vania-janet/multiturn-rag-retrieval-data huggingface dataset:
By default, keys in Hyper Protect Crypto Services require only a single deletion authorization by one user with the Manager role. However, if a [dual authorization policy is set](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy), two users with the Manager role are needed to approve the deletion.
4. Make sure that you are assigned the KMS Key Purge role if you want to purge a key manually. For more information about service access roles, see [IAM service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).







 What's next 



* To learn how to delete keys that hold a single authorization policy, see [Deleting keys by using a single authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-keys).
* To learn how to delete keys that hold a dual authorization policy, see [Deleting keys by using dual authorization](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-dual-auth-keys).
* To learn how to manually purge keys, see [Purging keys manually](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-purge-keys).
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-store-backup)
* [What happens if I delete my service instances?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-delete-instance)
* [Can I back up the keys before I delete a service instance?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-backup-keys)
* [What happens when I delete a key?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-delete-a-key)
* [What happens if I lose the signature key or the master key parts?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-ha-drfaq-lose-signature-key)



[FAQs: Support and maintenance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-support-maintenancefaq-support-maintenance)



* [How is routine maintenance performed on Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-support-maintenancefaq-routine-maintenance)
* [How do I get support for Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-support-maintenancefaq-hpcs-support)







 Troubleshooting key management service 

[Why am I not authorized to make key management service API request?]
With Key Protect, you can [enforce dual authorization policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth) at the instance level or for individual keys.
* What happens after I enable a dual authorization policy?

After you enable a dual authorization policy for a Key Protect instance, any keys that you add to the instance inherit the policy at the key level. Dual authorization policies for keys cannot be reverted.

If you have existing keys in a Key Protect instance, those keys will continue to require only a single authorization to be deleted. If you want to enable those keys for dual authorization, you can use the Key Protect APIs t [set dual authorization policies for those individual keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policy).
* Can I disable a dual authorization settings for my Key Protect instance?

Yes. If you need to add a key that doesn't require dual authorization to your Key Protect instance, you can always [disable dual authorization for the Key Protect instance](/docs/key-protect?topic=key-protect-manage-dual-auth#disable dual-auth-instance-policy-ui) so that any new or future keys won't require it.
* What happens when I need to delete or deprovision my Key Protect instance?

If you decide to move on from Key Protect, you must delete any remaining keys from your Key Protect instance before you can delete or deprovision the service. After you delete your Key Protect instance, Key Protect uses[envelope encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption) to crypto-shred any data that is associated with the Key Protect instance.
* Why does the user interface show unauthorized access?

Setting and retrieving the network access policy is only supported through the application programming interface (API). Network access policy support will be added to the user interface (UI), command line interface (CLI), and software development kit (SDK) in the future.
* kp key [enable](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-enable) : enable a root key that was previously disabled; this action restores the key's encrypt and decrypt operations
* kp key [restore](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-restore) : restore a previously deleted root key, which restores access to its associated data in the cloud
* kp key [policy-update dual-auth-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policy-update-dual) : update the "dual authorization delete" policy associated with a key
* kp key [policy-update rotation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-policy-update-rotation) : update the "rotation" policy associated with a key
* kp key [schedule-delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-schedule-delete) : authorize a key, with a "dual-auth-delete" policy, to be deleted







 kp registrations 



* kp [registrations](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-registrations) : list registrations, which are associations between keys and other cloud resources such as Cloud Object Storage (COS) buckets or Cloud Databases deployments









 Update these commands 



 kp import-token
Time from key deletion Name of key state Can view or access key data? Can restore? Can user initiate purge? 

 1 second–4 hours Destroyed Yes Yes No 
 4 hours–30 days Destroyed Yes Yes Yes 
 30–90 days Destroyed Yes No Yes 
 After 90 days Purged (not a key state technically) No No Yes 



Because purged keys are inaccessible and no longer restorable, Purged is not a key state technically. However, it can be useful to think of Purged as being a state because nonexistence is part of the lifecycle of a key.

The following table lists the APIs that you can use to retrieve data that is related to a deleted key before the key becomes purged.



Table 2. Lists the API that users can use to view details about a key and the registrations.

 API Description 

 [Get a key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-key) Retrieve key details. 
 [Get key metadata](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-details) Retrieve key metadata. 
 [Get registrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources) Retrieve a list of registrations associated with the key. 



After a key is purged, you receive a 404 HTTP Not Found error when you call any API methods that use the key ID of a purged key. If you need to retain any data that is associated with a purged key, it is suggested to make the necessary API or CLI calls to retrieve and store that data in your own storage device.



 Considerations before you delete and purge a key 

Hyper Protect Crypto Services blocks the deletion of any key that is actively protecting any registered cloud resources. Before you delete a key, bare the following considerations in mind:



1. [Review the registered IBM resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources) that are associated with the key.
For more examples of PII, see section 2.2 of the [NIST Special Publication 800-122](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf).

If you set the expirationDate in your request, the key is moved to the deactivated state within 1 hour past the key's expiration date.

A successful POST /v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Hyper Protect Crypto Services key management service API.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "test-root-key",
"aliases":
"alias-1",
"alias-2"
],
"description": "A test root key",
"state": 1,
"extractable": false,
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": false,
"creationDate": "2020-03-12T03:37:32Z",
"createdBy": "...",
response, err := iamIdentityService.DeleteServiceID(deleteServiceIDOptions)
if err != nil {
panic(err)
}

const params = {
id: svcId,
};

iamIdentityService.deleteServiceId(params)
.then(res => {
done();
})
.catch(err => {
console.warn(err);
});

Deleting a service ID also deletes all associated API keys and assigned policies. This action can't be undone, and might cause disruptions between dependent services.

For more information, see the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-apidelete-service-id).





 Locking a service ID 

To avoid a situation where your service ID is deleted causing an outage or disruption for the users of your service, you have the option to lock your service ID by using the UI or CLI. Locking a service ID also prevents any policies from being changed, deleted, or assigned. In addition to the ability to lock a service ID, you can [lock individual API keys](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeyslockkey) that are associated with each service ID that you create in your account.

While locked service IDs cannot be deleted from the account and the access policies can't be updated, locked service IDs can still be removed from any access group that they are added to. This means that any access that is assigned to the ID by its membership in an access group is removed when the service ID is removed from the access group.



 Providing user access for locking service IDs 

In order for a user to have access to lock and unlock service IDs and API keys that are associated with service IDs, they must be assigned a specific access policy. Two types of access policies can grant the proper access: access to all service IDs in the account or access to a specific service ID in the account
For more information, search for [Removing an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthremove-auth) in "Using authorizations to grant access between services".





 Restore temporary access 

To restore access after you temporarily remove it, follow these steps:



1. Re-create the authorization between your Watson service and Key Protect instance as shown in [Step 3. Grant service access](https://cloud.ibm.com/docs/language-translator?topic=language-translator-keyserviceserviceauth-key).
2. Tell your IBM Client Success Manager (CSM) that you want to restore access through Key Protect.



After you re-create the authorization and your CSM confirms Watson that any delegated authorizations are reconnected, the Watson instance starts accepting connections again.





 Permanently prevent access to your data 

To delete your data securely, delete both the encrypted Watson service instance and the Key Protect key.

When you delete a data encryption key, it is not recoverable and you cannot decrypt the key. You prevent further access to the data, but you also cannot recover the data.

For more information about deleting keys, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) in the Key Protect docs.





 Rotating keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
3.
The [kp key schedule-delete](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-schedule-delete) command is the "authorization" to delete the key.

Follow this process to delete a key with a dual-auth-delete policy.



1. Create a key and enable the dual-auth-delete policy
2. User 1 schedules (authorizes) a key deletion with the kp key schedule-delete command
3. User 2 schedules (authorizes) a key deletion
4. The key is deleted after the second schedule-delete is performed, which is supported in the user interface, API, and CLI
5. If a second authorization does not occur within 7 days, the key returns to its default status



There are two ways to enable the dual-auth-delete policy:



* Set the policy for a single key using kp key policy-update dual-auth-delete
* Set the policy for the instance using kp instance policy-update dual-auth-delete; all keys created after the instance policy is enabled inherit the instance policy setting



ibmcloud kp key cancel-delete KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID



 Example 

This is an example of canceling a previously scheduled key delete.

 this key has a dual-auth-delete policy
$ ibmcloud kp key policies $KEY_ID --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
A successful request returns an HTTP 204 No Content response, which indicates that the dual authorization policy was updated for your service instance. Keys that you create or import to the service now require only one authorization before they can be deleted. For more information, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys).





 Optional: Verify dual auth policy disablement 

You can verify that a dual auth policy key has been disabled by issuing a list policies request:

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=dualAuthDelete"   -H "accept: application/vnd.ibm.kms.policy+json"   -H "authorization: Bearer <IAM_token>"   -H "bluemix-instance: <instance_ID>"

Where the <instance_ID> is the name of your instance and your <IAM_token> is your IAM token.
list the policies for the key - dual-auth-delete is
 enabled because the key inherits the instance policy
$ ibmcloud kp key policies 6a8a129b-0cd4-4667-ba57-b355a125a7ca --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T19:13:00Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:a192d603-0b8d-452f-aac3-f9e1f95e7411:policy:2427dbde-6cff-41eb-8b5a-ff26b038cafc",
"lastUpdateDate": "2020-06-22T19:13:00Z",
"updatedBy": "user id ...<redacted>...",
"dualAuthDelete": {
"enabled": true
}
}
]

 attempt to delete the key - this fails
$ ibmcloud kp key delete 6a8a129b-0cd4-4667-ba57-b355a125a7ca

Deleting key: 6a8a129b-0cd4-4667-ba57-b355a125a7ca, from instance: a192d603-0b8d-452f-aac3-f9e1f95e7411...
FAILED
kp.Error:
correlation_id='8ad33eb2-7bbf-4b7a-a02e-221959920342',
msg='Conflict: 1 prior authorization(s) are required for deletion: Key could not be deleted.
For more information, search for [Removing an authorization](https://cloud.ibm.com/docs/account?topic=account-serviceauthremove-auth) in "Using authorizations to grant access between services".





 Restore temporary access 

To restore access after you temporarily remove it, follow these steps:



1. Re-create the authorization between your Watson service and Key Protect instance as shown in [Step 3. Grant service access](https://cloud.ibm.com/docs/natural-language-understanding?topic=watson-keyserviceserviceauth-key).
2. Tell your IBM Client Success Manager (CSM) that you want to restore access through Key Protect.



After you re-create the authorization and your CSM confirms Watson that any delegated authorizations are reconnected, the Watson instance starts accepting connections again.





 Permanently prevent access to your data 

To delete your data securely, delete both the encrypted Watson service instance and the Key Protect key.

When you delete a data encryption key, it is not recoverable and you cannot decrypt the key. You prevent further access to the data, but you also cannot recover the data.

For more information about deleting keys, see [Deleting keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-keys) in the Key Protect docs.





 Rotating keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. For more information, see [Setting a rotation policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-rotation-policy) in the Key Protect docs.





 Identify which key is encrypting your service instance 

To see which Key Protect instance is used to encrypt the data, use the link in the service details.



1. Go to your [resource list](https://cloud.ibm.com/resources).
2. Click the name of the Watson service instance.
3.
Key policies are [dual authorization delete](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-policy-update-dual) and [rotation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-policy-update-rotation).

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

c024c2b3-2093-46e5-aabb-fdf8cbc14e44

 show key details
$ ibmcloud kp key show $KEY_ID --output json

{
"id": "c024c2b3-2093-46e5-aabb-fdf8cbc14e44",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-18T20:34:39Z",
"lastUpdateDate": "2020-06-18T20:34:39Z",
"keyVersion": {
"id": "c024c2b3-2093-46e5-aabb-fdf8cbc14e44",
"creationDate": "2020-06-18T20:34:39Z"
},
"extractable": false,
"state": 1,
If it's necessary for a user to control encryption keys, root keys can be provided on a [per-object basis that uses SSE-C](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-sse-c), or a [per-bucket basis that uses SSE-KP](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-kp).

Storage can be accessed over HTTPS, and internally storage devices communicate with each other using TLS.



 Credential and encryption key rotation 

Credentials, such as HMAC and API keys, do not naturally expire. Over time, it is possible that employee turnover or an accidental mishandling of information can result in unintended or unwanted access to cloud resources. Following a rotation schedule can help to prevent this scenario. Read more about [rotation of encryption keys](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-kpkp-lifecycle) and [access credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-manual-rotation&interface=ui).





 Access Control Lists 

Access control lists (often referred to as ACLs) are an outdated method for controlling access to object storage resources. Some APIs exist for setting individual objects to a public-read status, but this is discouraged in favor of [using IAM to allow unauthenticated access to an entire bucket](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-public-access), and using these buckets to serve any open data.





 Data deletion 

IBM Cloud Object Storage data is erasure coded and distributed to multiple individual storage devices in multiple data centers. When data is deleted, various mechanisms exist which prevent recovery or reconstruction of the deleted objects. Deletion of an object undergoes various stages. First, the metadata is marked to indicate the object is deleted, then, the data is removed.
Preventing access to data 

To temporarily prevent access, you can disable your root key. As a consequence, Event Notifications can no longer access the data because it can no longer access the key.

To remove access permanently, you can delete the key. However, you must take extreme caution because this operation is non-recoverable. You will lose access to any data stored in your Event Notifications instance. There is no way to recover this data.

In both cases, the Event Notifications instance shuts down and no longer accepts or processes connections. An activity tracker event is generated to report the action. For more information, see [Event Notifications events](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-at_events).

The authorization should be left in place between your Event Notifications and the key management service instance at all times. While removing this authorization prevents Event Notifications from future access to your data, already in-use data will continue to be available for a period of time.

You are charged for your instance of Event Notifications until you deprovision it using the IBM Cloud console or CLI. These charges are still applied even if you chose to prevent access to your data.





 Restoring access to data 

Access can be restored only if the key was not deleted. To restore access, re-enable your root key. After a short period of initialization, your Event Notifications instance is restarted and starts accepting connections again. All data is retained, subject to the normal retention limits configured in your instance.

An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-at_events).





 Rotating the key 

Key Protect and Hyper Protect Crypto Services support the rotation of root keys, either on demand or on a schedule.
For more information, see [deleting keys using dual authorization](https://cloud.ibm.com/docs/key-protect?topic=key-protect-delete-dual-auth-keys) and [setting dual authorization policies for keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-dual-auth-key-policy).



 Notes 

Dual authorization delete for an instance is different than dual authorization delete for keys.

Once you enable dual-auth-delete for a key you cannot disable it or remove it. You must wait 7 days for the policy to expire.

Dual authorization delete for an instance can be enabled or disabled anytime.

If a key has a dual-auth-delete policy, changing the instance policy does not change any existing key policies.

When you change the instance policy, new keys are enforced with the instance policy.

ibmcloud kp instance policy-update dual-auth-delete
-i, --instance-id INSTANCE_ID
-d, --disable OR
-e, --enable





 Examples 

These are examples of kp instance policy-update dual-auth-delete.



 Example 1 

This example enables the dual authorization delete policy.

 enable the instance dual authorization policy
$ ibmcloud kp instance policy-update dual-auth-delete --enable

Updating instance policy...
OK

 list the instance policies
$ ibmcloud kp instance policies --output json

[
{
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-22T18:45:14Z",
"lastUpdated": "2020-06-22T18:45:14Z",
"updatedBy": "user id ...<redacted>...",
"policy_type": "dualAuthDelete",
"policy_data": { "enabled": true
}
}
]