ID, you must grant them the appropriate access. Use IBM Cloud® Identity and Access Management (IAM) access policies to grant users access to resources in a resource group.

Tags are visible account-wide and can be replicated across geographic regions. Since tags are not regulated information, avoid creating tags that use personal information, such as your name, address, phone number, email address, or other identifying or proprietary information.



 Tagging permissions 

Any user in an account can view tags. When a resource is tagged, all users that have read access to the resource can view the tag. To attach or detach a tag on a resource or service ID, certain access roles or permissions are needed depending on the resource type and tag type. See the following table to understand what role is needed for each resource type.



Table 1. Required roles for attaching and detaching tags
This is a simple data table.

 Resource Type Role 

 IAM-enabled To attach or detach user tags, editor or administrator on the resource <br>To attach or detach access management tags, administrator on the resource <br>To view the assigned policies on the resource that has an access management tag that is attached, viewer role 
 Bare metal on classic infrastructure View hardware details and access to a specific set of services or all bare metal servers 
 Dedicated Hosts on classic infrastructure View virtual dedicated host details and access to a specific set of services or all dedicated hosts 
 Virtual Server on classic infrastructure View virtual server details and access to a specific set of services or all virtual servers 
 Cloud Object Storage S3 on classic infrastructure Storage manage permission 
 File Storage on classic infrastructure Storage manage permission 
 Evault backup on classic infrastructure Storage manage permission 
 Content Delivery Network on classic infrastructure Manage CDN account permission 
 Direct Link on classic infrastructure Account member 
 Hardware Firewall Manage Firewalls 
 FortiGate Security Appliance Manage Firewalls 
 IBM Cloud Load Balancer Manage Load Balancers 
 Gateway Appliance Manage Network Gateways
--expand EXPAND (optional)
: Expanded view of the item.

--tags TAGS (optional)
: Filter features by a list of comma-separated tags.

--sort SORT (optional)
: Sort the details based on the specified attribute.





 Example 

To list all features, run the following command:

ibmcloud ac feature list --environment_id "production"



 Output 

The command returns the following output:

name feature_id segment_exists
Indian IBMers ibm-discount true
sampleFeature sampleFeature true
Cycle Rentals cycle-rentals true









 ibmcloud ac feature create 

You can create a feature, by using the command:

ibmcloud ac feature create {--file FILE-PATH | --environment_id ENVIRONMENT_ID --name NAME [--feature_id FEATURE_ID] --description DESCRIPTION --type TYPE --enabled_value ENABLED_VALUE --disabled_value DISABLED_VALUE --tags TAGS --enabled ENABLED --segment_rules SEGMENT_RULES --collections COLLECTIONS}



 Command options 

--environment_id ENVIRONMENT_ID
: Environment ID

--name NAME
: Feature name. Required field - input either as a flag or from file.

--feature_id FEATURE_ID (optional)
: Feature ID. If this value is not provided, name will automatically become the ID. Optional field - input either as a flag or from file.

--description DESCRIPTION
: Description of the feature. Required field - input either as a flag or from file.

--type TYPE
: Type of the feature (Boolean, String, Number). Required field - input either as a flag or from file.

--enabled_value ENABLED_VALUE
: Value of the feature when it is enabled. Required field - input either as a flag or from file.

--disabled_value DISABLED_VALUE
: Value of the feature when it is disabled. Required field - input either as a flag or from file.

--tags TAGS
: Tags associated with the feature. Required field - input either as a flag or from file.
To detach a tag from a resource, use the [ibmcloud resource tag-detach](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resourceibmcloud_resource_tag_detach) command. An example to detach a user tag called MyTag from a resource named MyResource:

ibmcloud resource tag-detach --tag-names MyTag —resource-name 'MyResource'

An example to detach an access management tag called project:myproject from a resource named MyResource:

ibmcloud resource tag-detach --tag-names project:myproject —resource-name 'MyResource' --tag-type access

For more information, see the [ibmcloud resource command reference](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource).

When you detach an access management tag from a resource, any associated access policies are also detached from that resource.





 Attaching tags to a resource by using the API 

You can programmatically attach tags by calling the [Global Search and Tagging - Tagging API](https://cloud.ibm.com/apidocs/taggingattach-tag) as shown in the following sample requests. The allowed values for the tag_type query parameter are: user for user tags and access for access management tags. The following example shows how to attach an access management tag that is called project:myproject to a service instance.



1. Find the unique identifier for your resource by calling the following command:



* Curl
* Java
* Python
* Go
* Node



curl -v -X POST -k --header 'Content-Type: application/json'
--header 'Accept: application/json'
--header 'Authorization: bearer <your IAM token>'
-d '{"query": "name:myresource"}' 'https://api.global-search-tagging.cloud.ibm.com/v3/resources/search'
matchLabels:
slot: global
- podSelector:
matchLabels:
component: watson-gateway
- podSelector:
matchLabels:
component: dvt
- podSelector:
matchLabels:
dwf_service: ${INSTANCE}-clu
network-policy: allow-egress
- podSelector:
matchLabels:
app: 0020-zen-base
- namespaceSelector:
matchLabels:
ns: ${NAMESPACE}
podSelector:
matchLabels:
app: 0020-zen-base
- podSelector:
matchLabels:
component: ibm-nginx
- namespaceSelector:
matchLabels:
ns: ${NAMESPACE}
podSelector:
matchLabels:
component: ibm-nginx
- namespaceSelector:
matchLabels:
assistant.watson.ibm.com/role: operator
podSelector:
matchLabels:
release: assistant-operator
- namespaceSelector:
matchLabels:
assistant.watson.ibm.com/role: operator
podSelector:
matchLabels:
app: watson-assistant-operator
- namespaceSelector:
matchLabels:
assistant.watson.ibm.com/role: operator
podSelector:
matchLabels:
app.kubernetes.io/instance: watson-assistant-operator
- namespaceSelector:
matchLabels:
assistant.watson.ibm.com/role: operator
podSelector:
matchLabels:
app.kubernetes.io/instance: ibm-etcd-operator-release
- namespaceSelector:
matchLabels:
assistant.watson.ibm.com/role: operator
podSelector:
matchLabels:
app.kubernetes.io/instance: ibm-etcd-operator
podSelector:
matchLabels:
* Flag: --max-items NUMBER



* Optional: The REGION where the bucket is present. If this flag is not provided, the program uses the default option that is specified in config.



* Flag: --region REGION



* Optional: Output FORMAT can be only json or text.



* Flag: --output FORMAT











 List parts 



* Action: Print out information about an in progress multipart upload instance.
* Usage:ibmcloud cos parts --bucket BUCKET_NAME --key KEY --upload-id ID --part-number-marker VALUE [--page-size SIZE] [--max-items NUMBER] [--region REGION] [--output FORMAT]
* Parameters to provide:



* The name of the bucket.



* Flag: --bucket BUCKET_NAME



* The KEY of the object.



* Flag: --key KEY



* Upload ID identifying the multipart upload.



* Flag: --upload-id ID



* Part number VALUE after which listing begins (default: 1)



* Flag: --part-number-marker VALUE



* Optional: The SIZE of each page to get in the service call. This does not affect the number of items returned in the command's output. Setting a smaller page size results in more calls to the service, retrieving fewer items in each call. This can help prevent the service calls from timing out. (default: 1000)



* Flag: --page-size SIZE



* Optional: The total NUMBER of items to return in the command's output. If the total number of items available is more than the value specified, a NextToken is provided in the command's output. To resume pagination, provide the NextToken value in the starting-token argument of a subsequent command. (default: 0)



* Flag: --max-items NUMBER



* Optional: The REGION where the bucket is present. If this flag is not provided, the program uses the default option that is specified in config.



* Flag: --region REGION



* Optional: Output FORMAT can be only json or text.
"type" : "Number",
"mentions" : {
"text" : "9000",
"confidence" : 0.8,
"location" : {
"begin" : 4,
"end" : 8
}
} ],
"model_name" : "natural_language_understanding"
} ]
} ],
"metadata" : { },
"text" : [ "ISO 9000 is a standard." ]
},
"notices" : [ ]
}
Show more





 Analyzing HTML content 

You can analyze HTML when you submit the html in JSON format by using syntax like this:

{
"html":"<p>My html content.</p>"
}

The following example request shows how to analyze text that you specify in the request, not that you pass in a physical file.

The collection to which the request is made uses the following enrichments, which means these enrichments are applied to the content that you submit with the API request:



* Entities
* Keywords
* Table Understanding





 Request example 

The body of the request contains form-data with the name file. The value is the JSON content to be analyzed.

curl --location --request POST 'https://cpd-abc.example.com/discovery/abc-wd/instances/1671204318684041/api/v2/projects/d457fcd9-a4ce-4637-a340-33123b5cbe2c/collections/2d47dbcc-64c7-84e9-0000-01851bb9d998/analyze?version=2020-08-30' --header 'Authorization: Bearer ...' --form 'file={
Combine the content of the Repository column (repository) and the Digest column (digest) separated by an at (@) symbol to create the image name in the format repository@digest.
* To identify your image by tag, run the ibmcloud cr image-list command. Combine the content of the Repository column (repository) and Tag column (tag) separated by a colon (:) to create the image name in the format repository:tag.



If you get a manifest error when you try to tag your image, see [Why do I get a manifest type error when I tag my image?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-manifest-error-type), [Why do I get a manifest version error?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-manifest-error-version), and [Why do I get a manifest list invalid error?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-manifest-list-error) for assistance.

ibmcloud cr image-tag [SOURCE_IMAGE] [TARGET_IMAGE]



 Prerequisites 

To find out about the required permissions, see [Access roles for using Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iamaccess_roles_using).





 Command options 

SOURCE_IMAGE
: The name of the source image. You can identify source images by using either the digest <dns>/<namespace>/<repo>@<digest> or by tag <dns>/<namespace>/<repo>:<tag>. Where <dns> is the domain name, <namespace> is the namespace, <repo> is the repository, <digest> is the digest, and <tag> is the tag.

TARGET_IMAGE
: The name of the target image. TARGET_IMAGE must be in the format repository:tag, for example, us.icr.io/namespace/image:latest.





 Examples
Response type Operators 

 <br><br> * Options<br><br><br> <br><br> * is<br> * is not<br> * is any of<br> * is none of<br><br><br> 
 <br><br> * Regex<br><br><br> <br><br> * is<br> * is not<br><br><br> 
 <br><br> * Number<br> * Currency<br> * Percent<br><br><br> <br><br> * is defined<br> * is not defined<br> * is equal to (==)<br> * is not equal to (≠)<br> * is less than (<)<br> * is less than or equal to (<=)<br> * is greater than (>)<br> * is greater than or equal to (>=)<br><br><br> 
 <br><br> * Date<br><br><br> <br><br> * is defined<br> * is not defined<br> * is on (also allows specific day of the week)<br> * is not on<br> * is before<br> * is after<br> * is on or before<br> * is on or after<br><br><br> 
 <br><br> * Time<br><br><br> <br><br> * is defined<br> * is not defined<br> * is at<br> * is not at<br> * is before<br> * is after<br> * is at or before<br> * is at or after<br><br><br> 
 <br><br> * Free text<br><br><br> <br><br> * is<br> * is not<br> * contains<br> * does not contain<br> * matches<br> * does not match<br><br><br>
Terminology 

This section applies to the names of model field names, URL segment names, query parameter names, and enumeration value names. In this document, these are collectively referred to as "names."



  Formatting 

Names MUST be lower snake case. This format is defined as one or more lowercase words separated by the underscore character (_). These names MUST NOT begin with an underscore or number.





  Abbreviations 

Names MUST NOT contain abbreviations which are not industry-standard. Where industry-standard abbreviations are used, they MUST be used consistently.





  Brand names 

Brand names and code names SHOULD be avoided in field names, URL segment names, and query parameter names. Brand names MAY be used in enumeration value names, if necessary. Where possible, resources and resource fields SHOULD be named with industry-standard, widely-understood terms.
* Flag: --body FILE_PATH



* Optional: The REGION where the bucket is present. If this flag is not provided, the program uses the default option that is specified in config.



* Flag: --region REGION



* Optional: Output FORMAT can be only json or text.



* Flag: --output FORMAT











 Upload a part copy 



* Action: Upload a part by copying data from an existing object.
* Usage:ibmcloud cos part-upload-copy --bucket BUCKET_NAME --key KEY --upload-id ID --part-number NUMBER --copy-source SOURCE [--copy-source-if-match ETAG] [--copy-source-if-modified-since TIMESTAMP] [--copy-source-if-none-match ETAG] [--copy-source-if-unmodified-since TIMESTAMP] [--copy-source-range value] [--region REGION] [--output FORMAT]



* Note that you must save each uploaded file part's number and ETag (which the CLI will print for you) for each part into a JSON file. Refer to the "Multipart Upload Guide" for more information.



* Parameters to provide:



* The name of the bucket.



* Flag: --bucket BUCKET_NAME



* The KEY of the object.



* Flag: --key KEY



* Upload ID identifying the multipart upload.



* Flag: --upload-id ID



* Part NUMBER of part being uploaded. This is a positive integer between 1 and 10,000.



* Flag: --part-number PART_NUMBER



* (SOURCE) The name of the source bucket and key name of the source object, which is separated by a slash (/). Must be URL-encoded.



* Flag: --copy-source SOURCE



* Optional: Copies the object if its entity tag (Etag) matches the specified tag (ETAG).



* Flag: --copy-source-if-match ETAG



* Optional: Copies the object if it has been modified since the specified time (TIMESTAMP).
ibmcloud resource tags [-o, --offset OFFSET] [-l, --limit LIMIT] [-p, --provider classic-infrastructure] [-d, --details true] [-a, --attached true] [--output FORMAT] [--tag-type TAG_TYPE] [--account-id ACCOUNT_ID]



 Command options 

--offset value, -o value
: Starting resource position number (default: 0).

--limit value, -l value
: Number of resources to return (maximum 1000) (default: 100).

--provider value, -p value
: Display Classic Infrastructure resources, only value allowed is: classic-infrastructure. Use it for resources of type SoftLayer_Hardware, SoftLayer_Network_Application_Delivery_Controller, SoftLayer_Network_Subnet_IpAddress or SoftLayer_Network_Vlan.

--details value, -d value
: Show additional attributes for each tag, only value allowed is true.

--attached value, -a value
: Show only filtered attached tags to a resource, only value allowed is true.

--tag-type value
: Type of the tag. Only allowed values are: user, service or access (default value : user).

--account-id value
: The ID of the account that owns the tags that you want to list (required if tag-type is set to service).

--output value
: Specify output format, only JSON is supported now.

-q, --quiet
: Suppress verbose output.







 ibmcloud resource tag-create 

Create an access management tag:

ibmcloud resource tag-create --tag-names TAG_NAMES



 Command options 

--tag-names value
: Comma separated list of tag names.

-q, --quiet
: Suppress verbose output.

This command is only valid for access management tags. For example:



* Run the following command to create the access management tag project:myproject:

ibmcloud resource tag-create —tag-names “project:myproject”









 ibmcloud resource tag-attach
tag_names=['project:myproject'],
tag_type='access').get_result()

print(json.dumps(tag_results, indent=2))

resourceModel := &globaltaggingv1.Resource{
ResourceID: &resourceCRN,
}

detachTagOptions := globalTaggingService.NewDetachTagOptions(
[]globaltaggingv1.Resource{resourceModel},
)
detachTagOptions.SetTagNames([]string{"project:myproject"})
detachTagOptions.SetTagType("access")

tagResults, response, err := globalTaggingService.DetachTag(detachTagOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(tagResults, "", " ")
fmt.Println(string(b))

const resourceModel = {
resource_id: resourceCrn,
};

const params = {
resources: [resourceModel],
tagNames: ["project:myproject"],
tagType: 'access',
};

globalTaggingService.detachTag(params)
.then(res => {
console.log(JSON.stringify(res.result, null, 2));
})
.catch(err => {
console.warn(err)
});

When you detach an access management tag from a resource, any associated access policies are also detached from that resource.







 Attaching tags to a resource by using Terraform 

Before you can attach tags to a resource by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform.
curl -X POST -H "Authorization: {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{ "tag_names": ["project:myproject"] }' "tags.global-search-tagging.cloud.ibm.com/v3/tags?tag_type=access"

CreateTagOptions createTagOptions = new CreateTagOptions.Builder()
.addTagNames("project:myproject")
.tagType("access")
.build();

Response<CreateTagResults> response = service.createTag(createTagOptions).execute();
CreateTagResults createTagResults = response.getResult();
System.out.println(createTagResults);

create_tag_results = global_tagging_service.create_tag(
tag_names=['project:myproject'],
tag_type='access').get_result()

print(json.dumps(create_tag_results, indent=2))

createTagOptions := globalTaggingService.NewCreateTagOptions(
[]string{"project:myproject"},
)
createTagOptions.SetTagType("access")

createTagResults, response, err := globalTaggingService.CreateTag(createTagOptions)
if err != nil {
panic(err)
}
b, _ := json.MarshalIndent(createTagResults, "", " ")
fmt.Println(string(b))

const params = {
tagNames: ['project:myproject'],
tagType: 'access',
};

globalTaggingService.createTag(params)
.then(res => {
console.log(JSON.stringify(res.result, null, 2));
})