vania-janet/multiturn-rag-retrieval-data huggingface dataset:
The Actions menu on the volume details page shows the actions that you can take, depending on whether the volume is a boot or data volume, and attached or unattached. For more information, see Table 4.

The Block Storage for VPC volumes details page shows volume details, attached virtual server instances, and backup policies. Table 3 describes this information.



Table 3. Volume details

 Field Description 

 Volume details 
 Name Name of the volume you specified when you created the volume. Click the pencil icon to edit the volume name. The volume name can be up to 63 lowercase alpha-numeric characters and include the hyphen (-), and must begin with a lowercase letter. Volume names must be unique for the account and for the region. 
 Volume ID System-generated volume ID. 
 Health Health monitors the overall health of the volume, such as I/O performance and data consistency. Volume health statuses are OK or degraded. Volumes in a degraded state have less than OK performance, capacity, or experience connection problems. Volumes that are being restored from a snapshot also show a degraded state. The service displays a possible reason for the degraded state so you can resolve it. For more information, see [Block Storage for VPC volume health states](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storageblock-storage-vpc-health-states). 
 Resource group Resource group defined when you set up your VPC. Resource groups manage access to resources but do not affect billing or monitoring. 
 Attachment type Data, for a secondary volume attached to an instance, boot when attached as a boot volume, or blank for an unattached volume. 
 Created date System-generated date when the volume was created. 
 Location Availability zone in your region. 
 Size Size of the volume you specified. When the volume is attached to a virtual server instance and the volume is not at maximum capacity for its range, you can click the icon to expand the volume. For more information, see [expanding Block Storage for VPC volume capacity (Beta)](https://cloud.ibm.com/docs/vpc?topic=vpc-expanding-block-storage-volumes).
: The API key content or the path of an API key file that is indicated by the @ symbol.

--cr-token TOKEN or @CR_TOKEN_FILE_PATH
: The compute resource token content or the path of a compute resource token file that is indicated by the @ symbol. If provided, the --profile flag, or IBMCLOUD_CR_PROFILE environment variable, must also be provided or set.

--vpc-cri
: Log in as a VPC VSI compute resource identity. For more information, see [Logging in as a Virtual Server Instance Compute Resource Identity](https://cloud.ibm.com/docs/cli?topic=cli-vsi-cri-login).

--profile PROFILE_ID, PROFILE_NAME, or PROFILE_CRN
: The name, ID, or CRN of the linked trusted IAM profile to be used when obtaining the IAM access token. If provided, the --cr-token flag, IBMCLOUD_CR_TOKEN environment variable, or --vpc-cri flag must also be provided or set. If authenticating as a VPC VSI compute resource, specifying only a trusted profile CRN or ID is supported.

-c ACCOUNT_ID
: The ID of the target account. This option is exclusive with the --no account option.

--no-account
: Forced login without the account. This option isn't recommended, and it is exclusive with the -c option.

--accept
: Accept an invitation to join the targeted account. The provided account must be a valid account ID.

-g RESOURCE_GROUP<
: The name or ID of the target resource group. Optional.

-r REGION
: The name of the target region. For example, us-south or eu-gb.

--no-region
: Forced login without targeting a region.

--skip-ssl-validation
: Bypass the SSL validation of HTTP requests. This option isn't recommended.

--vpc
: Use a VPC connection for a private API endpoint.





 Examples 

Log in interactively:
* UI
* CLI
* API







 Protecting Virtual Private Cloud (VPC) Infrastructure Services with context-based restrictions 

Context-based restrictions give account owners and administrators the ability to define and enforce access restrictions for IBM Cloud® resources based on the context of access requests. Access to VPC Infrastructure Services can be controlled with context-based restrictions and identity and access management (IAM) policies.

These restrictions work with traditional IAM policies, which are based on identity, to provide an extra layer of protection. Unlike IAM policies, context-based restrictions don't assign access. Context-based restrictions check that an access request comes from an allowed context that you configure. Since both IAM access and context-based restrictions enforce access, context-based restrictions offer protection even in the face of compromised or mismanaged credentials. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis).

A user must have the Administrator role on the VPC Infrastructure Services to create, update, or delete rules that target VPC Infrastructure Services. A user must have either the Editor or Administrator role on the context-based restrictions service to create, update, or delete network zones. A user with the Viewer role on the context-based restrictions service can add network zones to a rule only.

The context-based restriction service generates audit logs every time a context-based policy is enforced. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-cbr-monitor).

To get started protecting your VPC Infrastructure Services with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-tutorial).



 How VPC Infrastructure Services integrates with context-based restrictions 

VPC Infrastructure Services is a composite service made up of a number of child services.
All of the other configuration files are provided and do not need to be modified.

The IBM Cloud Provider plug-in for Terraform on IBM Cloud uses these configuration files to provision a VPC in your IBM Cloud account.





 What is created 

A VPC is a private space in IBM Cloud where you can run an isolated environment with custom network policies. The variables that you define are used by the scripts to provision the following virtual private cloud infrastructure resources for you:



* 1 VPC where you provision your virtual server instance
* 1 security group and rules for this security group to allow DNS and SSH connections to your virtual server instance and all outbound traffic
* 1 subnet to enable networking in your VPC
* 1 virtual server instance
* 2 storage volumes, 1 for swap and 1 for data
* 1 floating IP address that you use to access your VPC virtual server instance over the public network







 Support 

There are no warranties of any kind, and there is no service or technical support available for these materials from IBM®. As a recommended practice, review carefully any materials that you download from this site before using them on a live system.

Though the materials provided herein are not supported by the IBM Service organization, your comments are welcomed by the developers, who reserve the right to revise, re-adapt or remove the materials at any time. To report a problem, or provide suggestions or comments, open a GitHub issue.





 Before you begin 

[Create or retrieve an IBM Cloud API key](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key). The API key is used to authenticate with the IBM Cloud platform and to determine your permissions for IBM Cloud services.

[Create or retrieve your SSH key ID](https://cloud.ibm.com/docs/ssh-keys?topic=ssh-keys-getting-started-tutorial). You need the 40-digit UUID for the SSH key, not the SSH key name.





 Procedure 

Use these steps to configure the IBM Cloud Provider Plug-in and use Terraform to create a VPC for SAP.



1.
status <br>Always included <br>string The status of the subnet. <br>Possible values:available,deleting,failed, pending 
 total_ipv4_address_count <br>Always included <br>int64 
 vpc <br>Always included <br>VPCReference The VPC this subnet resides in. 
 zone <br>Always included <br>ZoneReference The zone this subnet resides in. 
 public_gateway <br>PublicGatewayReference The public gateway to use for internet-bound traffic for this subnet. 





Table 3. Create status codes

 Status Code 

 201 The subnet was created successfully. 
 400 An invalid subnet prototype object was provided. 
 409 The subnet prototype object conflicts with another subnet in the VPC, or specifies a CIDR block outside of the VPC's address prefixes. 



For more information (including Java, Node, Python and Go examples), see "Create a subnet" in the [VPC API reference](https://cloud.ibm.com/apidocs/vpc/latestcreate-subnet).







 Viewing subnets in VPC 

You can view the details of a subnet in your VPC by using the UI, API, or CLI.



 Viewing subnets in VPC using the UI 

After you have created a subnet, it appears in the Subnets for VPC list.

To view the details about a subnet in the list using the UI, click the link of the subnet in the Name column. The Overview tab shows the information you used in the subnet creation.





 Viewing subnets in VPC using the CLI 

To view the details about a subnets in VPC by using the CLI, run the following command:

ibmcloud is subnet SUBNET [--vpc VPC] [--show-attached] [--output JSON] [-q, --quiet]

Where:

SUBNET
: ID or name of the subnet.

--vpc
: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.

--show-attached
To find an overview of the resources that you can provision in IBM Cloud, see the [Terraform on IBM Cloud reference](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-resources-datasource-list).

Example infrastructure code for provisioning a VPC

resource ibm_is_vpc "vpc" {
name = "myvpc"
}



 Referencing resources in other resource blocks 

Review the options that you have to reference existing resources in other resource blocks of your Terraform on IBM Cloud configuration file.

The IBM Cloud Provider plug-in reference includes two types of objects, data sources and resources. You can use both objects to reference resources in other resource blocks.



* Resources: To create a resource, you use the resource definition in the IBM Cloud Provider plug-in reference. A resource definition includes the syntax for configuring your IBM Cloud resources and an Attributes reference that shows the properties that you can reference as input parameters in other resource blocks. For example, when you create a VPC, the ID of the VPC is made available after the creation. You can use the ID as an input parameter when you create a subnet for your VPC. Use this option if you combine multiple resources in one Terraform on IBM Cloud configuration file.

Example infrastructure code

resource ibm_is_vpc "vpc" {
name = "myvpc"
}

resource ibm_is_security_group "sg1" {
name = "mysecuritygroup"
vpc = ibm_is_vpc.vpc.id
}
* Data sources: You can also use the data sources from the IBM Cloud Provider plug-in reference to retrieve information about an existing IBM Cloud resource. Review the Argument reference section in the IBM Cloud Provider plug-in reference to see what input parameters you must provide to retrieve an existing resource. Then, review the Attributes reference section to find an overview of parameters that are made available to you and that you can reference in your resource blocks. Use this option if you want to access the details of a resource that is configured in another Terraform on IBM Cloud configuration file.
* VpcId - Find by using the list vpc command (with the preceding variables) and then populate the variable based on the provided ID:



export VpcId=<your_VPC_id>



* COSbucket - The name of the Object Storage bucket.



export COSbucket=<your_COS_bucket_name>
3. When all variables are initiated, provision a flow log collector for the specific VPC:

curl -X POST
-sH "Authorization:${iam_token}"
"$vpc_api_endpoint/v1/flow_log_collectors?version=$api_version&generation=2" -d '{ "name": "flow-logs-1", "resource_group": { "id": "'$ResourceGroupId'" }, "storage_bucket": { "name": "'$COSbucket'" }, "target": { "id": "'$VpcId'" } }' | jq
4. To provision a collector that targets a subnet, virtual server instance, or VNIC, you must provide a subnet ID, virtual server instance ID, or VNIC ID as a collector target. For example, the following request creates a collector that targets a virtual server instance ID:

export VsiId=<your_vsi_id>

curl -X POST -sH "Authorization:${iam_token}" "$vpc_api_endpoint/v1/flow_log_collectors?version=$api_version&generation=2" -d '{ 	 "name": "flow-logs-1", "resource_group": { "id": "'$ResourceGroupId'" }, "storage_bucket": { "name": "'$COSbucket'" }, "target": { "id": "'$VsiId'" } }' | jq







 Next steps 



* [Viewing flow log objects](https://cloud.ibm.com/docs/vpc?topic=vpc-fl-analyze)
* Working with flow logs
Scope of the design requirements





 Components 



 VPC architecture decisions 



Table 1. Architecture decisions

 Requirement Component Reasons for choice Alternative choice 

 <br><br> * Provide infrastructure/application administration access to monitor, operate, and maintain the environment.<br> * Limit the number of infrastructure/application administration entry points to ensure security audit.<br><br><br> Management VPC service Create a separate VPC service where SSH connectivity from outside is allowed 
 <br><br> * Provides compute, storage, and network services to support hosted applications and operations that deliver services to the consumer.<br> * Ensure you can reach IBM Cloud services, Workload VPC and Management VPC<br><br><br> Workload VPC service Create a separate VPC service as an isolated environment, without direct public internet connectivity and without direct SSH access 
 Create a virtual server instance to support hosted applications Workload virtual server instance Create a VPC virtual server instance that can act as a workload server to support hosted applications. Configure ACL and security group rules allow access to IBM Cloud services, Workload and Management VPC's 
 Create a virtual server instance as the only management access point to the environment Jump box host VPC instance Create a Linux VPC instance that acts as a jump box host. Configure ACL and security group rules to allow SSH connectivity (port 22). Add a public IP address to the VPC instance. 
 <br><br> * Set up network for all created services<br> * Isolate network for all created services<br> * Ensure all created services are interconnected<br><br><br> Secure landing zone components Create a minimum set of required components for a secure landing zone Create a modified set of required components for a secure landing zone in preset 







 Network security architecture decisions 



Table 2. Network security architecture decisions

 Requirement Component Reasons for choice Alternative choice
VPC The name of the VPC. The list of VPCs is available [here](https://cloud.ibm.com/vpc-ext/network/vpcs). 
 SECURITYGROUP The name of the Security Group. The list of Security Groups is available [here](https://cloud.ibm.com/vpc-ext/network/subnets) 
 SUBNET The name of the Subnet. The list of Subnets is available [here](https://cloud.ibm.com/vpc-ext/network/subnets) 
 PROFILE The profile used for the VSI. A list of profiles is available [here](https://cloud.ibm.com/docs/vpc?topic=vpc-profiles). 
 IMAGE The OS image used for the VSI. A list of images is available [here](https://cloud.ibm.com/docs/vpc?topic=vpc-about-images). 
 SSH_KEYS List of SSH Keys IDs that are allowed to SSH as root to the VSI. Can contain one or more IDs. The list of SSH Keys is available [here](https://cloud.ibm.com/vpc-ext/compute/sshKeys). 
 [DB/APP]-HOSTNAME The hostname for the VSI. The hostname must have up to 13 characters as required by SAP. For more information about rules regarding hostnames for SAP systems, see [SAP Note 611361 - Hostnames of SAP ABAP Platform servers](https://launchpad.support.sap.com//notes/%20611361). 



5. Initialize the Terraform CLI.

terraform init
6. Create a Terraform execution plan. The Terraform execution plan summarizes all the actions that are done to create the VPC instance in your account.

terraform init
7. Verify that the plan shows all of the resources that you want to create and that the names and values are correct.
A resource definition includes the syntax for configuring your IBM Cloud resources and an Attributes reference that shows the properties that you can reference as input parameters in other resource blocks. For example, when you create a VPC, the ID of the VPC is made available after the creation. You can use the ID as an input parameter when you create a subnet for your VPC. Use this option if you combine multiple resources in one Terraform configuration file.

Example of an infrastructure code.

resource ibm_is_vpc "vpc" {
name = "myvpc"
}

resource ibm_is_security_group "sg1" {
name = "mysecuritygroup"
vpc = ibm_is_vpc.vpc.id
}
* Data sources: You can also use the data sources from the IBM Cloud Provider plug-in reference to retrieve information about an existing IBM Cloud resource. Review the Argument reference section in the IBM Cloud Provider plug-in reference to see what input parameters you must provide to retrieve an existing resource. Then, review the Attributes reference section to find an overview of parameters that are made available to you and that you can reference in your resource blocks. Use this option if you want to access the details of a resource that is configured in another Terraform configuration file.

Example of an infrastructure code.

data ibm_is_image "ubuntu" {
name = "ubuntu-18.04-amd64"
}

resource ibm_is_instance "vsi1" {
name = "$mysi"
vpc = ibm_is_vpc.vpc.id
zone = "us-south1"
keys = [data.ibm_is_ssh_key.ssh_key_id.id]
image = data.ibm_is_image.ubuntu.id
profile = "cc1-2x4"

primary_network_interface {
subnet = ibm_is_subnet.subnet1.id
security_groups = [ibm_is_security_group.sg1.id]
}
}
Show more









 Managing resources in other account
: The type of file or block storage, either Endurance or Performance.

"ns":"default"
: The namespace that the storage instance is deployed to.

"pvc":"mypvc"
: The name of the PVC that is associated with the storage instance.

"pv":"pvc-d979977d-d79d-77d9-9d7d-d7d97ddd99d7"
: The PV that is associated with the storage instance.

"storageclass":"ibmc-file-gold"
: The type of storage class: bronze, silver, gold, or custom.
11. Remove the physical storage instance.

ibmcloud sl file volume-cancel <classic_file_id>
12. Verify that the physical storage instance is removed.

ibmcloud sl file volume-list



The deletion process might take up to 72 hours to complete.
ibmcloud is vpc-create VPC_NAME [--classic-access] [--address-prefix-management auto | manual] [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is vpc-create my-vpc --classic-access
* ibmcloud is vpc-create my-vpc --address-prefix-management auto
* ibmcloud is vpc-create my-vpc --resource-group-id fee82deba12e4c0fb69c3b09d1f12345
* ibmcloud is vpc-create my-vpc --resource-group-name Default --output JSON







 Command options 



* VPC_NAME: Name of the VPC.
* --classic-access: This flag indicates whether the VPC must be connected to Classic Infrastructure. The default value is false.
* --address-prefix-management: This flag indicates if a default address prefix is automatically created for each zone in this VPC. If manual, this VPC is created with no default address prefixes. One of: auto, manual. (default: auto).
* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpc-default-security-group 

View details of the default security group of a VPC.

ibmcloud is vpc-default-security-group VPC [--output JSON] [-q, --quiet]



 Command options
VPC CLI reference 

Use the following information as a reference of the command-line interface (CLI) commands that are available for IBM Cloud® Virtual Private Cloud (VPC).

This CLI reference is organized into the following sections:



* [Network commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&interface=clinetwork)
* [Compute commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&interface=clicompute-clis)
* [Regions and zones commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&interface=cligeography)
* [Storage commands](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-reference&interface=clistorage)





 Prerequisites 



1. Install the [IBM Cloud CLI ![External link icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/vpc/includes/icons/launch-glyph.svg)](https://cloud.ibm.com/docs/cli).
2. Install or update the VPC infrastructure service plug-in.

ibmcloud plugin install vpc-infrastructure

To update, use the following command:

ibmcloud plugin update

To view installed plug-ins and versions, use the following command:

ibmcloud plugin list



--------------------





 NETWORK COMMANDS 

The following section provides information about CLI commands for network services.





 Flow logs 



 ibmcloud is flow-log-create 

Create a flow log.
About VPC Instance Metadata 

The VPC Instance Metadata service is a free service that you can use to access information about your virtual server instances. You can invoke the service through a REST API within an instance to get information about that instance. Access to the API is unavailable from outside the instance. Before you can access the metadata, you need to generate an instance identity access token. You can use the instance identity token to optionally get an IAM token that can be used to access all IAM-enabled services.



 Metadata service concepts 

You can programmatically access metadata about a virtual server instance and use it to initialize new instances. Metadata that is provided by API services pertains only to the instance from which the request is made. You can't use the metadata service within an instance to obtain information about another instance or to obtain information about resources that are not currently associated with the instance.

Metadata that you can access includes the instance name, CRN, resource groups, user data, as well as information about SSH keys and placement groups. For more information about all metadata that is returned from the service, see the [summary of data returned by the metadata service](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-metadata-summary).

The instance metadata service uses a REST API and the instance's host name to retrieve metadata. The metadata service is disabled by default. You can enable the metadata services on all instances with the VPC API, from the CLI, or in the UI.

The instance metadata service has two components:



* [Instance identity token service](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-aboutimd-vpc-access-token) that lets you acquire a JSON web token to access the VPC metadata service. To access other IBM Cloud IAM-enabled services, you can generate an IAM token from the instance identity token. For example, starting an instance might require a call to IBM Cloud Database to set up a database server.