vania-janet/multiturn-rag-retrieval-data huggingface dataset:
An account owner can adjust the [user list visibility setting](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting) on the Settings page by selecting one of the following options:



* Unrestricted view: All users in your account can view everyone else in the account.
* Restricted view: Limits the ability to view users on the Users page to only those who have been granted explicit access, along with those who have visibility of other users through a classic infrastructure user hierarchy relationship.



* Do I need to assign access to a user when I invite them to the account?

No. You can invite users, and then assign access later.
* What does it mean for a user to be in pending state?

A user who is list as Pending is a user who has been invited to IBM Cloud but who hasn't accepted their invitation. On the Users page, the management actions for these users include resending the invitation or cancelling the invitation.

When inspecting access group memberships or access policies in your account, you might see memberships or policies that are related to pending users that were created as part of the invite. These display with an IAM ID that uses the BSS-. This IAM ID is a placeholder for the memberships and policies until the user accepts the invitation. And, since the user hasn't registered with IBM Cloud, they can't retrieve an IAM access token to leverage the assigned access. When the user accepts the invitation and registers with IBM Cloud, the ID in these memberships and policies is replaced with their assigned IAM ID.
* How do I add authentication into my web and mobile apps?

IAM is used to manage access to your IBM Cloud services and resources. With IBM Cloud App ID, you can take cloud security one step further by adding authentication into your web and mobile apps. With just a few lines of code, you can easily secure your Cloud-native apps and services that run on IBM Cloud. Ready to get started? [Check out the docs](https://cloud.ibm.com/docs/services/appid?topic=appid-getting-startedgetting-started).
* Where do I manage a user's access to infrastructure?
: Through [Kubernetes service account token volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/service-account-token-volume-projection), the apps that run in your linked cluster's [Kubernetes namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) and use the namespace's service account can exchange the service account public key to get an IBM Cloud IAM access token. Your app can use this access token to authenticate API requests to IBM Cloud services, such as databases, Watson, or VPC infrastructure. Through the access policies of the trusted profile, you control what actions the token lets the app perform.



 Prerequisites 

To use IBM Cloud IAM identities for pods in your cluster, verify that you meet the prerequisites.

Minimum required permissions



* Viewer[platform](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles) access role and the Writer[service](https://cloud.ibm.com/docs/containers?topic=containers-iam-service-access-roles) access role for the cluster in IBM Cloud IAM for Kubernetes Service.
* The iam-identity.profile.create and iam-identity.profile.linkToResource actions for the [IAM identity service](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsiam-identity-service).







 Creating an IAM trusted profile for your cluster in the API 

As an account administrator, create a trusted profile in IBM Cloud Identity and Access Management. For more information, see the [IAM documentation](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=ui).
FAQs - General 

This is a collection of frequently asked questions (FAQ) about the IBM® Db2® on Cloud service.



 How do I sign up for Db2 on Cloud? 

You can provision an instance of Db2 on Cloud directly through the IBM Cloud® catalog. You can [create a free IBM Cloud account](https://cloud.ibm.com/registration?target=%2Fcatalog%2Fservices%2Fdb2-warehouse) and get an IBM Cloud credit of $200 that you can use towards an enterprise Db2 on Cloud plan. Or, you can sign up for a free Lite plan.





 How do I choose the Db2 on Cloud plan that's right for me? 

Db2 on Cloud offers several configurations to meet your workload requirements. The Flex plan is recommended because it allows you to dynamically scale RAM/CPU and storage as your requirements change. Other plans with fixed resources are also available. For more information, see [About](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-about).





 How do I generate credentials for my instance? 



1. Log into [IBM Cloud](https://cloud.ibm.com).
2. Open your [Resource list](https://cloud.ibm.com/resources).
3. Under Services or Cloud Foundry services, locate your Db2 on Cloud instance and click on the service name.



* Services - This list includes all instances that were created under a resource group or that were migrated into a resource group.
* Cloud Foundry services - This list includes all instances that were created under a Cloud Foundry organization and space, and were not migrated into a resource group.



4. Select the Service credentials tab > New credentials+ > Add in order to generate your service admin credentials.
5. Expand View credentials, which displays your service connectivity information including your admin credentials (username and password).
6. The admin credentials can be used to connect to both Db2 and the web console.







 Now that I've generated credentials, how do I access my Db2 on Cloud instance?
Getting started with IBM Log Analysis 

Use IBM® Log Analysis to add log management capabilities to your IBM Cloud architecture.

You can use IBM Log Analysis to manage operating system logs, application logs, and platform logs in the IBM Cloud. IBM Log Analysis offers administrators, DevOps teams, and developers advanced features to filter, search, and tail log data, define alerts, and design custom views to monitor application and system logs.



 Step 1. Before you begin 



1. [Check the regions where the IBM Log Analysis service is available](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-regions).
2. If you don't have an IBM Cloud account, [register an IBM Cloud account](https://cloud.ibm.com/login). You need an IBMid to work in IBM Cloud.







 Step 2. Provision an instance 



1. Log in to your IBM Cloud account.

Click [Log in to IBM Cloud](https://cloud.ibm.com/login) to sign in to the IBM Cloud.

After you log in with your user ID and password, the IBM Cloud console opens.
2. Click Catalog. The list of the services that are available in IBM Cloud opens.
3. To filter the list of services that is displayed, click Services and select the Logging and Monitoring category.
4. Click the IBM Log Analysis tile.
5. Select a region for the service instance.
6. Select the Lite service plan.

By default, the Lite plan is set.

For more information about other service plans, see [Pricing plans](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).
7. Specify a Service name for your IBM Log Analysis service instance.
8. Select the Default resource group.

By default, the Default resource group is set.
9. To provision the IBM Log Analysis service in the IBM Cloud selected resource group, click Create.



After you provision an instance, the IBM Log Analysis dashboard opens.
User management for enterprises 

IBM Cloud® enterprises are valuable for large companies or organizations that need to group a set of accounts while still maintaining a separation and isolation between the accounts for different departments or teams. The management of users and their access to resources in each account remains entirely separate even when the accounts are added and organized in an enterprise.

See [What is an enterprise?](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-what-is-enterprise) for more information about enterprises.

The user list for each child account in an enterprise is accessible only to users in that child account. This means the users who are invited to the enterprise and the users who are invited to the accounts within the enterprise remain entirely separate. This is beneficial because you can add multiple accounts to an enterprise and organize them as needed into account groups, but keep the user lists restricted from other accounts.

In most cases, you want to add only the users to your enterprise account that need the ability to manage the enterprise. Depending on the role the user is assigned on the [Enterprise account management service](https://cloud.ibm.com/docs/account?topic=account-account-servicesenterprise-account-management), they have varying levels of access for managing the enterprise. For example, a user assigned the Administrator role on the Enterprise service can rename the enterprise, update the domain, view usage, create accounts, and more. However, a user with the viewer or operator role is limited to viewing the accounts and account groups hierarchy for the enterprise.

Inviting users to the enterprise account doesn't provide access to manage any of the child accounts within the enterprise or their resources. If you add a user to an enterprise account that contains a number of accounts, those users do not automatically have access to manage those accounts as far as user management, billing, and more. The enterprise account users also don't have access to any resources in other accounts within the enterprise.

If you want a user to manage the enterprise and have access to resources within child accounts, you must invite them to both accounts. Assigning access policies in the enterprise account allows the user to manage the enterprise.
You can sign up for an IBM Cloud account by using an existing IBMid or by creating a new IBMid.
* IBM Cloud infrastructure account. This account is used to log in to the IBM Cloud infrastructure customer portal that provides some additional function to manage infrastructure products and services. You can get an IBM Cloud infrastructure account by upgrading your IBM Cloud account to a billable account, or by linking your existing IBM Cloud infrastructure account with your IBM Cloud account. The IBM Cloud infrastructure account that you are using must meet certain requirements. For more information, see [Signing up for required accounts](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-signing_required_accounts).



* How do I associate my IBM Cloud infrastructure credentials with the VMware Solutions console?

When you order your instance for the first time, follow the instructions on the Settings page in the console. These instructions help you locate and copy the IBM Cloud infrastructure username and API key from the IBM Cloud infrastructure customer portal. The IBM Cloud infrastructure credentials are stored in the IBM Cloud for VMware Solutions console after the first order. Future orders automatically use the stored credentials.
* How do I connect my on-premises environment to VMware Shared?

Each virtual data center has an Edge Services Gateway (ESG) which provides network connectivity to the virtual data center. On-premises connectivity to the customer virtual data center can be accomplished in the following ways:



* IPsec tunnel over the internet to the ESG
* SSL VPN tunnel over the internet to the ESG
* Direct internet access through the ESG to the VMs by using NAT or load balancing



Along with the internet access methods, you can use IBM Cloud service endpoints to access your virtual data centers from other IBM Cloud accounts. This way, you can use DirectLink or other on-premises environments to access your IBM Cloud account network options. Then, from your cloud account, you can connect into your virtual data centers by using the Cloud Service Endpoint method.
* How are my VMware virtual platform consumptions billed?

All costs for the physical and virtual infrastructure and the licenses that result from the instance are charged to your IBM Cloud account.
* If the account owner does not set the API key, [ensure that the user who sets the API key has the correct permissions](https://cloud.ibm.com/docs/containers?topic=containers-access-credsowner_permissions).
* For more information about using your Pay-As-You-Go or Subscription account to set the API key, see [Accessing the infrastructure portfolio with your IBM Cloud Pay-As-You-Go or Subscription account](https://cloud.ibm.com/docs/containers?topic=containers-access-credsdefault_account).
* If you don't have a Pay-As-You-Go or Subscription account or need to use a different IBM Cloud infrastructure account, see [Accessing a different IBM Cloud infrastructure account](https://cloud.ibm.com/docs/containers?topic=containers-access-credscredentials).







 Understanding how the API key works 

IBM Cloud Kubernetes Service accesses the IBM Cloud infrastructure portfolio and other IBM Cloud services that you use for your cluster by using an [API key](https://cloud.ibm.com/docs/account?topic=account-manapikey). The API key impersonates, or stores the credentials of, a user with access to the infrastructure and other services. IBM Cloud Kubernetes Service uses the API key to order resources in the service, such as new worker nodes or VLANs in IBM Cloud infrastructure.



 What is the API key used for? 

The API key is used to authorize underlying actions in the following IBM Cloud services.



* Infrastructure, such as classic or VPC compute, networking, and storage resources for your cluster.
* Key Protect or Hyper Protect Crypto Services, if you [enable a key management service provider](https://cloud.ibm.com/docs/containers?topic=containers-encryptionkms) in your cluster.
* Secrets Manager, for managing the Ingress certificates for your cluster.
* Container Registry, for setting up default access to pull images from the registry to your cluster.
For more information, contact [Support](https://cloud.ibm.com/unifiedsupport/supportcenter). Make sure that you provide details about why you need to cancel your subscription.

To close a Pay-As-You-Go account or a Lite account, see [Can I cancel my account?](https://cloud.ibm.com/docs/account?topic=account-accountfaqscancelaccount).



Managing your account, resources, and access



* How do I create an IBM Cloud account?

You can create an account by [registering](https://cloud.ibm.com/registration) your email address. For identity verification, a credit card is required when you create a new account. New accounts are created as Pay-As-You-Go accounts, except purchased subscriptions. For more information, see [Account types](https://cloud.ibm.com/docs/account?topic=account-accounts).

Feature codes aren't supported in some countries. For more information, see [personal use availability](https://cloud.ibm.com/docs/account?topic=account-account-getting-startedsignup-personalaccts).
* How is my credit card authorized?

A credit card is required to create a new IBM Cloud account unless you have a subscription or feature code. As part of the authorization process, you might see a temporary hold on your credit card for verification and security when creating an account. This credit card hold is reversed within 24 to 72 hours. In many cases, a credit card isn't accepted because your credit card issuer didn't authorize it. For more information about issues with credit card authorization, see [Credit Card error messages](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-cc-error-messages).
* How do I get help with issues with creating an account?

If you are able to log in to an IBM Cloud account, go to the [Support Center](https://cloud.ibm.com/unifiedsupport/supportcenter) and choose one of the following options.
After the credentials are validated and the user is authenticated, a token is returned.

The token has the information to allow the user to choose an account where he is a member or owner.

The token does not include information about the account.
4. Next, the user selects an account. An access token and a refresh token are generated and returned to the user. These tokens are bound to the selected account. The tokens contain an identity, an account, and some rights.
5. At this point in the process, the IAM Identity Service generates an Activity Tracker Event Routing event with action iam-identity.user-refreshtoken.login.







 User logs in from the CLI by using a user ID and password 

When a user successfully logs in to your account through the IBM Cloud CLI by using a user ID and password, the following steps are taken:



1. To initiate log in request using the CLI, the IBM Cloud CLI must be installed. [Learn more](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli).
2. Log in to the IBM Cloud by using an API key. Run the following command: [ibmcloud login –u USER –p password](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cliibmcloud_login). The API key is forwarded to the IAM Identity Service.

The API key includes information about the account.
3. After the credentials are validated and the user is authenticated, a token is returned.

The token has the information to allow the user to choose an account where he is a member or owner.

The token does not include information about the account.
4. Next, the user selects an account. An access token and a refresh token are generated and returned to the user. These tokens are bound to the selected account. The tokens contain an identity, an account, and some rights.
5.
Google has an identifier for allAuthenticatedUsers that represents all service accounts and all users who are authenticated with a Google Account, which can also be granted access. 
 Auditing Audit with Activity Tracker Audit with AWS CloudTrail Azure Logging and Auditing Activity logs Audit with Audit logging 







 Federating users to IBM Cloud 

IBM Cloud offers two ways for you to federate your corporate identity provider (IdP), which simplifies login by giving your employees access to IBM Cloud with their company username and password. The first option is to [federate with IBMid](https://ibm.box.com/v/IBMid-Federation-Guide), and the other option is to create an IBM Cloud App ID service instance and use that as a way to federate users into an IBM Cloud account. For more information, see [Enabling authentication from an external identity provider](https://cloud.ibm.com/docs/account?topic=account-idp-integration).

In both types of federation, the user must be a member of the account, or have access to the account by a trusted profile to be able to complete operations. If trusted profiles are not configured, the account owner or administrator must invite individual IBMids into the IBM Cloud account. Only if the invited IBMid accepts the invitation is the user added the account as an active user. In the case of App ID, the user is automatically onboarded to IBM Cloud without a need to invite each user to the account. In both types of federation, the users are active IBM Cloud account users that can access the platform, including IAM-enabled resources, Cloud Foundry, and classic infrastructure all depending on their assigned access.

Trusted profiles deal with federated users differently. If the customer federates their corporate IdP, users from that IdP aren't added to an account as what we might consider a normal user. Instead, users' SAML-based IdP attributes are evaluated at login and if they meet all of the conditions for a trusted profile, they are prompted to apply one or more trusted profiles. Trusted profiles grant users the level of access they need to complete a specialized and specific set of tasks in a limited time-period, for example, 1-4 hours.
: Through [Kubernetes service account token volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/service-account-token-volume-projection), the apps that run in your linked cluster's [Kubernetes namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) and use the namespace's service account can exchange the service account public key to get an IBM Cloud IAM access token. Your app can use this access token to authenticate API requests to IBM Cloud services, such as databases, Watson, or VPC infrastructure. Through the access policies of the trusted profile, you control what actions the token lets the app perform.



 Prerequisites 

To use IBM Cloud IAM identities for pods in your cluster, verify that you meet the prerequisites.

Minimum required permissions



* Viewer[platform](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-roles) access role and the Writer[service](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-service-access-roles) access role for the cluster in IBM Cloud IAM for Kubernetes Service.
* The iam-identity.profile.create and iam-identity.profile.linkToResource actions for the [IAM identity service](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsiam-identity-service).







 Creating an IAM trusted profile for your cluster in the API 

As an account administrator, create a trusted profile in IBM Cloud Identity and Access Management. For more information, see the [IAM documentation](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profile&interface=ui).
You can create resource groups only if you're assigned the Administrator role on All Account Management services in the account. For more information, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-services).

Lite accounts can have only the default resource group, so you can't create any additional resource groups even if you have the required access.
* Can I delete a resource group?

Yes, you can delete a resource group only if it doesn't contain any resources, and it's not the default resource group. See [Deleting a resource group](https://cloud.ibm.com/docs/account?topic=account-delete_rgs) for more information.
* How do I add users to a resource group?

Resource groups are a method of organizing resources and are not directly associated with the management of users. For information on creating a resource group, see [Adding resources to a resource group](https://cloud.ibm.com/docs/account?topic=account-rgsadd_to_rgs). After your resource group is created, an account administrator can grant access to a specific user. Or, an account administrator can create an access group to provide access to a resource group. For information, see [Creating an Access Group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag) in the console. After an access group is created, complete the following steps to associate the access group with a resource group:



1. In the IBM Cloud console, click Manage > Access (IAM) and click Access groups.
2. Select an access group.
3. Click Access > Assign access.
4. Select a service, or group of services.
5. Click Next.
6. Scope the access to all resources, or select specific resources and select the resource groups attribute. Then, click Next.
7. Select the platform, service and resource group access for the resource group.
8. Click Review.
9.