vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Zoom

![Architecture focusing on the Application team](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution59-vpc-tg-dns-iam/app1.png)

Architecture focusing on the Application team







 IAM Architecture 

If you have a good understanding of resource groups and IAM Access Groups you can quickly skim this section and start the steps to create the resources.



 Access Groups 

An access group will be created for each team. Access policies are added to access groups, and then users (team members) are added to the access group to grant access.

The Transit Gateway service instance is managed exclusively by the network team. Editor access is required for creation. Manager access to the created instance allows VPCs to be connected to the Transit Gateway.

In this example, a single DNS zone, widgets.example.com will be created and access to the DNS zone will be permitted to all the VPCs. The DNS service instance is created by the network team (Editor role) and permitting the zones requires the Manager role. DNS resolution at run time in an instance on a VPC does not require IAM access. The shared team needs to list the DNS instances (Viewer role) and add an A or CNAME record (Manager role).

[VPC](https://cloud.ibm.com/docs/vpc) Infrastructure Service (IS) consists of about 15 different service types. Some are only of concern to the network team, like network ACLs (access control lists). Others are only of concern to the microservice teams, like VSI instances. But some are edited by the network team and operated by the microservice team, like subnets. The network team will create the subnet and a microservice team will create an instance in a subnet. For the purpose of this tutorial the VPC IS service types, Transit Gateway and DNS are summarized for each access group in the table below. The contents of the table are the required roles.
* --pools is the IDs of origin pool, if set to all, the all pool IDs will be used.
* --trigger-condition is the condition of pool toggle status.
* --include-future-pools sets whether or not include the future pools.
* -i, --instance is the instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.
* --output specifies the output format; only JSON is supported.







 WAF alert command and Advanced WAF alert command 

Create an alert policy about spikes in firewall events. Firewall events alerts use a z-score calculation over the last six hours and five-minute buckets of events. An alert is triggered whenever the z-score is above 3.5 (the threshold). You will not receive duplicate alerts within the same two-hour time frame.

ibmcloud cis alert-policy firewall-events-alert-create --name NAME (--emails EMAILS | --webhooks WEBHOOKS) --enabled (true | false) --domains DOMAINS [--services SERVICES] [--description DESCRIPTION] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* --name is the name of the alert policy.
* --description is the description for the alert policy.
* --emails is the email addresses for dispatching an alert notification. For example: --emails test1@cn.ibm.com,test2@cn.ibm.com
* --webhooks is the webhook ID that for dispatching an alert notification. For example: --webhook webhookID1,webhookID2
* --enabled sets whether or not the alert policy is enabled.
* --domains are the domain IDs for the alert policy. For example: --domains domainID1,domainID2
* --services (Advanced WAF) specifies which services the alert monitors.
Satellite reference architecture shared responsibility model 

In IBM Cloud, the responsibilities for deploying, operating, and securing products are shared between IBM and our customers. This [IBM Cloud® shared responsibility model](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities) is one of the most important things to understand when interpreting the control requirements of the IBM Cloud Framework for Financial Services. Here we dive deeper into this shared responsibility model for the [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-about).



 Shared responsibilities for IBM Cloud products 

All services that run in IBM Cloud as part of the Satellite reference architecture are considered [managed products](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilitiesmanaged-responsibilities) in the IBM Cloud shared responsibility model. Each of these products has their own [service-specific shared responsibilities](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-responsibilities).

Due to the hybrid nature of Satellite, there is a unique set of [Satellite-specific shared responsibilities](https://cloud.ibm.com/docs/satellite?topic=satellite-responsibilities) for components that run in the on-premises Satellite location.

For all products, these responsibilities cut across the following five task areas, which intersect with the IBM Cloud Framework for Financial Services's [best practices and requirements](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices):



Table 1. Tasks areas in IBM Cloud shared responsibility model
The rows are read from left to right. The first column is the title for the set of tasks. The next column describe the tasks.

 Types of tasks Description 

 [Incident and operations management](https://cloud.ibm.com/docs/satellite?topic=satellite-responsibilitiesincident-and-ops) Includes tasks such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.
To activate a trigger.





 Fleiss Kappa score 

A measure of how consistently the same annotation was applied by multiple human annotators across overlapping documents. The Fleiss Kappa score reaches its best value at 1 and worst value at 0.





 floating IP address 

A public, routable IP address that makes use of 1-to-1 network address translation (NAT) so that a server can communicate with the public internet and private subnet within a cloud environment. Floating IP addresses are associated to an instance, for example, a virtual server instance, a load balancer, or a VPN gateway, by means of a virtual network interface card (vNIC).





 framework 

An architecture for an application that provides a standard structure for an application, and general, extensible functionality. A framework enables and simplifies consistent implementation of complex technologies for application development.





 functional identifier 

An ID created through a federated identity provider that represents a program, application, or service that is assigned the minimum level of access required to complete the function for which it is created.







 G 



 GA 

See [general availability](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2117947).





 GB-hour 

The cumulative amount of memory (in gigabytes) that is running for all application instances for a particular buildpack per hour.





 general availability (GA) 

Date when a product is widely available for sale and delivery to customers or channels, usually across multiple geographies.





 genesis block 

The configuration block that initializes a blockchain network or channel, and also serves as the first block on a chain. See also [block](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2000384).





 globally unique identifier (GUID) 

An algorithmically determined number that uniquely identifies an entity within a system.





 gossip 

A method of sharing network information among peers in which each peer forwards messages to a random selection of the current peers in the network.





 Gossip Data Dissemination Protocol 

A protocol for secure, reliable, and scalable communication of information in an network by passing messages among peers.





 ground truth
When the reasonCode for an API call is any of the following values, the value of severity is set as follows:



Table 4. Severity value for some reason codes

 reasonCode description severity 

 400 Bad Request warning 
 401 Unauthorized critical 
 403 Forbidden critical 
 409 Conflict warning 
 424 Failed Dependency warning 
 500 Internal Server Error warning 
 502 Bad Gateway warning 
 503 Service Unavailable critical 
 504 Gateway Timeout warning 
 505 HTTP Version Not Supported warning 
 507 Insufficient Storage critical 







 Target fields 

Target fields provide information about the resource that is accessed, created, updated, or deleted by the initiator's action in your account.

The following table lists common target fields that are available for each event:



Table 5. Common target fields

 Field Name Description Value 

 target.id Cloud Resource Name (CRN) of the resource on which the action is executed. For example, crn:v1:bluemix:public:cloud-object-storage:global:a/12345678e6232019c6567c9123456789:fr56et47-befb-440a-a223c-12345678dae1:bucket:bucket1 
 target.name Human-readable name of the resource on which the action is executed. 
 target.typeURI Type of the cloud resource on which the action is executed. For example, iam-am/policy or cloud-object-storage/bucket/acl 
 target.host.address IP Address or URL of the target service 





 target.id (string) 

This field indicates the IBM Cloud resource on which the action is executed.

The format of this field is a CRN. For more information, see [CRN format](https://cloud.ibm.com/docs/account?topic=account-crn).





 target.name (string) 

This field indicates the human readable name of the IBM Cloud resource on which the action is executed.

Make sure that the name of resources does not include sensitive or PII data.





 target.alias (string)
An IBM Business Partner that provides IT services on a contractual basis to maintain clients' computers, networks or software. They manage services on-site at the clients' data center, remotely in the clients’ data center, or in a third-party data center.





 master key 

An encryption key that is used to protect a crypto unit. The master key provides full control of the hardware security module and ownership of the root of trust that encrypts the chain keys, including the root key and standard key.





 MBaaS 

See [mobile backend as a service](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx7044858).





 member 

A participant that is enrolled in a blockchain network. A member can be as large as a multi-national corporation or as small as an individual.





 membership service provider 

A component that defines the organizations that can transact on a blockchain network. The membership service provider turns identities into permissions by defining them as administrators of an organization. It also contains the public certificate for the root of trust of the organization. context: Typically, a single membership service provider is used to represent a single blockchain organization.





 mention 

A span of text that is considered relevant ina domain data. For example, in a type system about automotive vehicles, occurrences of terms such as "airbag", "Ford Explorer", and "child restraint system" might be relevant mentions.





 microservice 

A set of small, independent architectural components, each with a single purpose, that communicate over a common lightweight API.





 ML 

See [machine learning](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx8397498).





 mobile app 

See [mobile application](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx4258535).





 mobile application (mobile app) 

An application that has been designed for a mobile platform. Similar to web applications, mobile apps provide some function beyond static display of information, for example, allowing the user to filter news in near real-time.
Architecture 



 Cloud Architecture 

Maximo Application Suite (MAS) is a feature rich suite of applications delivered using key IBM and Red Hat technologies. The MAS Dedicated Service delivers this functionality on IBM Cloud and AWS platforms.

IBM Cloud - YouTube Videos

Inside the heart of an IBM Cloud Data Center:

[https://www.youtube.com/watch?v=HkIJTyjE4zo](https://www.youtube.com/watch?v=HkIJTyjE4zo)

Do you have a cloud designed for data?

[https://www.youtube.com/watch?v=TrbQbM_xtBw](https://www.youtube.com/watch?v=TrbQbM_xtBw)

Further information on IBM Cloud Data Centers:

[https://www.ibm.com/cloud/data-centers](https://www.ibm.com/cloud/data-centers)





 Network Architecture 

IBM Cloud has a unique Triple Network architecture. Every server provisioned in the IBM Cloud has 3 distinct networks:



* Public Network: Two network interfaces are dedicated to the public network. This network serves as the internet facing network for the server. IBM MAS-Dedicated uses this network as the way for external clients to access the application. This network is also secured by a firewall pair managed by the IBM SRE team.
* Private Network: Two network interfaces are dedicated to the private network. This network serves as a secure private network dedicated to IBM Cloud. IBM Cloud uses this network for secure server to server communication as well as data center to data center communications. This network has no access to the internet.
* Management Network: One network interface is dedicated to the Management network. This secure out-of-band network is accessible via an IBM managed VPN. It is used by IBM Cloud staff for maintenance and administration purposes such as firmware updates, OS reloads, power-cycle or other IPMI functions like keyboard, video, mouse control (KVM over IP).



For the MAS Dedicated Service each client is provisioned with their own application instance and dedicated namespace(s).
* UI







 Defining your support experience 

Making sure that your users understand how to get help and support for your product is key. Defining your support experience includes providing details about how users can contact your support team and escalate issues. To define your product's support experience, you need to select the type of support that is provided, add support details, and then provide information about how users can escalate support cases.



 Selecting your product's support provider 

Select your product's support provider to add the necessary details that are associated with the third-party or community provider types.

Third-party products
: Provided by individual service entities, IBM Business Partners, or independent service vendors (ISV). Support for third-party products is provided by the third-party provider. If the root cause analysis determines that the issue is a defect in a third-party product, IBM Cloud isn't required to provide a fix. However, IBM Cloud shares analysis with the third-party provider, if needed, and can work with the third-party provider to help solve the issue.

Community products
: Provided by open source communities. If a root cause analysis determines that a support issue is a defect in an open source or community product, IBM Cloud isn't required to provide a fix. IBM Cloud closes the case and refers users to the community or forum for assistance. Users can get community assistance for technical issues through [Stack Overflow](https://stackoverflow.com/questions/tagged/ibm-cloud).

Use the following steps to select your product's support provider.



1. In the IBM Cloud console, click the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/ff5860bfede49db3197c4bbba7f7123769bdc068/icons/icon_hamburger.svg) > Partner Center > Sell > My Products.
2. Select the product that you're onboarding, and click Support.
3. Select your product's support provider.



1.
If not set, the context instance specified by 'cis instance-set INSTANCE' is used.
* --output value specifies output format; only JSON is supported.







 Getting details for a webhook using the CLI 

To get a webhook using the CLI, run the following command.

ibmcloud cis alert-webhook WEBHOOK_ID [-i, --instance INSTANCE] [--output FORMAT]

Where:



* WEBHOOK_ID is the ID of webhook.
* -i, --instance value is the instance name or ID. If not set, the context instance specified by 'cis instance-set INSTANCE' is used.
* --output value specifies output format; only JSON is supported.







 Updating a webhook using the CLI 

To update a webhook using the CLI, run the following command.

ibmcloud cis alert-webhook-update WEBHOOK_ID [--name NAME] [--url URL] [--secret SECRET] [-i, --instance INSTANCE] [--output FORMAT]

Where:



* WEBHOOK_ID is the ID of webhook.
* --name value is the name of the webhook.
* --url value is the POST endpoint to call when dispatching an alert.
* --secret value is the secret that is passed in the webhook auth header when dispatching a webhook alert.
* -i, --instance value is the instance name or ID. If not set, the context instance specified by 'cis instance-set INSTANCE' is used.
* --output value specifies output format; only JSON is supported.







 Deleting a webhook using the CLI 

To delete a webhook using the CLI, run the following command.

ibmcloud cis alert-webhook-delete WEBHOOK_ID [-i, --instance INSTANCE] [-f, --force]

Where:



* WEBHOOK_ID is the ID of webhook.
* i, --instance value is the instance name or ID.
Get started by reviewing our predefined, compliant architectures and control libraries to see how your industry fits in the cloud.



 Understanding security and compliance requirements 

While you're working through the planning phase of running your enterprise solutions on IBM Cloud, it's important to consider the internal and external standards that your organization must meet. For example, if you are a medical establishment, you most likely need to prove that you are upholding HIPAA requirements. Or, if you are a financial institution you might need to prove that you are meeting NIST standards. With [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started), you can take advantage of predefined control libaries that are designed to help you validate and prove compliance for a group of controls.





 Identifying the right infrastructure architecture 

Instead of figuring out how to assemble a compliant infrastructure architecture on your own, you can review the deployable architectures that are available in [the catalog](https://cloud.ibm.com/catalogreference_architecture). IBM Cloud provides automation for the deployment of common architectural patterns that combine one or more cloud resources, which are known as deployable architectures. Each

deployable architectureis built and maintained by IBM Cloud experts following IBM Cloud best practices to take the guesswork out of the architecture design process and reduce the time that it takes to deploy to just minutes. Compliance managers and solution architects can review the components of the architecture and the level of compliance that each deployable architecture meets by reviewing the details directly from the catalog detail pages.

Zoom

![IBM Cloud catalog showing deployable architecture tiles](https://cloud.ibm.com/docs-content/v1/content/adcecdbe4e86955f88aac7f3c1e7ec3ff44992ef/overview/images/catalog.svg)

Figure 1. IBM Cloud catalog showing deployable architecture tiles

If you work in a financial institution, you might want to work with IBM Cloud Framework for Financial Services validated products.
This is described more fully in the diagrams for the deployment architectures for [Schematics Workspaces](https://cloud.ibm.com/docs/schematics?topic=schematics-sc-workspaces) and [Schematics Actions](https://cloud.ibm.com/docs/schematics?topic=schematics-sc-actions). The shared service executes jobs on the Schematics network. To access the users private network, the shared service will require bastion host access via the public internet.

Where policies are defined, selecting workspaces and attributes by policy, jobs are executed on the target agent on your private network. These can configure, and access your cloud or on-premises services and cluster resources, managed by your own network access policies. When using agents on your private network, bastion host access via the public internet is not required. This simplifies the infrastructure requirements when using Ansible or Terraform via SSH and eliminates a number of security considerations.

Schematics identifies and authenticates your agent using a trusted profile identity provided by the Kubernetes cluster that it runs on. This identity is dynamically created when an agent is created and deployed. The trusted profile identity guarantees that no one can spoof your agent’s identity, and steal data from Schematics. You are in control of the access permissions defined for the trusted profile identity by using IAM access policies.

The agent runtime includes Terraform, Ansible, and additional micro-services. For more information about the software utilities included in the agent runtime, see [Schematics agent runtime](https://cloud.ibm.com/docs/schematics?topic=schematics-sch-utilities).





 Private network configuration when using agents 

The following diagram illustrates a possible agent deployment model on a cluster in an environment with multiple VPCs connected via a transit gateway. Here an agent, running Terraform and Ansible jobs, has direct access to cloud resources over the private cloud network. In this deployment model, your Terraform or Ansible automations' can directly configure your cloud resources using SSH, without the need for bastion hosts to gain access via the public network.

Zoom
Responsibilities for operating services in your deployment 

In IBM Cloud, the responsibilities for deploying, operating, and securing products are shared between IBM and you, the application provider. It is important for you to understand these responsibilities for every IBM Cloud service you've deployed as part of the reference architectures.

Depending on the product, the responsibility for the following types of tasks (which span activities for Day 0, Day 1, and Day 2) can be exclusive to IBM, you, or shared. The tasks for each type of product are grouped in the following categories, which cut across nearly all of the IBM Cloud Framework for Financial Services's [best practices and requirements](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices).

Incident and operations management
: Includes tasks such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.

Change management
: Includes tasks such as deployment, configuration, upgrades, patching, configuration changes, and deletion.

Identity and access management
: Includes tasks such as authentication, authorization, access control policies, and approving, granting, and revoking access.

Security and regulation compliance
: Includes tasks such as security controls implementation and compliance certification.

Disaster recovery
: Includes tasks such as providing dependencies on disaster recovery sites, provision disaster recovery environments, data and configuration backup, replicating data and configuration to the disaster recovery environment, and failover on disaster events.

For more information, see [Shared responsibilities for using IBM Cloud products](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-shared-responsibilities).



 Responsibilities for Financial Services Validated services 

The following table provides references that describe your responsibilities for each Financial Services Validated service in the reference architecture.



Table 1. Your responsibilities for IBM Cloud services in the reference architectures

 Category VPC reference architecture Satellite reference architecture Optional for both