vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Then, depending on the access you're looking for, open the different tabs:



* To determine what access you have through the access groups you are assigned, select Access and view the Access groups table.
* To see IAM access policies that are assigned to you, select Access and view the Access policies table.



* What actions are mapped to each IAM role?

When you invite a new user or assign a user IAM access, you can view the actions that are associated with each role. Click the numbers listed next to each role to view a list of all actions that are mapped to a specific role. By reviewing the mapping of actions to roles, you can confidently know what access you're assigning.
* How do I request access to a resource?

The account owner can update your access to any resource in the account, or you can contact any user who is assigned the administrator role on the service or service instance.
* How do I find the IAM ID for a user or myself?

In the IBM Cloud console, go to Manage > Access (IAM), and select Users. Then, select your name or another user's name from the list. You can find the IAM ID for that user along with their email address on the User details page.
* How do I identify platform management roles and service access roles for a user?



1. In the IBM Cloud® console, click Manage > Access (IAM), and then select Users.
2. Select your name or another user's name from the list.
3. Click Access to view the permissions that are associated with the user.



The owner tag is listed for the owner of the account. This user is assigned the administrator role on the service or service instance.
* How do I find and manage API Keys for a user or myself?

In the IBM Cloud console, go to Manage > Access (IAM) > API keys to view and manage API keys that you have access to.



* For information about how to manage IBM Cloud API keys that are associated with user identities, see [Managing user API keys](https://cloud.ibm.com/docs/account?topic=account-userapikey).
Track runtime authentication events with Activity Tracker
: Now you can track, manage, and analyze authentication events that are performed by your app users at runtime by [integrating Activity Tracker and App ID](https://cloud.ibm.com/docs/appid?topic=appid-at-eventsat-monitor-runtime). Releasing your secured custom, mobile, or web app to your users is only the beginning of your journey toward adoption. After your app is deployed, you need to have insights into how your users are interacting with your app. For example, the number and trends of active users. In regulatory markets, such as with HIPAA, you must have a way to share the detailed records of both successful and failed authentication events with auditors. With App ID, you can now have a very detailed view of runtime events that are related to user authentication.

Edit user profile information directly in the dashboard
: You can now update profiles for users of your application through the App ID dashboard. Then, you can use that information to personalize their experience of your app. For more information, see [user profiles](https://cloud.ibm.com/docs/appid?topic=appid-profiles).





 30 July 2019 

Create future user profiles through the dashboard
: You can now start building profiles for users that you know will use your application in the future through the App ID dashboard. For more information, see [Preregistering future users](https://cloud.ibm.com/docs/appid?topic=appid-preregister).

Slack channel
: Have questions while working with App ID? Get in touch directly with the development team on [Slack](https://www.ibm.com/cloud/blog/announcements/get-help-with-ibm-cloud-app-id-related-questions-on-slack)!

The App ID Identity and Access Istio adapter
: Centralize all your identity management in a single place with the App Identity and Access adapter. The adapter can be configured to work with any OIDC-compliant identity provider, which enables it to control authentication and authorization policies in all environments including both front and backend apps.
In this case, the user's infrastructure credentials are used for the region and resource group that you targeted, even if a different user's credentials are stored in the API key that you retrieved in the previous step.

OK
Infrastructure credentials for user name <1234567_name@email.com> set for resource group <resource_group_name>.

Example output if credentials are not set to use a different account. In this case, the API key owner that you retrieved in the previous step has the infrastructure credentials that are used for the region and resource group.

FAILED
No credentials set for resource group <resource_group_name>.: The user credentials could not be found. (E0051)



2. [Get the CIDRs and IPs of the subnets that your worker nodes are attached to](https://cloud.ibm.com/docs/openshift?topic=openshift-firewalliam_cidr_ip).
3. Get the [control plane CIDRs of the region where your cluster is located](https://github.com/IBM-Cloud/kube-samples/tree/master/iam-firewall-ips).
4. Log in to the [IBM Cloud console](https://cloud.ibm.com/).
5. From the menu bar, click Manage > Access (IAM), and select Users.
6. Select the user that you found in step 1 from the list.
7. From the User details page, go to the IP address restrictions section.
8. Enter the subnet CIDRs and IPs, and the control plane CIDRs of the region where your cluster is located.
9. Click Apply.





 Getting your Kubernetes Service subnet IP addresses 

Follow the steps to obtain the correct subnet IP addresses to add to your IAM allowlist.



 Getting your subnet IP addresses in the console 



1. From the IBM Cloud console [resource list](https://cloud.ibm.com/resources), click on your cluster.
2. Click Worker nodes.
3.
* User Management
* Billing
* Catalog management
* Context-based restrictions
* Enterprise
* Global catalog
* IBM Cloud shell settings
* License and entitlement
* Partner Center
* Partner Center - Sell
* Projects
* Security and Compliance Center
* Software instance
* Support center





Table 1. Roles and example actions for a policy on account management services

 Roles Actions 

 Viewer All viewer role actions for the account management services 
 Operator All operator role actions for the account management services 
 Editor All editor role actions for the account management services and the ability to create resource groups 
 Administrator All administrator role actions for the account management services and the ability to create resource groups 







 All IAM Account Management services 

Identity and Access Management (IAM) services make up a subset of all account management services. Give users access to all IAM account management services so that they can work with the following services:



* IAM Access Groups
* IAM Identity service
* IAM Access Management



* Role Management



* User Management





Table 2. Roles and example actions for a policy on all IAM account management services

 Roles Actions 

 Viewer All viewer role actions for IAM services 
 Operator All operator role actions for IAM services 
 Editor All editor role actions for IAM services and the ability to create resource groups 
 Administrator All administrator role actions for IAM services and the ability to create resource groups 
 User API key creator Create API keys when the account setting to restrict API key creation is enabled 
 Service ID creator Create service IDs when the account setting to restrict service ID creation is enabled 



Some roles that you might assign on a policy for All IAM Account Management services affect only certain resources. For example, the role Service ID Creator is relevant to only the IAM Identity service.





 Billing 

You can give users access to update account settings, view subscriptions, view offers, apply subscription and feature codes, update spending limits, and track usage by using the Billing service.



Table 3. Roles and example actions for the Billing service

 Roles Actions 

 Viewer View account feature settings<br><br>View subscriptions in account<br><br>View account name<br><br>View subscription balances and track usage
If you are not the credentials owner, but you are assigned the Editor or Administrator IBM Cloud IAM platform access role for the [User Management service](https://cloud.ibm.com/docs/account?topic=account-account-services), you can update the restricted IP addresses for the credentials owner.



1. Identify what user credentials are used for the cluster's region and resource group infrastructure permissions.



1. Check the API key for a region and resource group of the cluster.

ibmcloud oc api-key info --cluster <cluster_name_or_ID>

Example output

Getting information about the API key owner for cluster <cluster_name>...
OK
Name Email
<user_name> <name@email.com>
2. Check if the infrastructure account for the region and resource group is manually set to use a different IBM Cloud infrastructure account.

ibmcloud oc credential get --region <us-south>

Example output if credentials are set to use a different account. In this case, the user's infrastructure credentials are used for the region and resource group that you targeted, even if a different user's credentials are stored in the API key that you retrieved in the previous step.

OK
Infrastructure credentials for user name <1234567_name@email.com> set for resource group <resource_group_name>.

Example output if credentials are not set to use a different account. In this case, the API key owner that you retrieved in the previous step has the infrastructure credentials that are used for the region and resource group.

FAILED
No credentials set for resource group <resource_group_name>.: The user credentials could not be found. (E0051)



2. Get the Worker Zones and VPCs that your cluster is created in.

ibmcloud oc cluster get -c <cluster>

Example output

...
Worker Zones: us-south-1, us-south-2, us-south-3
Ingress Subdomain: vpc-prod.us-south.containers.appdomain.cloud
Ingress Secret: vpc-prod
Creator: -
* Use access management tags to control access to the resources and service IDs in your account at scale. By assigning access only to resources and service IDs that have specific tags that are attached to them, you can avoid multiple updates to your defined policies. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* Use trusted profiles to automatically grant federated users and compute resources access to your account. This way, federated users can be mapped to one or more trusted profiles during login by evaluating SAML-based attributes to determine which profiles they can apply. Using trusted profiles for compute resources helps you avoid storing credentials to run applications and the management and rotation of credentials. You can also add trusted profiles to access groups to leverage the set of policies you have already created.
* Assign access by using a group of services so that you need only a single policy to assign access to multiple services. This way, you decrease the number of policies in your account and reduce the time and effort to manage access.



* All Identity and Access enabled services: All catalog services that use IAM for access management.
* All Account Management services: Platform services, such as billing and usage, license and entitlements, enterprises, and more. For more information, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services&interface=uiaccount-management-actions-roles).
* All IAM Account Management services: A subset of account management services that includes the IAM platform services IAM Identity, IAM Access Management, IAM Users, IAM Groups, and future IAM services.





Removing access for inactive identities and inactive policies can reduce the risk of unauthorized access to your IBM Cloud resources and help you manage access more efficiently. For more information, see [Identifying inactive identities](https://cloud.ibm.com/docs/account?topic=account-id-inactive-identities) and [Auditing access policies](https://cloud.ibm.com/docs/account?topic=account-iam-audit-policies).
Managing user accounts and settings 

Use the following procedures to invite users to update user account credentials, and to specify whether you want to receive email and console notifications for various events.



 Inviting users to access services and resources 

IBM Cloud® for VMware Solutions is integrated with IBM Cloud Identity and Access Management (IAM) for collaboration among multiple users. After you sign up for an IBM Cloud account and log in to the IBM Cloud for VMware Solutions console, you can add users to the IBM Cloud account. These added users can share the services and resources that are provisioned for the account.

For more information, see the following topics.



* [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv)
* [Managing IAM access for VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-iam)







 Setting notifications 

You can also specify whether you want to receive email and console notifications for various events.



 Procedure to set notifications 



1. In the IBM Cloud for VMware Solutions console, click Settings from the left navigation pane.
2. If you want to be notified by email when events occur, click Enable email notifications.
3. If you want to be notified in the console when events occur, click Enable console notifications.







 Results after you set notifications 

If email or console notifications are enabled for certain instance events, you're notified by email or console messages when these events occur.







 Updating user account credentials 

The requirement to update user account credentials applies only to the following offerings: VMware vSphere, VMware vCenter Server, VMware Regulated Workloads, and Cyber Recovery.

IBM Cloud for VMware Solutions communicates with the IBM Cloud infrastructure through SoftLayer API calls. To access the SoftLayer API securely, you must link the credentials of your IBM Cloud infrastructure account to your IBM Cloud account. After your first order, you can update the user account credentials on the Settings page.



 Before you begin 



* You can link only one IBM Cloud infrastructure account to one IBM Cloud user account.
* [Using groups to control data access in IBM Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-group_data_access)
* [Using groups to control data access in IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-group_data_access)
* [Monitoring RBAC, teams, and IAM integration](https://cloud.ibm.com/docs/monitoring?topic=monitoring-iam_grant_team)



Note that by default accounts are configured for [unrestricted user view access](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting). Any user in the account can see any other user information. You can [change the setting](https://cloud.ibm.com/iam/settings) to a restrictive mode.

A good practice is to start with the minimum set of permissions then expand carefully as needed. For Kubernetes, you will want to look at its [Role-Based Access Control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) to configure in-cluster authorizations.

For the Development environment, the user responsibilities defined earlier could translate to the following:



Roles and permissions in the Development environment

 IAM Access policies 

 Developer <br><br> * Resource Group: Viewer<br> * Platform Access Roles in the Resource Group: Viewer<br> * Logging & Monitoring service role: Writer<br><br><br> 
 Tester <br><br> * No configuration needed. Tester accesses the deployed application, not the development environments<br><br><br> 
 Operator <br><br> * Resource Group: Viewer<br> * Platform Access Roles in the Resource Group: Operator, Viewer<br> * Logging & Monitoring service role: Writer<br><br><br>
RBAC, teams, and IAM integration 

IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and consistently control access to all cloud resources in the IBM Cloud. Teams provide an isolated workspace in a Monitoring instance for a user or group of users to have access to metrics in a defined scope.

IAM can map a combination of teams and roles so that a user only has access to a specific set of metrics and can take a defined set of actions within the product.

Teams provide additional security by only allowing users to see metrics that are related to the infrastructure where their apps are deployed, as opposed to the entire infrastructure of the account. For example, in a Kubernetes cluster, you could grant a group of developers access to only see metrics from 1 kubernestes.namespace where their application is deployed.

In a Monitoring instance, you can define 1 or more teams. A team provides an isolated workspace for a user or group of users to have access to metrics with a defined scope.

A Monitoring instance includes the following teams:



* Monitor operations
* Secure operations



By default, users are granted access to the monitor operations team or to the team that is configured as the default team by the instance administrator.



* An admin of the service can configure multiple teams, and change the default team.
* Each team has their own set of custom dashboards and alerts that they can use to monitor the data in scope for the team.
* Users in a team have access to the data that is included in the scope defined by the team administrator.



[Learn more about teams](https://cloud.ibm.com/docs/monitoring?topic=monitoring-teams).

For a user to monitor data within the context of a team, you must grant the user a policy for the IBM Cloud Monitoring service. The policy specifies the team and the service permissions for the user so the user can work with the data in scope for that team.

You can grant any of the following IAM service roles:



* Writer: A writer role allows a user to monitor data through dashboards, alerts, and notifications, and to manage resources such as dashboards, alerts, and notifications that are in scope for the team.
* UI







 Managing IAM access for VMware as a Service 

Access to IBM Cloud® for VMware as a Service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the VMware as a Service in your account must be assigned an access policy with an IAM role. Review the following roles, actions, and more to help determine the best way to assign access to VMware as a Service.

The access policy that you assign users in your account determines the actions that a user can complete within the context of the service or specific instance that you select. The allowable actions are customized and defined by VMware as a Service as operations that are allowed to on the service. Each action is mapped to an IAM platform or service role that you can assign to a user.

If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

IAM access policies enable access to be granted at different levels. Some of the options include the following accesses:



* Access across all instances of the service in your account
* Access to an individual service instance in your account
* Access to a specific resource within an instance



Review the following tables that outline what types of tasks each role allows for when you're working with VMware as a Service. Platform management roles enable users to complete tasks on service resources at the platform level. For example, assign user access to the service, create, delete or scale instances, and bind instances to applications. Service access roles enable users to access VMware as a Service. For more information about the exact actions that are mapped to each role, see [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions).

Platform roles

Service roles



Table 1. IAM platform roles

 Platform role Description of actions
* UI
* API







 Managing IAM access for VMware Solutions 

Access to IBM Cloud® for VMware Solutions service instances for the users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the IBM Cloud for VMware Solutions services in your account must be assigned an access policy with an IAM user role defined.

The access policy determines the actions that the user can take within the context of the service or the instance that you select. The allowable actions are customized and defined by the IBM Cloud service as operations that can be applied to the service. The actions are then mapped to IAM user roles.

Policies enable access to be granted at different levels. Some of the options include the following accesses:



* Access across all service instances in your account
* Access to an individual service instance in your account
* Access to a specific resource within an instance
* Access to all IAM-enabled services in your account



After you define the scope of the access policy, you assign a role.

Review the following information, which outlines the actions that each role allows within the IBM Cloud for VMware Solutions service.



 Platform management roles and permissions for VMware Solutions 

Platform management roles enable users to complete tasks on service resources at the platform level. For example, assign user access to the service, create or delete service IDs, create instances, and bind instances to applications.

To use a smaller set of permissions, use the following roles:



* Reader in place of Viewer or Operator
* Writer in place of Editor
* Manager in place of Administrator





 Platform management roles for VMware Solutions 

The following table provides information about the actions that are mapped to platform management roles for VMware Solutions.



Table 1. Platform management roles and allowed actions for VMware Solutions

 Platform management role Actions 

 Reader Read-only actions to view service-specific resources. 
 Writer Create and edit service-specific resources. 
 Manager Privileged actions as defined by the service in addition to create and edit service-specific resources. 
 Viewer Read-only actions to view the summary and details of instances. 
 Operator Read-only actions. For example, list instances and view instance details.