vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"key": "iam_id",
"operator": "stringEquals",
"value": "IBMid-550000HFVV"
}
]
}
}



Temporary policies, which use the pattern time-based-conditions:once, aren't automatically removed when they expire. To avoid reaching the policy limit in the account, administrators can remove the policy manually after it expires.

For more information about time-based conditions for access policies, see [Conditions in access policies](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties&interface=uipolicy-condition-properties).





 Creating a temporary time-based condition by using the API 

You can assign access for a finite duration by specifying a date and time range that determines when the condition grants and terminates access. For example, you might have a user that needs to present a demonstration on your account for a few hours or a contractor that needs temporary access to a service over a couple days.

The following examples show you how to create a one-time time-based condition for you account by granting the user temporary access as an Operator for all Account Management Services.



* Java
* Python
* Go
* Node



V2PolicyAttribute subjectAttribute = new V2PolicyAttribute.Builder()
.key("iam_id")
.value(EXAMPLE_USER_ID)
.operator("stringEquals")
.build();

V2PolicyBaseSubject policySubject = new V2PolicyBaseSubject.Builder()
.addAttributes(subjectAttribute)
.build();

V2PolicyAttribute accountIdResourceAttribute = new V2PolicyAttribute.Builder()
.key("accountId")
.value(exampleAccountId)
.operator("stringEquals")
.build();
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 





 Cryptoperiods, originator-usage periods, and recipient-usage periods 

If you're familiar with NIST standard terms and key management systems, then you're probably aware of the concepts of a "cryptoperiod", an "originator-usage period", and a "recepient-usage period".

A "cryptoperiod" describes the complete lifecycle of a key. If a key is purged one year after it was created, the cryptoperiod of the key was one year. The cryptoperiod of a key, then, begins when it is created.

Similarly, the "originator-usage period" and "recepient-usage period" also begin when a key is created. The former describes the time in which a key can be used to protect data by wrapping it. The "recepient-usage period", on the other hand, describes the time in which a key can be "unwrapped" to decrypt protected data. Recall that deactivated keys can no longer be used to wrap data, but still can be used to unwrap data. Therefore, if a key is moved to the Deactivated state (for example, by establishing an expiration date), it's originator-usage period has ended. However, its recepient-usage period will continue until the key is deleted.

If no expiration date is set on a key (and it is not manually suspended, deactivated, or destroyed), the originator-usage period, recipient-usage period, and cryptoperiod of the key are the same.







 Monitoring for lifecycle changes 

After you add a key to the service, use the Key Protect dashboard or the Key Protect REST APIs to view the last time the key was transitioned.
This could be a specific date in the future, or a period of time after new objects are written.





 NoncurrentVersionExpiration 

The number of days after which non-current versions of objects are automatically deleted.





 Prefix 

An optional string that will be matched to the prefix of the object name in the bucket. A rule with a prefix will only apply to the objects that match. You can use multiple rules for different expiration actions for different prefixes within the same bucket. For example, within the same lifecycle configuration, one rule could delete all objects that begin with logs/ after 30 days, and a second rule could delete objects that begin with video/ after 365 days.





 Status 

A rule can either be enabled or disabled. A rule is active only when enabled.







 Sample lifecycle configurations 

This configuration expires any new objects after 30 days.

<LifecycleConfiguration>
<Rule>
<ID>delete-after-30-days</ID>
<Filter />
<Status>Enabled</Status>
<Expiration>
<Days>30</Days>
</Expiration>
</Rule>
</LifecycleConfiguration>

This configuration deletes any objects with the prefix foo/ on June 1, 2020.

<LifecycleConfiguration>
<Rule>
<ID>delete-on-a-date</ID>
<Filter>
<Prefix>foo/</Prefix>
</Filter>
<Status>Enabled</Status>
<Expiration>
<Date>2020-06-01T00:00:00.000Z</Date>
</Expiration>
</Rule>
</LifecycleConfiguration>

This configuration expires any non-current versions of objects after 100 days.

<LifecycleConfiguration>
<Rule>
<ID>DeleteAfterBecomingNonCurrent</ID>
<Filter/>
<Status>Enabled</Status>
<NoncurrentVersionExpiration>
A subscription is inactive if its term expires or all of its credit is spent.



You can use the spending and usage information on the Subscriptions page to evaluate whether your subscriptions suit your usage needs. For example, if you consistently have overages, you might increase your monthly spending commitment to save money on that usage. To buy new subscriptions or change future subscription amounts, contact [IBM Cloud Sales](https://www.ibm.com/cloud?contactmodule).





 Support subscriptions 

To view support subscription usage, in the console, go to Manage > Billing and usage, and select Support costs. You can view the remaining credit in your active support subscriptions and any upcoming subscriptions that aren't yet valid. For more information, see [Viewing your support costs](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-support).







 Subscription credit 

After you buy a subscription for platform or support credit, you add the credit to your account by applying a subscription code. Applying the code ensures that the credit is added to your account and you don't have unexpected overage charges.

For more information, see [Applying subscription codes](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-subscription_code).





 Expiring subscriptions 

You are notified by email 60, 30, 14, and 1 day before the expiration date of the last subscription on the account. After the subscription expires, your account is converted to a Pay-As-You Go account, which means you pay only for billable services that you use with no contracts or commitments. The discounts that are associated with the subscription account won't apply to the Pay-As-You-Go account. The IBM Sales team is happy to help extend your subscription before you reach its expiration date. If you extend your subscription within 30 days from the expiration date, you won't get charged at the Pay-As-You-Go account rate. After 30 days, you are invoiced as a Pay-As-You-Go account.
If the sign out due to inactivity duration is 1 hour, then the user will be signed out after an hour if they haven't done anything in their account in that time. To update your user's sign out due to inactivity settings, complete the following steps.

To update your user's sign out due to inactivity duration by using terraform, complete the following steps:



1. Create an argument in your main.tf file. The following example sets the inactive sign out by using the ibm_iam_account_settings and iam_account_settings_instance resources.
2. Enter the period of time in seconds in which you want a session to invalidate due to inactivity. Supported valid values are



* Any whole number between between 900 and 7200.
* Use NOT_SET to unset account setting and use service default.



resource "ibm_iam_account_settings" "iam_account_settings_instance" {
session_expiration_in_seconds = "3600"
}
3. Provision the resources from the main.tf file. For more information, see [Provisioning Infrastructure with Terraform](https://www.terraform.io/cli/run).



1. Run terraform plan to generate a Terraform execution plan to preview the proposed actions.

terraform plan
2. Run terraform apply to create the resources that are defined in the plan.

terraform apply





For more information, see the [Terraform documentation](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_account_settingsallowed_ip_addresses).





 Setting the number of allowed concurrent sessions 

You can choose the maximum number of concurrent sessions that are allowed for your account users. Concurrent sessions are active sessions that the user is signed into at one time. Users can have multiple sessions open by using different browsers or several logins with the IBM Cloud CLI. Multiple concurrent sessions are more beneficial for parallel workloads.



1. In the IBM Cloud console, click Manage > Access (IAM), and select Settings.
For more information about previewing actions, see [Reviewing and debugging your actions](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-review).





 19 May 2022 

Sign out due to inactivity setting
: Watson Assistant now uses the Sign out due to inactivity setting from Identity & Access Management (IAM). IBM Cloud account owners can select the time it takes before an inactive user is signed out and their credentials are required again. The default is 2 hours.

An inactive user will see two messages. The first message alerts them about an upcoming session expiration and provides a choice to renew. If they remain inactive, a second session expiration message appears and they will need to log in again.

For more information, see [Setting the sign out due to inactivity duration](https://cloud.ibm.com/docs/account?topic=account-iam-work-sessions&interface=uisessions-inactivity).





 12 May 2022 

Ability to upload and download example phrases and upload saved customer responses
: You can now upload and download example phrases from Customer starts with at the start of an action. This can be useful if you have a large number of example phrases and don't want to define them one by one. For more information, see [Adding more examples](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-understand-questionsunderstand-questions-adding-more-examples).

You can also now upload saved customer responses from the Saved responses page. For more information, see [Uploading saved customer responses](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-collect-infouploading-saved-customer-response).

The ability to upload example phrases and saved customer responses is also helpful if you're using the classic Watson Assistant and want to migrate your intents and entities to the new Watson Assistant. For more information, see [Migrating intents and entities](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-migrate-intents-entities).
AC-2 (3) - Disable Inactive Accounts 



  Control requirements 

AC-2 (3) - 0
:   The information system automatically disables inactive accounts after [IBM Assignment: ninety (90) days for user accounts].
The system returns an activation ID (with a nonblocking invocation) that confirms that it is received. If a network failure or other failure that intervenes before you receive an HTTP response, it is possible that Cloud Functions received and processed the request.

The system attempts to invoke the action once, resulting in one of the following four outcomes:



Table 5. Outcomes for invoking an action

 Result Description 

 success The action invocation completed successfully. 
 application error The action invocation was successful, but the action returned an error value on purpose, for instance because a precondition on the arguments was not met. 
 action developer error The action was invoked, but it completed abnormally, for instance the action did not detect an exception, or a syntax error existed. 
 whisk internal error The system was unable to invoke the action. The outcome is recorded in the status field of the activation record, as document in a following section. 



For every invocation that is successfully received, and that the user might be billed for, has an activation record.

When the outcome is action developer error, the action might partially run, and generate external visible side effects. It is the user's responsibility to check whether such side effects happened, and issue retry logic. Certain whisk internal errors indicate that an action starts to run, but fails before the action registers completion.







 Activation record 

Each action invocation and trigger firing results in an activation record.

An activation record contains the following fields:



Table 6. Fields for an activation record

 Field Description 

 activationId The activation ID. 
 start and end Timestamps recording the start and end of the activation. The values are in [UNIX time format](http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.htmltag_04_15). 
 namespace and name The namespace and name of the entity. 
 logs An array of strings with the logs that are produced by the action during its activation. Each array element corresponds to a line output to stdout or stderr by the action, and includes the time and stream of the log output.
5. Define an expiration time for the action URL. The URL expiration is the amount of time, in minutes, that a user must complete the action before the verification link expires. This setting also affects the amount of time that your reset password link is valid.
6. Enter a URL for the page that you want to display after a user verifies their email in the Thank you page URL box. If you choose to leave this field blank, an App ID default page is displayed.
7. Click Save.







 Email: Reset password 

When a user interacts with your app, they might forget their password or need to update it. You can customize the email response to their request. When a user requests a change to their password, the password remains unchanged until they click the link in this email.



1. Go to the Cloud Directory > Email templates > Reset password tab of the service dashboard.
2. Set Forgot password email to Enabled.
3. Customize the content of your message. You can add parameters and insert images by using the UI. To change the [language](https://cloud.ibm.com/docs/appid?topic=appid-cd-typescd-languages) of the message, you can use [the APIs](https://us-south.appid.cloud.ibm.com/swagger-ui//Management%20API%20-%20Config/mgmt.updateLocalization) to set the language. However, you are responsible for the content and conversion of the message. Check out the following table to see the different parameters that you can use in your message. If a user does not supply the information that is pulled by the parameter, it appears blank.



Table 3. Parameters that you can use in messages that are related to forgotten passwords

 Parameter Description 

 %{linkExpiration.hours} Displays the number of hours that the link is valid. 
 %{linkExpiration.minutes} Displays the number of minutes that the link is valid. 
 %{resetPassword.code} Displays a one-time passcode as part of the URL.
For example, you may get a 409 response when uploading a file which is older than the one already on the server resulting in a version control conflict.





 Context 

This error occurs when you enable or restore a key within 30 seconds of the last action.

You must wait at least 30 seconds between the last "action" and enabling or restoring a key.

This example fails because the key was enabled too soon after disabling a key.

 create a root key
$ KEY_ID=$(ibmcloud kp key create example-key -i $KP_INSTANCE_ID --output json | jq -r '.["id"]')

$ echo $KEY_ID

54f53384-b563-4466-860a-c42ce42f7ac9

 disable the key
$ ibmcloud kp key disable $KEY_ID -i $KP_INSTANCE_ID

Disabling key: '54f53384-b563-4466-860a-c42ce42f7ac9', in instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
OK

 this request fails because the key was enabled too soon
$ ibmcloud kp key enable $KEY_ID -i $KP_INSTANCE_ID

Enabling key: '54f53384-b563-4466-860a-c42ce42f7ac9', in instance: 'a192d603-0b8d-452f-aac3-f9e1f95e7411'...
FAILED
kp.Error:
correlation_id='59c343a7-c20f-43ea-9e50-da45cecbc8a6',
msg='Conflict:
Key could not be enabled.
Please see reasons for more details.',
reasons='[REQ_TOO_EARLY_ERR:
The key was updated recently.
Please wait and try again. -
[Avatar icon](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/icons/i-avatar-icon.svg)> Profile > Login settings. The user must set up the security questions and answers before an account owner or administrator can enable this setting on the User details page. Users with access to manage their own login settings by having the User-managed login setting that is turned on from their User details page can turn on and off this MFA setting.

External authentication
: Symantec is the only external, third-party authentication option that can be ordered for a monthly cost. An account owner or administrator must order this option for a user and enable it to be used from the User details page for the user. For Symantec, the administrator must work with the user to get that user's credential ID to complete the order. Users with access to manage their own login settings by having the User-managed login setting that is turned on from their User details page can turn on and off this MFA setting.

Password expiration
: The password expiration is set to never by default. When you sign up for an account, you're never required to change your password. When you set a password expiration period, you're notified of your password expiration by email 14 days before, 7 days before, and the day the password is set to expire. This option is available only to users that log in with a SoftLayer ID. To update your password expiration, you must be an account owner or have the User-managed login setting that is turned on by your account administrator on your IAM User details page.
"http://my-first-app.com/after_logout",
"http://my-second-app.com/after_logout"
]
}



Table 1. SSO configuration settings

 Setting Definition 

 isActive To enable SSO, set this value to true. The default setting is false. 
 inactivityTimeoutSeconds The longest length of time that can pass without any user activity before the user is required to reenter their credentials. This value is specified in seconds and can be a maximum of 604800 seconds (7 days). The default setting is 86400 seconds (1 day). 
 logoutRedirectUris A comma-separated list of allowed URIs that App ID can redirect your users to after they sign out. 









 Configuring logout 

With App ID, you can end a user's SSO session for their current browser. If the API endpoint is accessed by the user's browser, their session is terminated and the user is prompted to enter their credentials on their next sign-in attempt in that browser - for any of your apps.

When one of the flows that are related to changing, resetting, or renewing a password is started, the sessions across all clients are automatically terminated for the user.



 By using the API 

To sign out a user, redirect their browser by using your information to complete the following API call.

https://<region>.appid.cloud.ibm.com/oauth/v4/<tenantID>/cloud_directory/sso/logout?redirect_uri=<redirectURI>&client_id=<clientID>



Table 2. SSO sign-out API call variables

 Variable Value 

 region The region in which your instance of App ID is provisioned. Learn more about the [available regions](https://cloud.ibm.com/docs/appid?topic=appid-regions-endpoints). 
 tenantID The unique identifier for your instance of App ID. You can find this value in the Service Credentials tab of the App ID dashboard.
An administrator allows creation of service IDs without a policy in place action:iam-identity.accountsettings.update AND requestData.request_body.old_restrict_create_service_id:RESTRICTED AND requestData.request_body.new_restrict_create_service_id:UNRESTRICTED 
 An administrator sets an expiration timeout for sessions action:iam-identity.accountsettings.update AND requestData.request_body.old_session_expiration_in_seconds:NOT_SET AND requestData.request_body.new_session_expiration_in_seconds:<SECONDS> 
 An administrator sets the default expiration timeout for sessions action:iam-identity.accountsettings.update AND requestData.request_body.old_session_invalidation_in_seconds:<SECONDS> AND requestData.request_body.new_session_expiration_in_seconds:NOT_SET 
 An administrator sets an expiration timeout for sessions action:iam-identity.accountsettings.update AND requestData.request_body.old_session_expiration_in_seconds:NOT_SET AND requestData.request_body.new_session_invalidation_in_seconds:<SECONDS> 
 An administrator sets the default expiration timeout for sessions action:iam-identity.accountsettings.update AND requestData.request_body.old_session_invalidation_in_seconds:<SECONDS> AND requestData.request_body.new_session_invalidation_in_seconds:NOT_SET 
 An administrator sets an expiration timeout for sessions action:iam-identity.accountsettings.update AND requestData.request_body.old_session_expiration_in_seconds:NOT_SET AND requestData.request_body.new_session_invalidation_in_seconds:<SECONDS> 
 An administrator sets the default expiration timeout for sessions action:iam-identity.accountsettings.update AND requestData.request_body.old_session_invalidation_in_seconds:<SECONDS> AND requestData.request_body.new_session_invalidation_in_seconds:NOT_SET
Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.Moreover, your license from a particular copyright holder is reinstated permanently if the copyright older notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.<-- </section "id="section-en-notice-term" "> --><-- <section "id="section-en-notice-accept" "> --> 9. Acceptance Not Required for Having Copies You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.<-- </section "id="section-en-notice-accept" "> --><-- <section "id="section-en-notice-downstream" "> --> 10. Automatic Licensing of Downstream Recipients Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.