vania-janet/multiturn-rag-retrieval-data huggingface dataset:
A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key schedule-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2. User 1 schedules (authorizes) a key deletion with the kp key schedule-delete command
3. User 2 schedules (authorizes) a key deletion
4. The key is deleted after the second schedule-delete is performed, which is supported in the user interface, API, and CLI
5. If a second authorization does not occur within 7 days, the key returns to its default status



There are two ways to enable the dual-auth-delete policy:



* Set the policy for a single key using kp key policy-update dual-auth-delete
* Set the policy for the instance using kp instance policy-update dual-auth-delete; all keys created after the instance policy is enabled inherit the instance policy setting



The [kp key cancel-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-cancel-delete) command cancels, or removes, a prior authorization.

ibmcloud kp key schedule-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]



 Example 

This is an example of scheduleing a key to be deleted.

 schedule this key to be deleted
$ ibmcloud kp key schedule-delete $KEY_ID_OR_ALIAS

Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID_OR_ALIAS --output json

[
{
"message": "Key is protecting one or more cloud resources",
"status": 409,
"moreInfo": "https://cloud.ibm.com/apidocs/key-protect",
"target": {
"type": "query_param",
"name": "force"
}
}
]
}
]
}

 Why it’s happening 

This key is actively protecting one or more cloud resources, such as a IBM Cloud® Object Storage bucket or a Cloud Databases deployment.

 How to fix it 

For your protection, Key Protect prevents the deletion of a key that's actively encrypting data in the cloud. Before you delete a key, [review which resources are encrypted by this key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) and verify with the owner of the resources to ensure you no longer require access to that data.

You can get the current list of resources associated with your key by first [synchronizing the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-sync-associated-resources), which might take up to 4 hours. Then, proceed to [viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources).

After using Sync, associations between the key and other resources will be current and up to date. If there are no associations after using Sync, the key can be deleted normally.

If the associations are still there after Sync:



* You can use the Key Protect API to [force deletion on the key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keysdelete-keys-force-delete).
* You can delete the resources associated with the key, and then delete the key normally.







 Getting help and support
What happens if the user who set up the API key for a region and resource group leaves the company? 

If the user is leaving your organization, the IBM Cloud account owner can remove that user's permissions. However, before you remove a user's specific access permissions or remove a user from your account completely, you must reset the API key with another user's infrastructure credentials. Otherwise, the other users in the account might lose access to the IBM Cloud infrastructure portal and infrastructure-related commands might fail. For more information, see [Removing user permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-usersremoving).

Consider using a functional ID user for the API key owner instead of a personal user. In case the person leaves the team, the functional ID user remains the API key owner. Keep in mind that you can't use a service ID to set the API key.





 How can I lock down my cluster if my API key becomes compromised? 

If an API key that is set for a region and resource group in your cluster is compromised, [delete it](https://cloud.ibm.com/docs/account?topic=account-userapikeydelete_user_key) so that no further calls can be made by using the API key as authentication. For more information about securing access to the Kubernetes API server, see the [Kubernetes API server and etcd](https://cloud.ibm.com/docs/openshift?topic=openshift-securityapiserver) security topic.







 Ensuring that the API key or infrastructure credentials owner has the correct permissions 

To ensure that all infrastructure-related actions can be completed in the cluster, the user whose credentials you want to set for the API key must have the proper permissions. Consider using a functional ID user for the API key owner instead of a personal user. In case the person leaves the team, the functional ID user remains the API key owner. Note that you can't use a service ID to set the API key.



1. Log in to the [IBM Cloud console](https://cloud.ibm.com/).
2.
: Now, users can [Wrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys) and [Unwrap](https://cloud.ibm.com/docs/key-protect?topic=key-protect-unwrap-keys) active root keys to provide envelope encryption. For more information, see Protecting data with [envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) for an overview.





 15 March 2021 

Key Protect supports key purge
: Beginning in April 2021, Key Protect will implement a key purge feature that will automatically purge any keys that have been deleted for more than 90 days. A purged key and its associated data will be permanently removed, or hard deleted, from the Key Protect database. When a user or service deletes a key in Key Protect today, if the key is not restored within 30 days, the key is soft deleted. All key data, except key material data, remains in Key Protect, and those details are retrievable by List Keys, Get Key and other APIs. Once automatic key purge is introduced, users will not be able to retrieve any information regarding a purged key. Any API calls that use the Key ID of a purged key will result in a 404 HTTP Not Found error.



* Note: A key purge can be reversed by restoring the hard deleted key.
* How will the changes impact my environment? The majority of users will not notice an impact. Please note that any data related to a purged key (key metadata, registrations, policies, etc) will no longer be available via the Key Protect service. If you are required to retain any data related to a purged key (key metadata, registrations, policies, etc) for an extended period of time, it is recommended to perform the necessary API or CLI calls to retrieve and store that data in your own storage device.







 05 February 2021 

Key Protect supports new UI actions
: If you have Manager access permissions, you can filter for keys in the Destroyed state and restore an imported root key via the ⋯ icon on the Keys table.
Volume, snapshot, and image resources that are protected by the deleted root key have an unusable status and can't be used for normal operations. File Storage for VPC shares show a suspended status. The storage system is offline, and data cannot be accessed.

Your data still exists. You have a 30-day grace period to [restore the deleted key](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-restore-root-key). Otherwise, your encrypted resources become inaccessible. After 30 days, your root key can't be restored, and your resources are unrecoverable.

By default, the KMS prevents you from deleting a root key that's actively protecting a resource. You can force delete a root key in Key Protect and Hyper Protect Crypto Services. When you force delete a root key, the following actions happen automatically:



* If the deleted root key is protecting boot volumes, the associated virtual server instance is stopped.
* If the deleted root key is protecting data volumes, the associated virtual server instance is stopped.
* If the deleted root key is protecting file shares, the file share is suspended.
* Deleting a root key purges usage of the key for all resources in the VPC.
* Events are logged in the Activity Tracker.



To force the deletion of a root key in Hyper Protect Crypto Services, use the API. Hyper Protect Crypto Services requires that you delete all resources before you delete a root key that is protecting those resources. If you can't delete the key, see [troubleshooting key management service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-delete-keys).

Block Storage for VPC volumes, snapshots, and custom images with a deleted root key appear in the list of resources with an unusable status. File Storage for VPC shares show a suspended status. The API reason code is encryption_key_deleted.

Deletion of the root key results in the following conditions.
The IBM Cloud instance ID that identifies your Key Protect instance.

You can set an environment variable instead of specifying -i with the following command: $ export KP_INSTANCE_ID=<INSTANCE_ID>.







 Optional parameters 



* -k, --key-material

To rotate a key that was initially generated without a --key-material parameter, that is kp key create my-key, omit the --key-material parameter.

If a key was created with the --key-material parameter then specify the new base64-encoded key material that you use for rotating an existing root key.

To rotate a key that was initially imported into the service, provide a new 32-byte (256-bit) key.
* --key-ring

A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key schedule-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2. User 1 schedules (authorizes) a key deletion with the kp key schedule-delete command
3. User 2 schedules (authorizes) a key deletion
4. The key is deleted after the second schedule-delete is performed, which is supported in the user interface, API, and CLI
5. If a second authorization does not occur within 7 days, the key returns to its default status



There are two ways to enable the dual-auth-delete policy:



* Set the policy for a single key using kp key policy-update dual-auth-delete
* Set the policy for the instance using kp instance policy-update dual-auth-delete; all keys created after the instance policy is enabled inherit the instance policy setting
* As a ReaderPlus, you can browse a high-level view of keys, access key material for standard keys, and perform wrap and unwrap actions. The ReaderPlus role cannot modify key material.



* How do I monitor API calls to Key Protect?

You can use the IBM Cloud Activity Tracker service to track how users and applications interact with your Key Protect instance. For example, when you create, import, delete, or read a key in Key Protect, an Activity Tracker event is generated. These events are automatically forwarded to the Activity Tracker service in the same region where the Key Protect service is provisioned.

To find out more, check out [IBM Cloud® Activity Tracker events](https://cloud.ibm.com/docs/key-protect?topic=key-protect-at-events).
* How can I check what data is encrypted by which root key?

When you use a root key to protect at rest data with envelope encryption, the cloud services that use the key can create a registration between the key and the resource that it protects. Registrations are associations between keys and cloud resources that help you get a full view of which encryption keys protect what data on IBM Cloud.

You can [browse the registrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources) that are available for your keys and cloud resources by using the Key Protect APIs.
* What happens when I delete a key?

In the event that a key is no longer needed or should be removed, Key Protect allows you to delete and ultimately purge keys, an action that shreds the key material and makes any of the data encrypted with it inaccessible.

Deleting a key moves it into a Destroyed state, a "soft" deletion in which the key can still be seen and restored for 30 days. After 90 days, the key will be automatically purged, or "hard deleted", and its associated data will be permanently shredded and removed from the Key Protect service. If it is desirable that a key be purged sooner than 90 days, it is also possible to hard delete a key four hours after it has been moved into the Destroyed state.
Deactivated and Suspended keys have not been deleted, and still count as non-deleted versions. For more information about key states, check out [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).



 Pricing scenarios 



* Scenario: You have one non-deleted key that has been rotated 19 times, which means it has 20 total versions.



* Pricing: Your charge is USD15.675 per month (the first five key versions are free).



* Scenario: You have one non-deleted key that has been rotated four times, meaning the key has five total versions.



* Pricing: Your charge is USD0 per month.



* Scenario: You have one non-deleted key with 20 total versions, another key with three versions, and a key in the Suspended state with two versions.



* Pricing: Your charge is USD20.9 per month.





You are charged for all versions of all non-deleted keys that exist in your instances during the billing period (minus the five free key versions). This includes keys you create (or import) and delete before the month is over. If for example you create and delete a key the same day, you are charged USD1.045 that month for the key (if you have more than five key versions in your instances). However, you will not be charged the following month for that key if it remains deleted. If you restore the key at any point, you will be charged for all of the versions of that key for that month. For more information about deleting keys, check out [About deleting and purging keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-purge-keys).





 How many key versions do you have? 

To see how many versions you have of each key you have deployed:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/).
2. Go to Menu > Resource List to view a list of your resources.
3.
description A description for the registration. 
 preventKeyDeletion A boolean that determines whether Hyper Protect Crypto Services must prevent deletion of the root key. If true, the associated resource is nonerasable due to a retention policy, and the Hyper Protect Crypto Services key that is encrypting the resource cannot be deleted. 
 keyVersion The version of the root key that's protecting the cloud resource. 





 Listing registrations for a specific root key with the API 

You can retrieve the registration details that are associated with a specific root key by making a GET call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/registrations



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. View the registrations that are associated with a root key by running the following cURL command.

curl -X GET 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/registrations 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>'

Replace the variables in the example request according to the following table.



Table 7. Describes the variables needed to list all registrations that are associated with a root key

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-de, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request.
When you enable a root key that was previously disabled, the key transitions from the Suspended (value is 2) to the Active (value is 1) key state. This action restores the key's encrypt and decrypt operations.

If you're using an integrated Cloud Service that supports restoring access to a disabled root key, the service may take up to a maximum of 4 hours before access to the root key's associated data is restored.

After access to the associated data is restored, a corresponding enable event is displayed in the IBM Cloud Activity Tracker web UI. The enable event indicates the key has been restored (and is now enabled) and the key can be used for encrypt and decrypt operations, such as wrap, unwrap, and rewrap.

ibmcloud kp key enable <KEY_ID_OR_ALIAS> -i <INSTANCE_ID> [ --key-ring KEY_RING_ID]



 Examples 

This is an example of kp key enable.

 create a root key
$ ibmcloud kp key create my-root-key --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 show key details - a state of "1" is "active"
$ ibmcloud kp key show 264fadc3-7667-4b25-916e-5825fe70de0b --output json

{
As an admin, you might need to temporarily [disable a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-disable-keys) if you suspect a possible security exposure, compromise, or breach with your data.

Disabling a root key suspends its encrypt and decrypt operations. After confirming that a security risk is no longer active, you can restore access to your data by [enabling](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-enable) the disabled root key.

When you disable a root key that was previously enabled, the key transitions from the Active (value is 1) to the Suspended (value is 2) key state.

To disable a root key, you must be assigned a Manager service access role for the instance or key. To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).

If you're using an integrated Cloud Service that supports revoking access to a disabled root key, the service may take up to a maximum of 4 hours before access to the root key's associated data is revoked.

After access to the associated data is revoked, a corresponding disable event is displayed in the IBM Cloud Activity Tracker web UI. The disable event indicates the key has been revoked (and is now disabled) and the key can not be used for encrypt and decrypt operations.

ibmcloud kp key disable KEY_ID
-i, --instance-id INSTANCE_ID



 Examples 

These are examples of kp key disable.



 Example 1 

Create a root key, disable it, verify the key state (suspended), enable the root key, and verify the key state (active).

 create a root key
$ ibmcloud kp key create my-root-key --output json

{
-i, --instance-id INSTANCE_ID
-e, --enable
[-o, --output OUTPUT]



 Example 

This example enables the dual authorization delete policy.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

d887bfe8-5166-4dad-af32-7e3055ca1873

 show key details
$ ibmcloud kp key show $KEY_ID --output json

{
"id": "d887bfe8-5166-4dad-af32-7e3055ca1873",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-19T16:07:50Z",
"lastUpdateDate": "2020-06-19T16:07:50Z",
"keyVersion": {
"id": "d887bfe8-5166-4dad-af32-7e3055ca1873",
"creationDate": "2020-06-19T16:07:50Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:key:d887bfe8-5166-4dad-af32-7e3055ca1873"
}
After you delete your Key Protect instance, Key Protect uses[envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) to crypto-shred any data that is associated with the Key Protect instance.
* Why does the user interface show unauthorized access?

Setting and retrieving the network access policy is only supported through the application programming interface (API). Network access policy support will be added to the user interface (UI), command line interface (CLI), and software development kit (SDK) in the future.

After the network access policy is set to private-only the UI cannot be used for any Key Protect actions.

Keys in a private-only instance will not be shown in the UI and any Key Protect actions in the UI will return an unauthorized error (HTTP status code 401).



Secrets Manager



* What is a secret?

A secret is a piece of sensitive information. For example, a secret might be a username and password combination or an API key that you use while you develop your applications. To keep your applications secure, it is important to regulate which secrets can access what and who has access to them.

In addition to the static secrets described, there are other types of secrets that you might work with in the Secrets Manager service. To learn more about secret types, check out [Types of secrets](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-what-is-secretsecret-types).
* What is a secret group?

A secret group is a means to organize and control access to the secrets that you store within Secrets Manager. There are several different strategies that you might use to approach secret groups. For more information and recommendations, see [Best practices for organizing secrets and assigning access](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-best-practices-organize-secrets).
* What is an IAM credential?

An IAM credential is a type of dynamic secret that you can use to access an IBM Cloud resource that requires IAM authentication.
A unique, human readable name for the key-ring. Required if the user doesn't have permissions on the default key ring.









 kp key schedule-delete 

A key with a dual-auth-delete policy requires authorization from two administrative users to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2. User 1 schedules (authorizes) a key deletion with the kp key schedule-delete command
3. User 2 schedules (authorizes) a key deletion
4. The key is deleted after the second schedule-delete is performed, which is supported in the user interface, API, and CLI
5. If a second authorization does not occur within 7 days, the key returns to its default status



There are two ways to enable the dual-auth-delete policy:



* Set the policy for a single key using kp key policy-update dual-auth-delete
* Set the policy for the instance using kp instance policy-update dual-auth-delete; all keys created after the instance policy is enabled inherit the instance policy setting



The [kp key cancel-delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-cancel-delete) command cancels, or removes, a prior authorization.

ibmcloud kp key schedule-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]



 Example 

This is an example of scheduleing a key to be deleted.

 schedule this key to be deleted
$ ibmcloud kp key schedule-delete $KEY_ID_OR_ALIAS

Scheduling key for deletion...
OK

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID_OR_ALIAS --output json

[
{