vania-janet/multiturn-rag-retrieval-data huggingface dataset:
iam-identity.serviceid-apikey.login An event is generated when an initiator logs in to the IBM Cloud by using an API key that is associated with a service ID. 
 iam-identity.user-identitycookie.login This is an event that is generated when an initiator requests an identity cookie to run an action. 
 iam-identity.user-refreshtoken.login This is an event that is generated when the initiator logs in to IBM Cloud, or when an initiator that is already logged in requests a new refresh token to run an action. 
 iam-identity.user-passcode.loginiam-identity.trustedprofile-apikey.login This is an event that is generated when the initiator logs in to IBM Cloud by applying a trusted profile, or when an initiator that is already logged in by applying a trusted profile requests a new refresh token to run an action. 
 iam-identity.user.logout This is an event that is generated when the initiator logs out of the IBM Cloud. 







 Viewing events 

Events are available in the Frankfurt (eu-de) region.

To view these events, you must [provision an instance](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-provisionprovision) of the IBM Cloud Activity Tracker service in the Frankfurt (eu-de) region. Then, you must [open the IBM Cloud Activity Tracker UI](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-launchlaunch_cloud_ui).





 Analyzing events 



 Login events 

In the IBM Cloud, an administrator, or a user that has the correct access in your account, has different options to manage a user's login settings. For example, an administrator can order external authentication options, enable a one-time passcode to be used during login, enable the use of security questions at login, or set a password expiration time period. For more information, see [Types of multifactor authentication](https://cloud.ibm.com/docs/account?topic=account-types).
Include this file in the How to nav group of your toc file



 Managing IAM access for IBM Cloud for Education 

Access to IBM Cloud for Education service instances for users in your account is controlled by IBM Cloud® Identity and Access Management (IAM). Every user that accesses the IBM Cloud for Education service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to IBM Cloud for Education.

The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by the IBM Cloud for Education as operations that are allowed to be performed on the service. Each actions is mapped to an IAM platform or service role that you can assign to a user.

If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

IAM access policies enable access to be granted at different levels. Some of the options include the following:



* Access across all instances of the service in your account
* Access to an individual service instance in your account
* Access to a specific resource within an instance, such as the number concurrent users and network file storage.



Review the following tables that outline what types of tasks each role allows for when you're working with the IBM Cloud for Education service.

The following table describes the types of tasks that can be completed with each platform management role assigned. Platform management roles enable users to perform tasks on service resources at the platform level, for example, assign user access to the service, create or delete instances, and bind instances to applications.

For information about the exact actions mapped to each role, see [IBM Cloud for Education](https://cloud.ibm.com/docs/_YourSubHeadingLink_).



Table 1. IAM platform roles
The rows are read from left to right. The first column is the platform management role.
Granting users access to tag IAM-enabled resources by using the API 

To assign the editor role for a user to tag IAM-enabled resources, call the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-management) as shown in the following example request. Replace variables with your target service and resource name.



* Curl
* Java
* Python
* Go
* Node



curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME's RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

Show more

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value(EXAMPLE_USER_ID)
.build();
PolicySubject policySubjects = new PolicySubject.Builder()
Because service IDs are not tied to a specific user, your apps can authenticate if individual users leave your account. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids).



1. Create an IBM Cloud IAM service ID for your cluster that is used for the IAM policies and API key credentials. Be sure to give the service ID a description that helps you retrieve the service ID later, such as including the cluster name.

ibmcloud iam service-id-create <cluster_name>-id --description "Service ID for Red Hat OpenShift on IBM Cloud cluster <cluster_name>"

Example output

NAME <cluster_name>-id
Description Service ID for Red Hat OpenShift on IBM Cloud cluster <cluster_name>
CRN crn:v1:bluemix:public:iam-identity::a/1aa111aa1a11111aaa1a1111aa1aa111::serviceid:ServiceId-bbb2b2b2-2bb2-2222-b222-b2b2b2222b22
Bound To crn:v1:bluemix:public:::a/1aa111aa1a11111aaa1a1111aa1aa111:::
Version 1-c3c333333333ccccc33333c33cc3cc33
Locked false
UUID ServiceId-bbb2b2b2-2bb2-2222-b222-b2b2b2222b22
2. Create a custom IBM Cloud IAM policy for your cluster service ID that grants access to Red Hat OpenShift on IBM Cloud.

ibmcloud iam service-policy-create <cluster_service_ID> --service-name containers-kubernetes --roles <service_access_role> --service-instance <cluster_ID>



Table 1. Understanding this command's components

 Parameter Description 

 <cluster_service_ID> Required. Enter the service ID that you previously created for your Red Hat OpenShift cluster.
To configure a logging agent on Linux Ubuntu or Debian, see [Configuring a logging agent on Linux Ubuntu or Debian](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-config_agent_linux).

To send data and attach custom metadata to each log record, you can use the REST API.





 Define the IAM strategy 

Use IBM Cloud® Identity and Access Management (IAM) to securely authenticate users and service IDs, and to control access to all cloud resources and data consistently in the IBM Cloud.

If you add PII information in the name or description of IAM resources, you might be disclosing sensitive data to others in the same account.

When you define your IAM resources, do not add sensitive information in their names and descriptions.



 Access groups 

You can assign permissions to work with the IBM Log Analysis service within the context of the service, a resource group, or an access group.

Use access groups to organize a set of users and service IDs into a single entity that makes it easy for you to manage IAM permissions.

You can create multiple access groups.

Define a minimum of 4 access groups:



Table 2. List of access groups

 Access group Description 

 Administrators Users in this group should have permissions to fully manage the service and grant other users in the account permissions to work with the service in the IBM Cloud. 
 Managers Users in this group should have permissions to fully manage the service in the IBM Cloud. 
 Advanced service users Users in this group should have permissions to run advanced service tasks. 
 Users Users in this group should have permissions to run basic tasks. 







 Policies 

A policy determines the full set of actions that a user or service ID can perform.

For each access group, define a policy for each resource group that defines the level of access to that resource group.

By default, the account owner is the only user in the account that can grant permissions to other users to manage and work with the IBM Log Analysis service.
Granting users access to tag IAM-enabled resources by using the API 

To assign the editor role for a user to tag IAM-enabled resources, call the [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-management) as shown in the following example request. Replace variables with your target service and resource name.



* Curl
* Java
* Python
* Go
* Node



curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME's RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value(EXAMPLE_USER_ID)
.build();
PolicySubject policySubjects = new PolicySubject.Builder()
Then, enter the account ID of the source account.
4. Select IBM Cloud Metrics Routing as the source service. Then, set the scope of the access to All resources.
5. Select IBM Cloud Monitoring as the target service. Then, set the scope of the access to All resources or a single instance by configuring Resources based on selected attributes > Service Instance.

Other attributes are not supported for this type of authorization.
6. In the Service Access section, select Supertenant Metrics Publisher to assign access to the source service that accesses the target service.
7. Click Authorize.



If you create an authorization between a service in another account and a target service in your current account, you need to have access only to the target resource. For the source account, you need only the account number.





 Creating an authorization by using the CLI 

You must have access to the target service to create an authorization between services. You can grant only the level of access that you have as a user of the target service. The autorization that you define for the IBM Cloud Metrics Routing service requires that you have Administrator role for the IBM Cloud Monitoring service.

Run the following command to create an authorization for the IBM Cloud Metrics Routing service.

ibmcloud iam authorization-policy-create metrics-router sysdig-monitor "Supertenant Metrics Publisher"



1. You can scope a specific IBM Cloud Monitoring instance using [--target-service-instance-name TARGET_SERVICE_INSTANCE_NAME | --target-service-instance-id TARGET_SERVICE_INSTANCE_ID].
2. Do not provide any other scope options.



For more information about all of the parameters that are available for this command, see [ibmcloud iam authorization-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_authorization_policy_create).





 Creating an authorization by using Terraform 

Before you can create an authorization by using Terraform, make sure that you have completed the following:
You can run the command ibmcloud iam access-groups to get the list of names and corresponding GUIDs in the account.

And use the following JSON file.

{
"type": "access",
"subjects": [
{
"attributes":
{
"name": "access_group_id",
"value": "AccessGroupGuid"
}
]
}
],
"roles" : [
{
"role_id" : "crn:v1:bluemix:public:iam::::serviceRole:Reader"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "accountGuid"
},
{
"name": "serviceName",
"value": "logdnaat"
},
{
"name": "serviceInstance",
"value": "instanceGuid"
},
{
"name": "logGroup",
"value": "group1"
}
]
}
]
}
Show more





 Add permissions through the UI 

Complete the following steps to assign a policy to an access group through the UI:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Access policies > Assign access > Assign access to resources.
4. Select IAM services.
5. In the section What type of access do you want to assign?, select IBM Cloud Activity Tracker.
6. In the section Which services do you want to assign access to?, complete the following steps:



1. Select Services based on attributes to refine the scope of the policy. Choose 1 of the following options:

Option 1: Set the scope to 1 instance in a resource group.
Users with the same set of policies can be placed into the [same access group](https://cloud.ibm.com/docs/account?topic=account-groupsgroups). It simplifies the user management as policies will be assigned to the access group and inherited by all users in the group.



Usually, you can invite team members to the account as users. You could also leverage [trusted profiles](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile) to map federated users to your defined roles (see above). By defining rules on the properties provided by the Identity Provider (IdP), you could assign external users to trusted profiles which you would define for the roles, e.g., Developer or Tester. Then you would apply policies similar to those defined for access groups.

Refer to the services documentation to understand how a service is mapping IAM roles to specific actions. See for example [how the IBM Cloud Monitoring service maps IAM roles to actions](https://cloud.ibm.com/docs/monitoring?topic=monitoring-iam).

Assigning the right roles to users will require several iterations and refinement. Given permissions can be controlled at the resource group level, for all resources in a group or be fine-grained down to a specific instance of a service, you will discover over time what are the ideal access policies for your project.

Some services also provide IAM-based data access controls, i.e. IAM groups combined with the service own group filtering. For example:



* [Using groups to control data access in IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-group_data_access)
* [Using groups to control data access in IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-group_data_access)
* [Monitoring RBAC, teams, and IAM integration](https://cloud.ibm.com/docs/monitoring?topic=monitoring-iam_grant_team)
[IBM Cloud log out](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/cloud_logout.png)





 Managing provider organizations 

Use IAM to add and remove users, and to manage their permissions.



 Assign ownership of a provider organization 

Instead of managing all provider organizations yourself, you can designate other users as owners and give them the appropriate access. To assign owner-level access to a provider organization, create an IAM access group that has administrative access to the provider organization, and add the user to that access group.





 Manage user permissions 

To change a user's permissions in API Connect, either change the roles assigned to the IAM access group containing that user, or move the user to a different access group.





 Remove users from a provider organization 

To remove a user from a provider organization, delete that user from the corresponding access role in IAM. The next time that the user attempts to log in to the provider organization, the login will not be allowed.

A user who is already logged in to API Connect when you remove them from the access group remains logged in and still has access to the provider organization's assets. To stop the user from working with assets immediately, remove them from all catalog and space memberships within the Reserved instance.
Auditing events for Secrets Manager 

As a security officer, auditor, or manager, you can use the Activity Tracker service to track how users and applications interact with IBM Cloud® Secrets Manager.

IBM Cloud Activity Tracker records service and user initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. The events that are collected comply with the Cloud Auditing Data Federation (CADF) standard.

For more information, see the [getting started tutorial for IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started).

Audit devices that you can enable with Vault, such as the [syslog audit device](https://developer.hashicorp.com/vault/docs/audit/syslog), are not supported by Secrets Manager.



 Events for secrets 

The following table lists the secret actions that generate an event.



Table 1. List of secret events

 Action Description 

 secrets-manager.secret.create Create a secret. 
 secrets-manager.secrets.list List secrets. 
 secrets-manager.secret.read Get a secret. 
 secrets-manager.secret.rotate Rotate a secret. 
 secrets-manager.secret-credentials.delete Delete the IBM Cloud API key that is associated with a secret. 
 secrets-manager.secret.delete Delete a secret. 
 secrets-manager.secret-metadata.read View the metadata of a secret. 
 secrets-manager.secret-metadata.update Update the metadata of a secret. 
 secrets-manager.secret-policies.set Set secret policies. 
 secrets-manager.secret-policies.get Get secret policies. 







 Events for secret groups 

The following table lists the secret group actions that generate an event.



Table 2. List of secret group events

 Action Description 

 secrets-manager.secret-group.create Create a secret group. 
 secrets-manager.secret-groups.list List secret groups. 
 secrets-manager.secret-group.read View the details of a secret group.
The following table lists the IAM actions that are generated when you manage routes:



Table 2. IAM actions for managing routes

 Action Description 

 metrics-router.route.create Create a route with rules that define how to route metrics data to targets. 
 metrics-router.route.list List routes. 
 metrics-router.route.read Retrieve a route and its details by specifying the ID of the route. 
 metrics-router.route.update Replace a route details by specifying the ID of the route. Validate a target by checking the credentials to the destination target. 
 metrics-router.route.delete Delete a route by specifying the ID of the route. 







 Settings 

The following table lists the IAM actions that are generated when you manage settings:



Table 3. IAM actions for managing settings

 Action Description 

 metrics-router.setting.update Configure the IBM Cloud Metrics Routing settings for an account. 
 metrics-router.setting.get Get information about the IBM Cloud Metrics Routing settings for an account. 









 IAM roles 

The IBM Cloud Metrics Routing service provides the following IAM roles to control access to the service.



Table 4. IAM platform roles

 Platform role Scope Description of actions 

 Viewer All resources As a viewer, you can view IBM Cloud Metrics Routing configuration resources such as routes, targets, and the account configuration settings. 
 Operator All resources As an operator, you can view IBM Cloud Metrics Routing configuration resources such as routes, targets, and the account configuration settings. 
 Editor All resources As an editor, you can view, create, update, and delete IBM Cloud Metrics Routing resources such as routes and targets. You can also view the account configuration settings. 
 Administrator All resources As an administrator, you can view, create, update, and delete IBM Cloud Metrics Routing resources. You can also assign access policies to manage IBM Cloud Metrics Routing resources to other users in the account. 



When you define a policy, the Resources scope must be set to All resources. If this is not set, you will not be able to manage your IBM Cloud Metrics Routing instance and you will get a return code of 403.
* You can create multiple connections between your IAM-managed service and any application in any space, organization, and region in the same account if you have permission.
* Multiple connections that are made in the same space to different apps from an IAM-managed service instance use the same alias.
* Unbinding an IAM-managed service instance doesn't delete the service instance that represents the alias.
* Deleting the application that your IAM-managed service instance is connected to doesn't delete the instance that represents the alias.
* Deleting an IAM-managed service instance deletes the service instance that represents the alias.







 Creating a connection (alias) between an IAM-managed service and an app 

To connect your IAM-managed service instance to an application:



1. Go to your dashboard.
2. Click the name of your app to open the app details view.
3. Click Connect existing and choose from your existing app. Or click Create connection to create an app to connect to.
4. Specify the Access Role for connection. This value sets the IAM service access role. For more information, see [IAM access](https://cloud.ibm.com/docs/account?topic=account-userroles).
5. Optionally, you can provide a Service ID for connection by either allowing IAM to generate a unique value for you, or by providing an existing service ID. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids).
6. Click Create.







 Creating a connection (alias) between an IAM-managed service and an app by using the API 

To create a new alias and connect your IAM-managed service instance to an application, call the [Resource Controller API](https://cloud.ibm.com/apidocs/resource-controller/resource-controllercreate-resource-alias) as shown in the following example:



* Curl
* Java
* Python
* Go
* Node