vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see the [Updated handling of IBM Cloud API keys for users removed from accounts](https://www.ibm.com/cloud/blog/announcements/updated-handling-of-ibm-cloud-api-keys-for-users-removed-from-accounts) blog post.







 January 2020 



 21 January 2020 

IBM Cloud Shell (Beta) is now available
: We're introducing a new way to access IBM Cloud from the command line with no installation needed - IBM® Cloud Shell! IBM Cloud Shell is a cloud-based shell environment that gives you instant command-line access through your web browser. It's preconfigured with the full IBM Cloud CLI, all CLI plug-ins, and tons of tools so you have everything that you need to manage apps, resources, and infrastructure. To try out this beta release, see [Getting started with IBM Cloud Shell](https://cloud.ibm.com/docs/cloud-shell?topic=cloud-shell-getting-started).





 09 January 2020 

Improved Support Center
: The latest enhancement to the support center offers a personalized experience to better resolve any IBM Cloud related issue. Navigate through the landing page to view incidents that are specific to your account along with a list of your open cases. Additionally, our self-help options have expanded, popular FAQs and recommended topics are populated to provide information that is relevant to your account. To check out the new experience, log in and go to the [Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) .







 December 2019 



 19 December 2019 

Disable public access to resources
: All users and service IDs are members of the Public Access group by default, which provides unauthenticated access to the resources that the group can access. You can now disable public access at the account level for cases in which you might want to prevent policies that could publicly expose resources from being created. For more information, see [Managing public access to resources](https://cloud.ibm.com/docs/account?topic=account-public).







 November 2019 



 26 November 2019 

Delete resource groups
You can also find your accounts from the CLI by running the ibmcloud account list command. This command lists the account that you own and any other accounts that are affiliated with your IBMid.





 Can I view my account ID, account type, and account number? 

Go to the [Account settings](https://cloud.ibm.com/account/settings) page in the console to view your account ID and type. The account ID is a 32 character, unique account identifier. The IBM Cloud console menu bar lists all of the accounts that are affiliated with your IBMid, including the accounts that you own. The account selector displays the account name and account number.





 How can I join accounts? 

The account owner, organization manager, or a user with the correct permissions can invite you to join their account.



* If you're new to IBM Cloud®, you receive an email that contains all the information you need.
* As an existing member of IBM Cloud®, you can accept the invitation in your notifications, by email, or by using the CLI to onboard to the new account. To accept invitations in the CLI, use the [ibmcloud login](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliaccept-invitation-to-join-a-new-account-) command.







 Can I switch between multiple accounts? 

If you have access to more than one account, you can click your account name in the console menu bar to switch to another account.

Zoom

![A screen capture of the account selector in the console menu bar. The account selector displays the account name and account number, and you select the current account to display a list of other accounts that you can access.](https://cloud.ibm.com/docs-content/v1/content/4d8c6eec891cff72b666dc24bd3211810c77fb42/account/images/account-faq.svg)

Figure 2. Account selector displays all accounts to which you have access





 Can I move data between IBM Cloud accounts?
The [IBM Cloud Identity and Access Management (IAM)](https://cloud.ibm.com/docs/services/account?topic=account-iamoverview) service provides two types of API keys:



* user API keys: These API keys provide full access to all of the services and resources that the user has access to.
* service API keys: You can configure service API keys to provide specific access to various services and resources.



Some services cannot use service ID API keys. In such cases, the pipeline user interface prompts you to specify a user API key.

Because pipeline jobs run user-created scripts that might use service API keys in arbitrary ways, the pipeline cannot determine the set of restrictions to apply to a particular key. In such cases, if you request that the pipeline creates an API key, it creates a user API key. To maintain strong security, instead use a service API key with access that is restricted to only the services and resources that you need in the script. In this instance, you must create the API key yourself. For more information about creating an API key, see [IBM Cloud API keys](https://cloud.ibm.com/docs/account?topic=account-userapikeycreate_user_key).







 Jobs 

A job is an execution unit within a stage. A stage can contain multiple jobs, and the jobs in a stage run sequentially. By default, if a job fails, subsequent jobs in the stage do not run.

Zoom

![Build and test jobs within a stage](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/jobs.png)

Figure 3. Build and test jobs within a stage

Jobs run in discrete working directories within Docker containers that are created for each pipeline run. Before a job is run, its working directory is populated with input that is defined at the stage level. For example, you might have a stage that contains a test job and a deploy job.
* UI
* CLI
* API







 Logging in with a federated ID 

As a federated user that uses a corporate or enterprise single sign-on ID, you can log in to IBM Cloud® from the console by using a federated ID and password. You can also log in from the command-line interface (CLI) by using a one-time passcode or an API key.

By using federated IDs, you don't need to set up new login credentials specific to IBM Cloud, for example, by using IBMid. Instead, users in your organization can easily log in to IBM Cloud with their organization credentials through your identity provider (IdP).

When a user logs in, the user gets an IAM token, which is a temporary credential that expires after 1 hour. After that time, the token must be refreshed to secure the connection and to continue accessing account resources to which they are assigned access. For more information about using federated IDs, see [Setting up your IBM Cloud account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started).



 Using the console to log in 

Use the following steps to log in to the IBM Cloud console:



1. Go to the [IBM Cloud login page](https://cloud.ibm.com/login).
2. Enter your ID, and click Continue.
3. Enter your password.



After you log in, you are directed to the IBM Cloud dashboard, which provides various development, account management, and infrastructure widgets.





 Using trusted profiles to log in to the console 

Account administrators use trusted profiles to manage specific access for account users. Each profile includes a different set of access policies that map to the roles or actions that you need to be productive. For example, a developer might use access group membership to do their daily work, but at some point during the week they might need to do some operations work in production environments. In this case, the developer would authenticate themselves and then take explicit action to apply a trusted profile that has the access policies they need to do operations work in production.



 Applying trusted profiles as an IBMid user
ibmcloud account org-account ORG_NAME [-r, --region REGION] [--guid]



 Command options 

-r (optional)
: Region name. Default to current region if not specified.

--guid (optional)
: Display account ID only







 ibmcloud account show 

Show account details:

ibmcloud account show



 Examples 

Show details of currently targeted account:

ibmcloud account show







 ibmcloud account update 

Update a specific account:

ibmcloud account update (--service-endpoint-enable true | false)



 Command options 

--service-endpoint-enable true | false
: Enable or disable service endpoints connectivity for a SoftLayer account.





 Examples 

Enable service endpoint connectivity for current account:

ibmcloud account update --service-endpoint-enable true







 Classic infrastructure account audit-logs 

List SoftLayer account audit logs:

account audit-logs [-u, --user-name USER_NAME] [-t, --object-type OBJECT_TYPE] [-o, --object OBJECT] [-a, --action ACTION] [-s, --start-date START_DATE] [-e, --end-date END_DATE]



 Command options 

-a, --action ACTION
: Action. List audit logs with the action.

-e, --end-date END_DATE
: End date. List audit logs before the end date. Supported formats are yyyy-MM-ddTHH:mm:ss.

o, --object OBJECT
: Object. List audit logs with the object.

t, --object-type OBJECT_TYPE
: Object type. List audit logs with the object type.

s, --start-date START_DATE
: Start date. List audit logs after the start date. Supported formats are yyyy-MM-ddTHH:mm:ss.

u, --user-name USER_NAME
: User name. List audit logs with the user name.





 Examples 

List audit logs:
(https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/atracker/images/endpoint_s3.svg)](https://cloud.ibm.com/docs/atracker?topic=atracker-getting-started-mng-endpointsgetting-started-mng-endpoints-step3)



 Prerequisites 



* You need a user ID that is a member, or an owner of, an IBM Cloud account. To get an IBM Cloud user ID, go to: [Create an account](https://cloud.ibm.com/login).
* If you prefer to work with the command line, you must install the IBM Cloud CLI. For more information, see [Installing the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
* Your user ID needs administrator platform permissions to manage the IBM Cloud Activity Tracker service. Contact the account owner. The account owner can grant another user access to the account for the purposes of managing user access, and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).







 Step 1: Check your account is VRF enabled 

By default, public endpoints are enabled in your account. To allow the usage of private endpoints in your account, you must enable the account for virtual routing and forwarding (VRF).



* When using the classic infrastructure, you connect to resources in your account over the IBM Cloud public network by default. You can enable virtual routing and forwarding (VRF) to move IP routing for your account and all of its resources into a separate routing table. If VRF is enabled, you can then enable IBM Cloud service endpoints to connect directly to resources without using the public network. [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
* If your account [restricts service ID creation](https://cloud.ibm.com/docs/account?topic=account-restrict-service-id-create), the Service ID creator role to IAM Identity Service in the console (iam-identity in the API or CLI).
* If your account [restricts API key creation](https://cloud.ibm.com/docs/account?topic=account-allow-api-create), the User API key creator role to IAM Identity Service in the console (iam-identity in the API or CLI).
* If you plan to [encrypt your cluster](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkeyprotect):



* Assign the user the appropriate permission to the key management service (KMS) provider, such as the Administrator platform access role.
* For clusters that run Kubernetes 1.18.8_1525 or later: When you enable KMS encryption, an additional Reader[service-to-service authorization policy](https://cloud.ibm.com/docs/account?topic=account-serviceauth) between IBM Cloud Kubernetes Service and your KMS provider, such as Key Protect, is automatically created for your cluster, if the policy doesn't already exist. Without this policy, your cluster can't use all the [Key Protect features](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms-keyprotect-features).



* Viewer platform access role for the resource group access.



Infrastructure
: 

* Classic clusters only: Super User role or the [minimum required permissions](https://cloud.ibm.com/docs/containers?topic=containers-classic-roles) for classic infrastructure.
* VPC clusters only: Administrator platform access role for [VPC Infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started).



User that creates the cluster
: In addition to the API key, each individual user must have the following permissions to create a cluster.
:
"account_id": "003e9bc3993aec710d30a5a719e57a80",
"crn": "crn:v1:bluemix:public:compose-redis:us-south:a/003e9bc3993aec710d30a5a719e57a80:416d769b-682d-4833-8bd7-5ef8778e5b52",
"resource_group_crn": "crn:v1:bluemix:public:resource-controller::a/003e9bc3993aec710d30a5a719e57a80::resource-group:b4570a825f7f4d57aa54e8e1d9507926",
"target_crn": "crn:v1:bluemix:public:resource-catalog::a/e97a8c01ac694e308ef3ad7795c7cdb3::deployment:e62e2c19-0c3b-41e3-b8b3-c71762ecd489:us-south38399"
},
"parameters": {
"location": "us-south",
"optional-param":"parameter required by your service"
}
}





 Understanding the IBM Cloud context parameter 

In the previous example, you can see the metadata returned in the context parameter. The context for IBM Cloud returns the following:



* platform: Identifies the platform as ibmcloud
* account_id: Returns the ID of the account in IBM Cloud that is creating the service instance.
* crn: When a customer creates your service in IBM Cloud, a service instance is created, and this instance is identified by its IBM Cloud Resource Name (CRN). The CRN is used in all aspects of the interaction with IBM Cloud including creating instances, binding (creating credentials and endpoints), metering, dashboard display, and access control.
Therefore, it allows sharing resources across accounts by creating an IAM authorization policy. Such policies can be created in many ways, including [in the browser console](https://cloud.ibm.com/iam/authorizations/grant) as shown below, utilizing the CLI or by executing Terraform code.

In the following examples, a specific Object Storage instance in the source account is granted the Reader role for that identified Key Protect instance in the current account.

Zoom

![Grant a service-to-service authorization](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/solution65-resource-sharing/grant_service_authorization.png)

Grant a service-to-service authorization

The following shows the Terraform code to create a [resource with the same IAM authorization policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy):

resource "ibm_iam_authorization_policy" "cross_account_policy" {
source_service_account = data.ibm_iam_account_settings.account_a_settings.account_id
source_service_name = "cloud-object-storage"
source_resource_instance_id = data.ibm_resource_instance.cos_resource_instance.guid

target_service_name = "kms"
target_resource_instance_id = data.ibm_resource_instance.kms_resource_instance.guid

roles = ["Reader"]
description = "read access on Key Protect in Main Account for Account A"
}

The same authorization policy can be created using the [IBM Cloud CLI with the iam service-policy-create command](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_service_policy_create):
: Specify this option to [log in with a federated ID](https://cloud.ibm.com/docs/iam?topic=iam-federated_id). Using this option prompts you to authenticate with your single sign-on provider and enter a one-time passcode to log in.

-u USERNAME
: The IBM Cloud user name.

-p PASSWORD
: The user password.

--apikey API_KEY or @API_KEY_FILE_PATH
: The API key content or the path of an API key file that is indicated by the @ symbol.

--no-iam
: Force authentication with the login server instead of the public IAM.

-c ACCOUNT_ID
: The ID of the target account. This option is exclusive with the --no account option.

--no-account
: Forced login without the account. This option isn't recommended, and it is exclusive with the -c option.

-g RESOURCE_GROUP
: The name or ID of the target resource group.





 Examples 

Log in to IBM Cloud by entering tom for the user ID and 123 for the password.

ibmcloud login -a cloud.ibm.com -u tom -p 123





 Output 

The command returns the following output:

Targeted account tom Account (abc123cf7ca78fb1997fcbd8999106af)

API endpoint: https://cloud.ibm.com
Region: us-south
User: tom
Account: tom's Account (abc123cf7ca78fb1997fcbd8999106af)
Resource group: No resource group targeted, use 'ibmcloud target -g RESOURCE_GROUP'
CF API endpoint:
Org:
Space:

Tip: If you are managing Cloud Foundry applications and services
- Use ibmcloud target --cf to target Cloud Foundry org/space interactively, or use ibmcloud target --cf-api ENDPOINT -o ORG -s SPACE to target the org/space.
You need to go through this process only once.<br><br>If you have problems when you associate your IBMid with an IBM Cloud account, see [Why is my password incorrect?](https://cloud.ibm.com/docs/account?topic=account-ts_logintoibm) 
 IBM Cloud account To order and use IBM Cloud services, an IBM Cloud account is required. Billing information is associated with the IBM Cloud account. The price of the physical and virtual infrastructure and the resulting licenses are charged to your IBM Cloud account. 









 Step 1: Accessing the VMware Solutions console 

The VMware Solutions console is the user interface where you order and manage your deployments. To access the console:



1. Go to [https://cloud.ibm.com/vmware](https://cloud.ibm.com/vmware).
2. Log in to the console with your IBMid.







 Step 2: Planning the deployment 

Before you order an instance, consider the size of the VMware® deployment required.

VMware deployments are sized based on the CPU, memory, and storage that are required to run the targeted workload. If you are planning a workload migration from on-premises to the cloud, the on-premises size is a good starting point. VMware deployments are elastic and you can resize them at any time.

After the basic size of the VMware environment is established, consider the performance characteristics and bare metal host type.

You can choose from the following storage performance tiers:



* 0.25 IOPS/GB
* 2 IOPS/GB
* 4 IOPS/GB
* 10 IOPS/GB



Depending on the selected region, you can choose bare metal servers with various CPU and memory sizes.





 Step 3: Ordering a VMware as a Service instance 

You must specify the following settings when you order a VMware as a Service instance.

These configurations are used to order a new VMware cluster for running the target workload:



* Instance name
* Resource group
* Cluster name
* Location (geography, region, and data center)
* Host profile and quantity
Identities in IBM Cloud 

The two major concepts of IBM Cloud® IAM are identity and access management. For more information, review the following sections and [Access management concepts](https://cloud.ibm.com/docs/account?topic=account-access-management-overview).

The identity concept consists of user identities, service and app identities, API keys for users and service IDs, trusted profiles, and resource identities. Users are identified by their IBMid, SoftLayer ID, App ID user ID, or federated user attributes.

Removing access for inactive identities can reduce the risk of unauthorized access to your IBM Cloud resource and help you manage access more efficiently. For more information, see [Identifying inactive identities](https://cloud.ibm.com/docs/account?topic=account-id-inactive-identities).



 Users 

User IDs are best used when a person needs a digital identity in an account. Users are invited to the account and given access to the resources in the account. Users log in by using their IBMid, SoftLayer ID, App ID user ID, or federated user ID. Each user is also identified by a generated ID called an IAM ID.

IAM IDs always include a realm to identify the provider of the user, such as IBMid or an external identity provider. In the IAM ID, the realm is followed by a series of numbers that is a unique identifier. For example, the IAM ID for a user with an IBMid would look like IBMid-20000AB1C.

IAM IDs are most commonly used when you assign access to others by using the API. They are used to identify a user, service ID, trusted profile, or resource. The IAM ID is included in the token when used in the console, CLI, or API. Access policies are defined by using IAM IDs since it is the identity that can be verified in the IAM token.

To find your IAM ID, go to Manage > Access (IAM). You can see your IAM ID in the My user details section.
* UI
* CLI
* API







 Creating trusted profiles 

You can use trusted profiles to grant different IBM Cloud® identities access to resources in your account. Automatically grant federated users access to your account with conditions based on SAML attributes from your corporate directory. Or, use trusted profiles to set up fine-grained authorization for applications that are running in compute resources. This way, you aren't required to create service IDs or API keys for the compute resources. You can also establish trust with IBM Cloud services or service IDs in another account to grant cross-account access.

A user doesn't need to be a member of the account to assume a trusted profile. A user can use the profile as long as the user has the same identity provider (IdP) as the trusted profile and they meet the conditions of trust.

When you initially create a trusted profile, you can build conditions of trust with the following entity types: federated users, compute resources, service IDs, or IBM Cloud services. After you create the trusted profile, you can add more conditions to combine multiple entity types in the same profile.

You can use Activity Tracker to monitor which federated users compute resources, service IDs, and IBM Cloud services apply a trusted profile. For more information, see [Monitoring login sessions for trusted profiles](https://cloud.ibm.com/docs/account?topic=account-trusted-profile-monitor).



 Before you begin 

If you have the following access, you can create trusted profiles:



* Account owner
* Administrator role on all account management services
* Administrator role on the IAM Identity Service. For more information, see [IAM Identity service](https://cloud.ibm.com/docs/account?topic=account-account-servicesidentity-service-account-management).







 Establishing trust with federated users in the console 

Complete the following steps to define which federated users can access specific resources:



1. [Enable authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).
2. In the IBM Cloud console, click Manage > Access (IAM), and select Trusted profiles.