vania-janet/multiturn-rag-retrieval-data huggingface dataset:
About VPC+ Cloud Migration 



  What is VPC+ Cloud Migration? 

VPC+ Cloud Migration is a third-party, software-based migration-as-a-service solution for migrating components from IBM Cloud® classic infrastructure to your IBM Cloud Virtual Private Cloud (VPC). VPC+ Cloud Migration allows you to discover and choose resources for migration, and create and set up those resources in your VPC environment. You can also run and manage your VPC environment from within the tool.

VPC+ Cloud Migration, which is managed by Wanclouds, follows industry best practices to ensure that their application tool is secure and protects your sensitive information.





  What resources can be migrated? 

You can migrate the following key elements of IBM Cloud classic infrastructure to VPC:



*  Subnets
*  Virtual server instances
*  Dedicated hosts
*  Storage volumes (primary and secondary)
*  Security groups
*  Load balancers
*  Firewall (ACL) configuration
*  VPN configuration
*  SSH keys
*  Public gateway







  Next steps 

When you are ready to start working with VPC+ Cloud Migration, see [Getting started with VPC+ Cloud Migration](https://cloud.ibm.com/docs/wanclouds-vpc-plus?topic=wanclouds-vpc-plus-getting-started-tutorial).
About subnets in VPC 

IBM Cloud® has specific terminology for the types, and uses, of subnets. Knowing their intended use helps you understand how best to use them in your cloud infrastructure.

To understand subnets and subnetting in general, review [Subnetwork](https://en.wikipedia.org/wiki/Subnetwork). Additionally, subnets are referred to in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing).

Subnets are networks created within a VPC. Subnets are a fundamental mechanism within VPC used to allocate addresses to individual resources (such as Virtual server instances), and enable various controls to these resources through the use of network ACLs, routing tables, resource groups.

Subnets are bound to a single zone; however, they can reach all other subnets within a VPC, across a region. They are created from a larger address space within the VPC called an address prefix; and you can provision multiple subnets per address prefix.



 Subnets features 

Subnets have the following features:



* Routable throughout your VPC across an entire region and further on-prem through Transit Gateway and Direct Link.
* Provide unique IP addresses to VPC resources including:



* [Bare metal servers](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-for-bare-metal-servers)
* [Virtual server instances](https://cloud.ibm.com/docs/vpc?topic=vpc-vsi_best_practices)
* [Virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe)
* Appliances and virtual appliances



* IP range selection: Provision subnets of any size, as small as /29 and up to /9 from any IP address space.
* [Network ACLs](https://cloud.ibm.com/docs/vpc?topic=vpc-using-acls): Access control lists (ACLs) can be used to control all incoming and outgoing traffic in IBM Cloud VPC.
VPC resource attributes

 Resource Resource Attribute 

 Auto Scale for VPC instanceGroupId:<instance-group-id> 
 Backup service backupPolicyId: <backup-policy-id> 
 Block Storage for VPC volumeId: <volume-id> 
 Baremetal server bareMetalServerId: <bare-metal-server-id> 
 Dedicated Host for VPC dedicatedHostId:<dedicated-host-id> 
 File Storage shareId: <share-id> 
 Floating IP for VPC floatingIpId: <fip-id> 
 Flow Logs for VPC flowLogCollectorId: <flc-id> 
 Image Service for VPC imageId:<image-id> 
 Load Balancer for VPC loadBalancerId: <load-balancer-id> 
 Network ACL networkAclId: <nacl-id> 
 Placement Group for VPC placementGroupId: <placement-group-id> 
 Public Gateway for VPC publicGatewayId: <pgw-id> 
 Security Group for VPC securityGroupId: <default-sec-grp-id> 
 Snapshots snapshotId: <snapshot-id> 
 SSH Key for VPC keyId:<key-id> 
 Subnet subnetId: <subnet-id> 
 Virtual Private Endpoint for VPC endpointGatewayId:<endpoint-gateway-id> 
 Virtual Private Cloud vpcId: <vpc-id> 
 Virtual Server for VPC instanceId: <instance-id> 
 VPN for VPC vpnGatewayID: <vpn-gateway-id> 



Review the following tables that outline what types of tasks each role allows when you're working with the VPC Infrastructure Services service. Platform management roles enable users to perform tasks on service resources at the platform level. For example, assign user access to the service, create or delete instances, and bind instances to applications. Service access roles enable user access to VPC Infrastructure Services and the ability to call the VPC Infrastructure Services API.

VPC Infrastructure Services Platform roles

VPC Infrastructure Service roles



Table 2. IAM VPC Infrastructure Services platform roles

 Platform role Description of actions
About File Storage for VPC 

IBM Cloud® File Storage for VPC is a zonal file storage offering that provides NFS-based file storage services. You create file shares in an availability zone within a region. You can share them with multiple virtual server instances within the same zone or other zones in your region, across multiple VPCs. You can also mount a file share to a specific virtual server instance within a VPC.

IBM Cloud® File Storage for VPC is available for customers with special approval to preview this service in the Frankfurt, London, Madrid, Dallas, Toronto, Washington, Sao Paulo, Sydney, Osaka, and Tokyo regions. Contact your IBM Sales representative if you are interested in getting access.



 Overview 

File Storage for VPC provides file shares within the VPC Infrastructure. You create file shares at the zonal level, for example, us-south-1. File shares are identified by name and associated with a resource group in your IBM Cloud customer account.

You create a file share in a zone and create the mount targets for the share per VPC. You can control how the file share is accessed by specifying the [access mode](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-about&interface=uifs-mount-access-mode): VPC-wide access or targeted access for a specific instance within a zone.

You can set up [replication](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-replication) between the source file share and a replica file share. So if an outage at the primary site was to occur, you can fail over to the replica file share.

Data on a file share is encrypted at rest with IBM-managed encryption by default. For added security, you can use your own root keys to protect your file shares with customer-managed keys. When you specify the security group access mode and attach a [virtual network interface](https://cloud.ibm.com/docs/vpc?topic=vpc-vni-about) to the file share mount target, you can enable encryption of data in transit.
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"image": {
"id": "'$image_id'"
}
}'
Show more





 Provision an instance from a private catalog image by using the API 

You can provision an instance with a private catalog image by specifying the image's offering_crn or the version_crn subproperty as the value of the catalog_offering property.



* Create an instance by using a private catalog image from the latest version of a catalog product offering.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
"name": "my-instance",
"zone": {
"name": "us-south-3"
},
"vpc": {
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"catalog_offering": {
"offering": {
"crn": "'$offering_crn'"
}
}'
Show more
* Create an instance by using a private catalog image from a specific version of a catalog product offering.
Supported zones: https://cloud.ibm.com/docs/containers?topic=containers-regions-and-zoneszones-vpc
 Example: ZONE = "eu-de-2"

DOMAIN_NAME = "example.com"
 The DOMAIN_NAME variable should contain at least one "." as a separator. It is a private domain and it is not reacheable to and from the outside world.
 The DOMAIN_NAME variable could be like a subdomain name. Ex.: staging.example.com
 Domain names can only use letters, numbers, and hyphens.
 Hyphens cannot be used at the beginning or end of the domain name.
 You can't use a domain name that is already in use.
 Domain names are not case sensitive.

ASCS-VIRT-HOSTNAME = "sapascs"
 ASCS Virtual hostname
 Default = "sap($your_sap_sid)ascs"

ERS-VIRT-HOSTNAME = "sapers"
 ERS Virtual Hostname
 Default = "sap($your_sap_sid)ascs"

HANA-VIRT-HOSTNAME = "dbhana"
 Hana Virtual Hostname
 Default = "db($your_hana_sid)hana"

VPC = "ic4sap"
 EXISTING VPC, previously created by the user in the same region as the VSI. The list of available VPCs: https://cloud.ibm.com/vpc-ext/network/vpcs
 Example: VPC = "ic4sap"

SECURITY_GROUP = "ic4sap-securitygroup"
 EXISTING Security group, previously created by the user in the same VPC. The list of available Security Groups: https://cloud.ibm.com/vpc-ext/network/securityGroups
 Example: SECURITY_GROUP = "ic4sap-securitygroup"

RESOURCE_GROUP = "wes-automation"
 EXISTING Resource group, previously created by the user. The list of available Resource Groups: https://cloud.ibm.com/account/resource-groups
About File Storage for VPC 

IBM Cloud® File Storage for VPC is a zonal file storage offering that provides NFS-based file storage services. You create file shares in an availability zone within a region. You can share them with multiple virtual server instances within the same zone or other zones in your region, across multiple VPCs. You can also mount a file share to a specific virtual server instance within a VPC.

IBM Cloud® File Storage for VPC is available for customers with special approval to preview this service in the Frankfurt, London, Madrid, Dallas, Toronto, Washington, Sao Paulo, Sydney, Osaka, and Tokyo regions. Contact your IBM Sales representative if you are interested in getting access.



 Overview 

File Storage for VPC provides file shares within the VPC Infrastructure. You create file shares at the zonal level, for example, us-south-1. File shares are identified by name and associated with a resource group in your IBM Cloud customer account.

You create a file share in a zone and create the mount targets for the share per VPC. You can control how the file share is accessed by specifying the [access mode](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-vpc-aboutfs-mount-access-mode): VPC-wide access or targeted access for a specific instance within a zone.

You can set up [replication](https://cloud.ibm.com/docs/vpc?topic=vpc-file-storage-replication) between the source file share and a replica file share. So if an outage at the primary site was to occur, you can fail over to the replica file share.

Data on a file share is encrypted at rest with IBM-managed encryption by default. For added security, you can use your own root keys to protect your file shares with customer-managed keys. When you specify the security group access mode and attach a [virtual network interface](https://cloud.ibm.com/docs/vpc?topic=vpc-vni-about) to the file share mount target, you can enable encryption of data in transit.
To create an instance from a catalog image by using Terraform, see [Creating virtual server instances by using Terraform](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=terraformcreate-instance-terraform).





 21 October 2022 

Context-based restrictions (limited availability)
: For accounts authorized to preview this functionality, account owners and administrators can now define and enforce network access policies for IBM Cloud VPC resources. For more information about specific VPC Infrastructure services that are supported for context-based restrictions, see [Protecting Virtual Private Cloud (VPC) Infrastructure Services with context-based restrictions (limited availability)](https://cloud.ibm.com/docs/vpc?topic=vpc-cbr).





 19 October 2022 

Windows BYOL for multi-tenant hosts
: You can now bring your own license for Windows operating systems with a custom image to provision virtual server instances on multi-tenant hosts. Previously Windows BYOL was limited to dedicated hosts. For more information, see [Bring your Own License](https://cloud.ibm.com/docs/vpc?topic=vpc-byol-vpc-about) and [Getting started with custom images](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-custom-images).







 3 October 2022 

VPC Public Ingress Routing
: You can now route public internet ingress traffic (destined to a floating IP) to a VPC next-hop IP. For more information, see [Creating a routing table](https://cloud.ibm.com/docs/vpc?topic=vpc-create-vpc-routing-table) and limitations and guidelines for [Ingress routes](https://cloud.ibm.com/docs/vpc?topic=vpc-about-custom-routes&interface=uiroutes-ingress).

Currently, public ingress routing (public internet traffic choice) is available in the UI and API only. CLI is forthcoming.

Flow Logs for VPC
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port
* Check whether all virtual server instances have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Virtual Private Cloud (VPC) has no public gateways attached at the time of provisioning
* Check whether App ID redirect URIs are not using wildcards (*)
* Check whether Virtual Servers for VPC instance has all interfaces with IP-spoofing disabled
* Check whether account has at least one VPN or Direct Link configured
* Check whether Virtual Private Cloud (VPC) classic access is disabled
* Check whether Virtual Private Cloud (VPC) has no rules in the default security group
* Check whether all network interfaces of a virtual server instance have at least one Virtual Private Cloud (VPC) security group attached
* Check whether Container Registry image pushes and pulls take place only over private endpoints
* Check whether Virtual Servers for VPC instance has the minimum # interfaces
* Check whether Virtual Private Cloud (VPC) has no subnet with public gateway attached
* Check whether Hyper Protect Crypto Services is accessible only through private endpoints
* Check whether Virtual Private Cloud (VPC) security groups have outbound ports that are open only to permitted IP addresses
* Check whether Virtual Private Cloud (VPC) is configured with public gateways that are provisionable only within permitted zones
* Check whether a security group other than the default for Virtual Private Cloud is attached to all endpoints
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to RDP port
* Check whether App ID redirect URIs are not using localhost or 127.0.0.1
* Check whether Cloud Object Storage is accessible only by using private endpoints
* Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port







 NIST supplemental guidance 

This control enhancement applies to both inbound and outbound network communications traffic.
* --source-acl: The ID or name of the network ACL to copy rules from.
* --source-acl-vpc: The ID or name of the source network ACL's VPC. This is only required to specify the unique source network ACL by name inside this VPC.
* --resource-group-id: ID of the resource group. This ID is mutually exclusive with --resource-group-name.
* --resource-group-name: Name of the resource group. This name is mutually exclusive with --resource-group-id.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is network-acl-update 

Update a network ACL.

ibmcloud is network-acl-update ACL --name NEW_NAME [--vpc VPC] [--output JSON] [-q, --quiet]



 Command examples 



* ibmcloud is network-acl-update 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --name my-renamed-acl
* ibmcloud is network-acl-update my-acl --name my-renamed-acl
* ibmcloud is network-acl-update my-acl --vpc my-vpc --name my-renamed-acl
* ibmcloud is network-acl-update 72b27b5c-f4b0-48bb-b954-5becc7c1dcb3 --name my-renamed-acl --output JSON







 Command options 



* ACL: ID or name of the network ACL.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --name: New name of the network ACL.
ibmcloud is vpc-routing-table-route-create VPC ROUTING_TABLE --zone ZONE_NAME --destination DESTINATION_CIDR [--action delegate_vpc | delegate | deliver | drop] [--priority PRIORITY] [--next-hop NEXT_HOP --vpngw VPNGW]] [--name NAME] [--output JSON] [-q, --quiet]

Where:



* VPC is the ID or name of the VPC.
* ROUTING_TABLE is the ID or name of the VPC routing table.
* --zone is the name of the zone.
* --destination is the destination CIDR of the route. At most, two routes per zone in a table can have the same destination, and only if both routes have an action of deliver.
* --action is the action to perform with a packet that matches the route. Actions are delegate_vpc, delegate, deliver, and drop.
* --priority is the route's priority. Values are 0, 1, 2, 3, and 4. The default value is 2. Smaller values have higher priority. If a custom routing table contains routes with the same destination, the route with the highest priority (smallest value) is selected.
* --next-hop - If the action is deliver, enter the IP address or VPN connection ID of the next hop to which to route packets.
* --vpngw - Is the name of the VPN gateway.
* --name is the name of the VPC routing table.
* --output formats the output in JSON.
* --q, quiet causes the command to run silently and does not generate any output.





 CLI examples
--------------------







 ibmcloud is vpn-gateway 

View details of a VPN gateway.

ibmcloud is vpn-gateway VPN_GATEWAY [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* VPN_GATEWAY: ID or name of the VPN gateway.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-gateway-connection 

View details of a VPN gateway connection.

ibmcloud is vpn-gateway-connection VPN_GATEWAY (CONNECTION1 CONNECTION2 ...) [--vpc VPC] [--output JSON] [-q, --quiet]



 Command options 



* VPN_GATEWAY: ID or name of the VPN gateway.
* CONNECTION1: ID or name of the VPN connection.
* CONNECTION2: ID or name of the VPN connection.
* --vpc: ID or name of the VPC. It is only required to specify the unique resource by name inside this VPC.
* --output: Specify output format, only JSON is supported. One of: JSON.
* -q, --quiet: Suppress verbose output.



--------------------







 ibmcloud is vpn-gateway-connection-create 

Create a VPN gateway connection.

ibmcloud is vpn-gateway-connection-create CONNECTION_NAME VPN_GATEWAY PEER_ADDRESS PRESHARED_KEY --local-cidr CIDR1 --local-cidr CIDR2 ... --peer-cidr CIDR1 --peer-cidr CIDR2 ...
/instance image The image from which the virtual server instance was provisioned. For example, a Debian Linux stock image. 
 /instance lifecycle_reasons The reasons for the current lifecycle_state. 
 /instance lifecycle_state The lifecycle state of the virtual server instance. 
 /instance memory The amount of memory; truncated to whole gigabytes. 
 /instance metadata_service Indicates whether the metadata service endpoint is available to the virtual server instance. (Enabled status is true or false.) 
 /instance name The user-defined name for this virtual server instance (and default system hostname). 
 /instance network_interfaces A list of the virtual server instance's network interfaces, including the primary network interface. 
 /instance placement_target The placement restrictions for the virtual server instance. 
 /instance primary_network_interface The instance's primary network interface. 
 /instance profile The globally unique name for this virtual server instance profile. For example, a bx2-2x8, balanced profile. 
 /instance startable Indicates whether the state of the virtual server instance permits a start request. 
 /instance status The status of the instance: deleting, failed, paused, pausing, pending, restarting, resuming, running, starting, stopped, or stopping. 
 /instance status_reasons The reasons for the current status. 
 /instance total_network_bandwidth The amount of bandwidth in megabits per second that is allocated exclusively to instance network interfaces. 
 /instance total_volume_bandwidth The amount of bandwidth in megabits per second allocated exclusively to the instance's block storage volumes. Increasing this value results in a corresponding decrease to total_network_bandwidth. 
 /instance vcpu The number of VCPUs assigned by way of a structure that includes count and architecture properties. 
 /instance volume_attachments A list of the virtual server instance's volume attachments. 
 /instance boot_volume_attachment Instance's boot volume attachment. 
 /instance vpc The VPC in which the virtual server instance resides. 
 /instance zone The globally unique name for the zone. 
 /instance_initialization default_trusted_profile The default trusted profile configuration that was specified at virtual server instance creation.
Understanding your responsibilities when using Virtual Private Cloud 

Learn about the management responsibilities that you have when you use IBM Cloud® Virtual Private Cloud (VPC). IBM Cloud VPC customer responsibilities apply across all VPC infrastructure services, unless otherwise noted. For overall terms of use, see [Cloud Services terms](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-termsterms).



 Overview of shared responsibilities 

IBM Cloud VPC is an infrastructure-as-a-service (IaaS) offering in the [IBM Cloud shared responsibility model](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-shared-responsibilities). Review the following table of who is responsible for particular cloud resources when you use IBM Cloud VPC. Then, you can view more granular tasks for shared responsibilities in [Tasks for shared responsibilities by area](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpctask-responsibilities).



Table 1. Responsibilities by resource

 Resource Incident and Operations Management Change Management Identity and Access Management Security and Regulation Compliance Disaster Recovery 

 Data Customer Customer Customer Customer Customer 
 Application Customer Customer Customer Customer Customer 
 Operating system Customer Customer Customer Customer Customer 
 Virtual servers Shared Shared Shared Shared Shared 
 Virtual storage Shared Shared Shared Shared Shared 
 Virtual network Shared Shared Shared Shared Shared 
 Hypervisor IBM IBM IBM IBM IBM 
 Bare metal servers Shared Shared Shared Shared Shared 
 Physical servers and memory IBM IBM Shared Shared IBM 
 Physical storage IBM IBM IBM IBM IBM 
 Physical network and devices IBM IBM IBM IBM IBM 
 Facilities and data centers IBM IBM IBM IBM IBM 







 Tasks for shared responsibilities by area 

After you reviewed the [overview](https://cloud.ibm.com/docs/vpc?topic=vpc-responsibilities-vpcoverview-by-resource), see what tasks you and IBM share responsibility for when you use IBM Cloud VPC.



 Incident and operations management 

Incident and operations management includes tasks such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.



Table 2. Responsibilities for incidents and operations

 Task IBM Responsibilities Your Responsibilities