vania-janet/multiturn-rag-retrieval-data huggingface dataset:
All root keys and standard keys, whether generated by Hyper Protect Crypto Services or imported by you, can be restored. For more information, see [Restoring keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys).





 31 March 2021 

Added: Grouping keys by using key rings
: You can now group the keys in your Hyper Protect Crypto Services instance by creating a key ring. In this case, you can manage keys and control access at the key ring level. For how to use key rings, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings).

Added: Initializing the service instance by using recovery crypto units
: Besides using smart cards and the Hyper Protect Crypto Services Management Utilities and using key part files, you can now also initialize your service instance by using recover crypto units in the Dallas (us-south) and Washington DC (us-east) regions.

When you provision a service instance in either of the Dallas or Washington DC region, two recovery units are automatically assigned without extra costs. A random master key value is automatically generated in a recovery crypto unit and copied to the other crypto units for the service instance. The master key value never appears in the clear outside of the HSMs.

For more information about the differences between the service instance initialization approaches, see [Introducing service instance initialization approaches](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-recovery-crypto-unit).

For detailed instructions, see [Initializing service instances with recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-recovery-crypto-unit).

To rotate your master key, see [Rotating master keys by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-recovery-crypto-unit).
* backup_encryption_key_crn - The CRN of a KMS key (for example, [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) or [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about)), which is then used for backup encryption. A KMS key CRN is in the format crn:v1:<...>:key:<id>.

To use a key for your backups, you must first [enable the service-to-service delegation](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protectbyok-for-backups).
* members_memory_allocation_mb - Total amount of memory to be shared between the database members within the database. For example, if the value is "6144", and there are three database members, then the deployment gets 6 GB of RAM total, giving 2 GB of RAM per member. If omitted, the default value is used for the database type is used.
* members_disk_allocation_mb - Total amount of disk to be shared between the database members within the database. For example, if the value is "30720", and there are three members, then the deployment gets 30 GB of disk total, giving 10 GB of disk per member. If omitted, the default value for the database type is used.
* members_cpu_allocation_count - Enables and allocates the number of specified dedicated cores to your deployment. For example, to use two dedicated cores per member, use "members_cpu_allocation_count":"2". If omitted, the default value "Shared CPU" uses compute resources on shared hosts.
* service-endpoints - Selects the types [Service Endpoints](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-service-endpoints) supported on your deployment. Options are public, private, or public-and-private. If omitted, the default is public.
* Review the [Activity Tracker](https://cloud.ibm.com/docs/vpc?topic=vpc-vpc-encryption-managingbyok-key-rotation-activity-tracker-events) to verify events as you manage the lifecycle of your keys.





 View root key registrations 

Block Storage for VPC volumes, snapshots, File Storage for VPC shares, and custom images that are encrypted with your key are registered against the root key in the key management service (Key Protect or Hyper Protect Crypto Services). By viewing the registration, you can map your resources to their associated encryption keys. You can quickly see which resources are protected by a root key. You can also assess the risk that is involved in disabling or deleting a key by viewing which keys are actively protecting data.

For more information the following topics.



* Key Protect - [Viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-protected-resources)
* Hyper Protect Crypto Services - [Viewing associations between root keys and encrypted IBM Cloud resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources)







 Verify root key rotation in the UI 

When you create volume, snapshot, file share, or custom image with customer-managed encryption, your root key is automatically registered in the KMS instance. You can view the registration to verify whether the key was rotated. The following procedure shows how to verify key rotation for a Block Storage for VPC volume, but steps are similar for other resources.



1. From the [IBM Cloud console)](https://cloud.ibm.com/login), go to menu icon ![menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > VPC Infrastructure > Storage > Block storage volumes. The list shows all volumes and the Encryption column displays either "Provider Managed" or the name of the KMS that is used for custoner-managed encryption.
2.
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-redis?topic=databases-for-redis-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-etcd?topic=databases-for-etcd-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery
CP-9 (d) <br><br> * Check that any Cloud Object Storage buckets used by Activity Tracker Event Routing are configured as cross-region<br> * Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated<br><br><br> 







 NIST supplemental guidance 

System-level information includes, for example, system-state information, operating system and application software, and licenses. User-level information includes any information other than system-level information. Mechanisms employed by organizations to protect the integrity of information system backups include, for example, digital signatures and cryptographic hashes. Protection of system backup information while in transit is beyond the scope of this control. Information system backups reflect the requirements in contingency plans as well as other organizational requirements for backing up information.
For how to use key aliases, see [Managing key aliases](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-key-alias).

Added: Synchronizing protected resources associated with root keys
: When the state of a root key changes, the protected resources that are associated with the root key are notified of the key lifecycle event and are encouraged to respond accordingly. In the case where the resources do not respond to the key lifecycle notification, you can now manually initiate a renotification to those associated cloud services. For more information, see [Synchronizing associated resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-sync-associated-resources).

Added: Using Virtual Private Endpoints for VPC
: You can now create virtual private endpoints (VPEs) for your IBM Cloud Virtual Private Cloud (VPC) instance to access Hyper Protect Crypto Services within your VPC network. For more information, see [Using a virtual private endpoint for VPC](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpc).

Updated: The cryptography algorithm that is used to generate signature keys
: The cryptography algorithm to generate signature keys is updated from Rivest-Shamir–Adleman 2048 (RSA 2048) to P521 Elliptic Curve (P521 EC). The cryptographic strength of P521 EC keys is equivalent to RSA 15360, which means the updated signature keys can provide the higher level of security comparing to the previous signature keys. The previous RSA 2048 signature keys are still valid and can be used.





 28 February 2021 

Added: Key verification by using the PKCS #11 API
: To ensure that no tampering has occurred to the keys that are stored in the Hyper Protect Crypto Services instance by using the PKCS #11 API, a key verification mechanism is now provided for you to check the key objects that are stored in Hyper Protect Crypto Services.
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/databases-for-mongodb?topic=databases-for-mongodb-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery
Restoring your data from another region 

If a regional disaster that affects all available zones occurs, you're notified through the [IBM Cloud status](https://cloud.ibm.com/status?selected=status) web page and an email. In this case, depending on your [pricing plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision), whether you enable failover crypto units, and your requirements for recovery time, you can restore your data with different options.



 Restoring your data by using failover crypto units 

If you are using the standard plan, and create your instance in Dallas (us-south) or Washington DC (us-east) and you enable failover crypto units, your data is restored automatically to reduce the downtime and data loss. In this case, you switch to use the failover crypto units in another region to manage your keys and perform cryptographic operations. The failover crypto units contain a backup of all the encryption keys and other resources in the operational crypto units.

At the same time, IBM repairs your service instance in the original region. If new operational crypto units are required to complete the repair, you will be notified by IBM and you need to load the master key to the new operational crypto units by [using recovery crypto units or master key parts](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode). After your original service instance is recovered, IBM automatically redirects traffic back to the original region.

To use failover crypto units to restore data in a regional disaster, make sure that you initialize and configure all the failover crypto units the same as the operational crypto units before the disaster happens. For more information about initialization approaches, see [Introducing service instance initialization approaches](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-mode).





 Restoring your data by opening an IBM support ticket
"updatedby": "IBMid-820DPWINC2",
"updatedat": "2019-03-10T12:24:22Z"
}
]
}

The interval_month and updatedat values are updated in the policy details for the key. If a different user updates a policy for a key that you created initially, the updatedby value also changes to show the identifier for the person who sent the request.









 What's next 



* After you set a rotation policy and you root key is rotated, new cryptographic key material becomes available for protecting the data encryption keys (DEKs) that are associated with the root key. Learn how to reencrypt or rewrap your DEKS without exposing the keys in their plain text form, see [Rewrapping keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rewrap-keys).
* To learn how envelope encryption helps you control the security of at-rest data in the cloud, see [Protecting data with envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption).
* To find out more about programmatically managing your keys, [check out the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
"method": "enc-zero",
"value": "DDFA4A"
}
],
"activation_date": "2027-04-18",
"expiration_date": "2028-06-29",
"tags": [
{
"name": "first-tag",
"value": "for-ibm"
}
],
"created_at": "2022-03-09T11:26:01Z",
"updated_at": "2022-03-09T11:26:04Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"referenced_keystores": [],
"instances": [
{
"id": "ea7b6b27-d71b-4fe9-bbfe-309c7ca713a6",
"label_in_keystore": "IBM CLOUD KEY",
"type": "secret_key",
"keystore": {
"group": "Production",
"type": "ibm_cloud_kms"
}
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko managed-key-sync 

Sync a managed key in keystores.

ibmcloud hpcs uko managed-key-sync --id ID --uko-vault UKO-VAULT --if-match IF-MATCH



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.
Commit the new master key value by using the cryptounit-mk-commit command. The new master key register state is changed to Full committed.
3. Reencrypt key storage and activate the new master key by using the cryptounit-mk-rotate command:



1. Encryption keys in key storage are decrypted by using the value in the current master key register and then reencrypted by using the value in the new master key register. The rewrapping takes place inside the HSM, so it's secure.
2. The new master key is activated and loaded to the current master key register in Valid state, and the new master key register is cleared and back to Empty state.











 How keys are protected during master key rotation 

In the Hyper Protect Crypto Services with Unified Key Orchestrator plan, managed keys are protected in different ways:



* Internal KMS keys that are activated in internal KMS keystores are encrypted by the master key directly.
* External keys are wrapped by one or more key-encryption keys with advanced encryption. The key-encryption keys are encrypted by the master key.



If you want to create a managed key or a vault during master key rotation, keep in mind the following considerations:



* You can still create or activate internal KMS keys. However, an Out of sync flag can be displayed. To sync each of these keys, after the master key rotation is complete, select Show details on the Actions ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) menu and then click Sync keys.
* You can create external keys with no restrictions.
* You can create vaults only after the master key rotation process is complete.







 How the IBM Cloud console reflects master key rotation 

The following flow shows how master key rotation progress is displayed in the IBM Cloud console:



1. Master key rotation process starts
"crn": "crn:v1:bluemix:public:cloud-object-storage:global:a/db995d8d9cc715cd99f13b0671d978b6:57da8e3a-a86d-4e01-b840-f22d36e6f23f:bucket:keyprotecttest",
"description": "some description"
}
}
]
}







 hpcs uko keystore-status 

Retrieve the status of a target internal or external keystore.

ibmcloud hpcs uko keystore-status --id ID --uko-vault UKO-VAULT



* Command options

--id (string)
: Required. The UUID of the keystore. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko keystores command to retrieve the UUID.
* Example

ibmcloud hpcs uko keystore-status 
--id=0325e05e-2b25-4f13-85b2-2d7f85e54359 
--uko-vault=5295ad47-2ce9-43c3-b9e7-e5a9482c362b 
--output json
* Output

The command returns the output similar to the following example:

{
"last_heartbeat": "2022-01-26T00:56:01Z",
"health_status": "ok",
"message": "Ping executed successfully."
}







 hpcs uko managed-keys-from-keystore 

List all managed keys that are activated in the target keystore.

If the --all-pages option is not set, the command only retrieves a single page of the collection.
If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk. Users can monitor that backups are successful by using the API, and periodically restore a backup to ensure validity and integrity. Users can retrieve the most recent-scheduled backup details from the [Cloud Databases CLI plug-in](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-dashboard-backupsbackups-in-the-cli) and the [Cloud Databases API](https://cloud.ibm.com/docs/messages-for-rabbitmq?topic=messages-for-rabbitmq-dashboard-backupsrestoring-a-backup-through-the-api).
* As a managed service, Cloud Databases monitors the state of your backups and can attempt to remediate when possible. If you encounter issues from which you cannot recover, contact support for more help.







 Backup Locations 

Backup location differs per database region. Ensure that the backup region location matches your data location requirements.



Table 1. Database and Backup Regions

 Database Region Backup Region 

 Dallas US Cross Regional Object Storage 
 Washington D.C. US Cross Regional Object Storage 
 London EU Cross Regional Object Storage 
 Frankfurt EU Cross Regional Object Storage 
 Tokyo AP Cross Regional Object Storage 
 Osaka AP Cross Regional Object Storage 
 Sydney AP Cross Regional Object Storage 
 Toronto Montreal Object Storage 
 Chennai Chennai Object Storage 
 Sao Paolo Sao Paolo Object Storage 



For more details about Cloud Databases Object Storage locations, review the location's [documentation](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-endpointsendpoints-geo).





 Point-in-Time Recovery