vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Data that is stored on instance storage is tied directly to the instance lifecycle and is only held temporarily. The instance storage disk is automatically created and destroyed with the instance. However, instance storage data is not lost when an instance is rebooted. For more information, see [About instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storage).





 Backup for VPC 

The IBM Cloud® Backup for VPC service automatically backs up your block storage volumes based on a schedule. You create a backup policy and plan, and associate tags to the policy, which can be applied to block storage volumes. When tags match, a backup of the volume is triggered based on the backup policy.

By using this service, you can prevent data loss, manage risk, and improve data compliance. You can retain the backups while you need them and set a retention schedule to automatically delete older backups.

Backups use the Snapshots service to create backup snapshots. Whereas snapshots are created on-demand by the user, backups are created automatically by a backup plan. For more information, see [Backup for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-service-about).





 Next steps 



* [Create block storage volumes](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-block-storage).
* [Create file shares and mount targets](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-create).
* [Create snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-create).
* [Manage instance storage](https://cloud.ibm.com/docs/vpc?topic=vpc-instance-storage-provisioning).
* [Create backup policies](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-policy-create).
[menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes.
2. On the Block Storage for VPC volume details page, select the Snapshots and Backups tab. A list of snapshots that were created manually or by backup policies is shown.
3. From the list, click the snapshot name to go to its details page.
4. From the Actions menu, click Create volume.
5. Define the new volume in the side panel. The information that you need to provide is the same as when you create a volume from the [list of snapshots](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=clisnapshots-vpc-restore-snaphot-list-ui). See Table 1 for the details.
6. When you're finished, click Save. The new volume is created.







 Creating a volume from a snapshot when you provision a virtual server instance in the UI 

Follow these steps to create a boot and a data volume from snapshots when you provision a new virtual server instance.



1. In the [IBM Cloud console](https://cloud.ibm.com/login), click the menu ![menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Virtual server instances.
2. Click Create and provision your new instance. For more information about the required fields, see the table in [Creating virtual server instances in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).
Source objects will be [encrypted using the root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about) of the source bucket, and replicas are encrypted using the root key of the target bucket.





 Lifecycle configurations 

If a [lifecycle policy is enabled](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-expiryexpiry-rules-attributes) on a target bucket, the lifecycle actions will be based on the original creation time of the object at the source, not the time that the replica becomes available in the target bucket.





 Immutable Object Storage 

Using retention policies is not possible on a bucket with [versioning enabled](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-versioning), and as versioning is a requirement for replication, it is not possible to replicate objects to or from a bucket with Immutable Object Storage enabled.





 Legacy bucket firewalls 

Buckets using [legacy firewalls to restrict access based on IP addresses](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewallfirewall-legacy-about) are not able to use replication, as the background services that replicate the objects do not have fixed IP addresses and can not pass the firewall.

It is recommended to instead [use context-based restrictions](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-setting-a-firewallsetting-cbr) for controlling access based on network information.





 Cloud Functions and Code Engine 

Configuring replication does not provide a [trigger for Cloud Functions](https://cloud.ibm.com/docs/openwhisk?topic=openwhisk-triggers) or Code Engine events at this time, but object writes and deletes will create Object:Write and Object:Delete notifications for both the source and target buckets.
To begin, make a GET /snapshots request to see a list of snapshots. You can filter by resource group and source volume ID in the request.



* To restore a boot volume from a bootable backup snapshot, specify the boot volume attachment and snapshot ID in the POST /instances request.
* To restore a data volume from a backup snapshot and attach it, specify the data volume attachment and snapshot ID in the POST /instances request.
* To restore a stand-alone volume from a snapshot, specify the snapshot ID in the POST /volumes request.



The API requests are the same as the one you use to restore from a manually created snapshot. For more information, see [Restore a volume from a snapshot with the API](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=apisnapshots-vpc-restore-API).

For more information about using the API and all backup service API methods, see [VPC API reference](https://cloud.ibm.com/apidocs/vpc/latest).





 Restoring a volume from a snapshot with Terraform 

You can create a boot or data volume from a backup snapshot with Terraform. The resource, arguments, and attributes are the same as the ones that are used to restore a volume from a manually created snapshot. For more information, see [Restore a volume from a snapshot with Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=terraformsnapshots-vpc-restore-terraform).

For more information about the Terraform resources, arguments, and attributes that are used for restoring a volume, see [ibm_is_volume](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_volume).





 Performance impact 

The performance of boot and data volumes is initially degraded when data is restored from a snapshot. Performance degradation occurs during the restoration because your data is copied from IBM Cloud® Object Storage to Block Storage for VPC in the background.
Overview of the Backup Portal 

The Backup Portal provides a central access point for managing backups and restores for all of your servers. You can create and run backup jobs, restore data, monitor computer and processes; all within the Portal.



 Starting Cloud Backup Portal 

Remember to start your [IBM Cloud® VPN](https://www.ibm.com/cloud/vpn-access) connection to get access to the IBM Cloud® private network. The Cloud Backup Portal link doesn't work otherwise.



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/login). From the menu ![Menu icon](https://cloud.ibm.com/docs-content/v1/content/921d024aca5ff45536208840a52f864567eb4068/icons/icon_hamburger.svg), select Classic Infrastructure![Classic icon](https://cloud.ibm.com/docs-content/v1/content/921d024aca5ff45536208840a52f864567eb4068/icons/classic.svg).
2. Click Storage > Cloud Backup to display the backup services.
3. Select the instance name of the IBM Cloud Account.
4. Click View backup portal to start the portal in your browser.







 Pages in the Portal 

Portal includes a series of pages where you can perform various tasks for managing backups and restores.



 Dashboard 

The Dashboard provides notifications and summary information about servers, backups, restores, and activity in your site. In the What’s new section, you can see the newest IBM Cloud® Backup for Classic Announcements along with unconfigured agent information. Such a IBM Cloud Backup for Classic agent can be configured by clicking the Configure Now link or by clicking the computers tab.

For more





 Computers 

On the Computers page, you can view server information, configure backup jobs, run jobs, and restore data.
[menu icon](https://cloud.ibm.com/docs-content/v1/content/f02b9c9adcbb7328d95a45e105cec371d50f15eb/icons/icon_hamburger.svg) > VPC Infrastructure > Compute > Virtual server instances.
2. Click Create and provision your new instance. For more information about the required fields, see the table in [Creating virtual server instances in the UI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers).
3. For the operating system, click the tab for Snapshots. The most recent bootable snapshot is listed.



* If you want to use a different snapshot, click Edit. From the list of snapshots, select a bootable snapshot for your instance's operating system. Click Save. This action populates the snapshot data in the boot volume field on the provisioning page.
* If you want to change the properties of the boot volume, such as the name, auto-delete feature, encryption, or tags, click the pencil icon. Change the property that you want and click Save. The boot volume information is updated on the provisioning page.



4. To create a data volume, under Data Volumes, click Create. A side panel is displayed.



1. Select Import from snapshot. Expand the list to select a data snapshot. The most recent data snapshot is selected by default. However, you can select any snapshot from the list.
2. The snapshot contains the properties of the original source volume, including the auto-delete status, tags, size, profile, and encryption. You can change all these properties. Keep in mind that you can change the volume name, profile, size, and IOPS later, but you cannot change encryption type or CRK after the volume is created.
3. Select a unique name, specify the size, and click Create. The data volume information is added in the Data volume list.



5.
For more information about this option, see [Restoring a volume by using fast restore](https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-restore&interface=uisnapshots-vpc-use-fast-restore).

Make a POST /backup_policies/{backup_policy_id}/plans request to create a backup plan for the policy that is identified by ID. Specify the clone_policy property and zones subproperty to indicate which zone in your region you want to create the backup snapshot clone. The zone must be different than your source zone. You can specify multiple zones. By default, you can keep a maximum of five cached backup snapshots in each zone.

You can also set up the fast restore option when you create a new backup policy and plan. Specify clone_policy as a subproperty of the plans property. For more information, see the [Create a backup policy](https://cloud.ibm.com/apidocs/vpc/latestcreate-backup-policy) in the API reference.

The following example creates a backup plan for an existing policy that includes fast restore in the us-south-2 zone. The plan specifies keeping a maximum of two cached backup snapshots.

curl -X POST "$vpc_api_endpoint/v1/backup_policies/8758bd18-344b-486a-b606-5b8cb8cdd044/plans?version=2022-12-09&generation=2"
-H "Authorization: $iam_token"
-d '{
"active": true,
"attach_user_tags": [
"hourly-backups"
],
"clone_policy": {
"max_snapshots": 2,
"zones": [
{
"name": "us-south-2"
},
{
"href": "https://us-south.iaas.cloud.ibm.com/v1/regions/us-south/zones/us-south-2"
Editor <br><br> * Create data volumes with user tags.<br> * View volume details with user tags.<br> * List volumes filtered by tag.<br> * Update user tags post volume creation.<br><br><br> 





Table 3. Snapshot user roles for backup policies

 Snapshot user role What you can do: 

 Editor <br><br> * Create snapshots with user tags.<br> * View snapshot details with tags.<br> * List snapshots filtered by tag.<br> * Update user tags post snapshot creation.<br><br><br> 







 Service-to-service authorizations 

Specific IAM user roles are required to grant service-to-service authorization that enables the backup service to detect volume tags to create a backup. For more information, see [Establishing service to service authorizations](https://cloud.ibm.com/docs/vpc?topic=vpc-backup-s2s-auth).





 Limitations in this release 

This release has the following limitations.



* You can create up to 10 backup policies per account.
* You can take a total of 750 backups per volume based on your backup policy, in your account and region. If you exceed this limit, no further backups are taken.
* The first backup and the entire volume backup cannot exceed 10 TB.
* You can't take a backup of a detached volume.
* You can't create a copy of a backup snapshot in the source (local) region.
* You can create a copy of a backup in another region. However, only one copy of the backup snapshot can exist in each region.







 Next steps 

Review [best practices](https://cloud.ibm.com/docs/vpc?topic=vpc-backups-vpc-best-practices) for creating a backup policy and the [planning checklist](https://cloud.ibm.com/docs/vpc?topic=vpc-backups-vpc-planning).
An NTP server is available from time.adn.networklayer.com, which resolves to 161.26.0.6.





 IBM Cloud Object Storage 

IBM Cloud Object Storage stores encrypted and dispersed data across multiple geographic locations. For more information about IBM Cloud Object Storage, see [Getting started with IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage).

For more information about reaching Object Storage from a VPC see [Connecting to IBM Cloud Object Storage from VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-connecting-vpc-cos).
About Data Masking 



 Overview 

Data Security Broker Shield can mask the encrypted data and return the data in a user-friendly format without decryption or with partial decryption.

Data Masking converts data values into a predefined format that is typically irreversible. A Masking Mode defines the format used to mask selected data. You can create new Masking Modes and use them in a policy or map them to a column.





 Creating a new masking mode 

This section demonstrates how to create a new masking mode that is added to the Data Protection Library.

To create a masking mode, complete the following steps:



1. Go to the Data Protection Library and in the header, click the Plus (+) sign to begin creating a new mode.
2. Select Masking Mode from the drop-down list. The Masking Mode Builder dialog appears.
3. Enter a unique Mask Mode Name (30 characters or less) and optionally, a Description of up to 100 characters.
4. Select one of the following options from the Mask Mode drop-down menu: FIXED, PATTERN, NUMERIC, CHARACTER.
5. In the Mask Format field, enter the string to be used to mask the data.
6. Click Save. The new masking mode appears in the Data Protection Library, as well as a selection in the Encryption Mode drop-down.

The compatible data types are automatically associated with the mode when you click Save. In this way, only the modes that are compatible with a column's data type are shown.







 Viewing and editing a masking mode 

This section demonstrates how to view and edit Masking Modes. However, editing is limited to modifying the name and description of the selected mode.

To view the details of a masking mode, complete the following steps:



1. Go to the Data Protection Library and click the carrot icon (>) next to Masking Modes to view the list of modes.
2. Select a mode from the list. The details for the mode appear in the window on the right.

To edit a masking mode, peform the following steps:

a.
* With TDE, you can encrypt sensitive data on database storage media, such as table spaces and files, and on backup media. Transparent Data Encryption ensures that sensitive data is encrypted, meets compliance, and provides functionality that streamlines encryption operations. The database system automatically and transparently encrypts and decrypts data when it is used by authorized users and applications. Database users do not need to be aware of TDE and database applications do not need to be adapted specifically for TDE.

TDE uses a two-tiered key hierarchy that is composed of a TDE master encryption key and a TDE data encryption key. The TDE data encryption key is used to encrypt and decrypt data, while the TDE master encryption key is used to encrypt and decrypt the TDE data encryption key.

Zoom

![Transparent Database Encryption by using the standard PKCS #11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/pkcs-database.svg)

Figure 5. Transparent Database Encryption by using the standard PKCS #11 API
* IBM Db2 default encryption protects key database files and database backup images from inappropriate access while they are stored on external storage media. The database system automatically encrypts and decrypts data when it is used by authorized users and applications. Typically, database users do not need to be aware of default encryption and database client applications do not need to be adapted specifically.

Db2 default encryption uses a two-tiered key hierarchy: Data is encrypted with a data encryption key (DEK). The DEK is encrypted with a master key and is stored in encrypted form with the database or the backup image. A unique DEK is generated by Db2 for each encrypted database and for each encrypted backup. A master key is used to encrypt a DEK. Each encrypted database is associated with one master key at one time.

Zoom

!
The encryption process manages keys that are generated by a commercially available key management service such as IBM® Key Protect and Hyper Protect Crypto Services.

Application performance is minimally impacted allowing for enterprise workflows to continue to operate in a secure environment. The Data Security Broker Manager is the cloud-based management console providing scalability, fault tolerance, and manageability of the software.





 Encryption Technology Configuration Overview: 

Data Security Broker supports data protection services that can be configured in four main modes.



 Data Encryption: 

Data Security Broker functions as an application-level encryption (ALE) software in this mode for encrypting data on a field-level basis. This is performed using Data Security Broker Manager to enumerate the data schema and enable an encryption key mapping.





 Data Tokenization: 

Data Security Broker supports length preserving and data type preserving tokenization method to anonymize data at the field level databases or in semi-structured data files.





 Record Level Encryption: 

Data Security Broker can be configured for record level encryption to support multiple keys within a single column that are mapped to respective data owners or entities. This encryption mode can be used effectively in multi-tenant or shared data environments where segmenting of the data can be challenging. In this mode, data shredding can be enabled by deleting public keys and private keys for a respective entity.





 Data Masking: 

Data Security Broker can enable simplified data masking to prevent decryption of data and sensitive file information based on configuration or deleted keys. This mode can minimize data exposure in public cloud environment and provides a better control of data exfiltration to external parties.







 Deployment Plans in IBM Cloud Data Data Security Broker: 

When you assign and customize default Data Protection Policies with Data Security Broker Manager, there are three options that you can choose to implement your data encryption policy:



 Save Policy: 

Save Policy option is selected by default. This option saves your selected data, but does not execute encryption or data protection on your database. Your policy remains saved with the application until a new policy is saved to overwrite it. You can use the saved policy to deploy or migrate it later.





 Deploy Policy: 

Deploy Policy option saves your policy and deploys your configured Data Security Broker Shield as a proxy for the configured database.
Data security 

IBM Cloud® Object Storage uses an innovative approach for cost-effectively storing large volumes of unstructured data that ensures security, availability, and reliability.

This level of security is accomplished by using Information Dispersal Algorithms (IDAs) to separate data into unrecognizable “slices”. The system distributes these slices across a network of data centers, making transmission and storage of data inherently private and secure. No complete copy of the data resides in any single storage node, and only a subset of nodes needs to be available in order to fully retrieve the data on the network.

All data in IBM Cloud Object Storage is encrypted at rest. This technology individually encrypts each object by using per-object generated keys. These keys are secured and reliably stored by using the same Information Dispersal Algorithms that protect object data by using an All-or-Nothing Transform (AONT). Key data is impossible to recover, even if individual nodes or hard disks are compromised.

If it's necessary for a user to control encryption keys, root keys can be provided on a [per-object basis that uses SSE-C](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-sse-c), or a [per-bucket basis that uses SSE-KP](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-kp).

Storage can be accessed over HTTPS, and internally storage devices communicate with each other using TLS.



 Credential and encryption key rotation 

Credentials, such as HMAC and API keys, do not naturally expire. Over time, it is possible that employee turnover or an accidental mishandling of information can result in unintended or unwanted access to cloud resources. Following a rotation schedule can help to prevent this scenario.
[-p, --plaintext DATA_KEY]



 Best practices 

Wrapping a data encryption key (DEK) creates a ciphertext. The ciphertext is encrypted information that, when unwrapped, reveals the original DEK.

The Key Protect service does not store your DEK. Save, or persist to storage, the ciphertext to make sure you can retrieve the DEK with the kp key unwrap command.

It is recommended that you never save, or persist to storage, the plaintext DEK. In your application, load the ciphertext from storage, call Key Protect to get the plaintext DEK, and use the DEK to encrypt, or wrap, "other" pieces of information.

Do not save the DEK to persistent storage. Exposing the DEK may allow others to decrypt your data.

A new ciphertext is create each time the root key is wrapped.





 Examples 

These are examples of kp key wrap.



 Example 1 

Key Protect creates a new base64-encoded data encryption key (DEK) and wraps it with the root key.

 create a root key
$ ibmcloud kp key create my-root-key

Creating key: 'my-root-key', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK
Key ID Key Name
807eb0a6-cc10-4bfe-8331-41a6f712c4ea my-root-key

 create a new key and wrap it with the root key, creating a DEK (this is the ciphertext)
$ ibmcloud kp key wrap 807eb0a6-cc10-4bfe-8331-41a6f712c4ea

Wrapping key...
OK
Ciphertext
eyJjaXBoZXJ0ZXh0IjoiKzhjbHVqcUNP ...<redacted>... NmY3MTJjNGViIn0=

 capture the ciphertext