vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Introducing service instance initialization approaches - Standard Plan 

Depending on your business needs and security requirements, Hyper Protect Crypto Services provides you with the following three approaches to initializing your service instance.



* [Initializing service instances by using smart cards and the Hyper Protect Crypto Services Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-management-utilities)
* [Initializing service instances by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-recovery-crypto-unit)
* [Initializing service instances by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeinstance-initialization-key-files)



The following table compares the three approaches:



Table 1. Comparing three approaches to initializing service instances

 Approaches Tool Master key storage Master key backup Master key rotation 

 Using smart cards and the Hyper Protect Crypto Services Management Utilities The Management Utilities The master key is composed of two or three master key parts that are stored on smart cards. You are responsible for backing up the master key using smart cards. You need to prepare new master key parts on your smart card before you can rotate the master key for your service instance. 
 Using recovery crypto units IBM Cloud TKE CLI plug-in The master key is automatically generated and stored within the recovery crypto units of your service instance. The master key is automatically backed up in recovery crypto units. You can recover your master key from the backups if the master key is lost or destroyed. You don't need to prepare a new master key for the rotation. The new master key is automatically generated in a recovery crypto unit and then propagated to the operational crypto units and other recovery crypto units. 
 Using key part files IBM Cloud TKE CLI plug-in The master key is composed of two or three master key parts that are stored on your local workstation files. The local files serve as a backup of the master key.
Setting up Terraform for Hyper Protect Crypto Services Standard Plan 

Terraform on IBM Cloud® enables predictable and consistent provisioning of IBM Cloud services so that you can rapidly build complex, multitiered cloud environments following Infrastructure as Code (IaC) principles. Similar to using the IBM Cloud CLI or API and SDKs, you can automate the provisioning, update, and deletion of your Hyper Protect Crypto Services instances by using HashiCorp Configuration Language (HCL).

This topic only covers how to set up Terraform for Hyper Protect Crypto Services Standard Plan.

Looking for a managed Terraform on IBM Cloud solution? Try out [IBM Cloud® Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-getting-started). With Schematics, you can use the Terraform scripting language that you are familiar with, but you don't have to worry about setting up and maintaining the Terraform command line and the IBM Cloud Provider plug-in. Schematics also provides pre-defined Terraform templates that you can easily install from the IBM Cloud catalog.

Before you begin, make sure that you have the [required access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access) to create and work with Hyper Protect Crypto Services resources.



 Example: Provisioning and initializing service instances by using Terraform 

Complete the following steps to create and initialize a Hyper Protect Crypto Services instance by using Terraform:



1. Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform by following the [Terraform on IBM Cloud getting started tutorial](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started).

The plug-in abstracts the IBM Cloud APIs that are used to provision, update, or delete Hyper Protect Crypto Services service instances and resources. The preferred Terraform versions are 0.13.x, 0.14.x, and 0.15.x.
* [Scalability](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newscalability-new)



* [28 February 2019](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-Feb2019)



* [Hyper Protect Crypto Services Beta is available](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newbeta-201902)



* [31 December 2018](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-Dec2018)



* [Added: Integration of Key Protect API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newkp-api)
* [Added: Support for HSM management with Keep Your own Key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhsm-kyok)
* [Deprecated: Function of accessing Hyper Protect Crypto Services through Advanced Cryptography Service Provider](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newdeprecated-acsp)









 Tutorials on key management service 

[Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-keys)



* [Objectives](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-objectives)
* [Task flow](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-flow)
Integrating IBM Cloud services with Hyper Protect Crypto Services 

You can integrate IBM Cloud services with IBM Cloud® Hyper Protect Crypto Services to build solutions for you to bring and manage your own encryption in the cloud.

After you [create an instance of the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision) and [initialize the service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm), you can integrate Hyper Protect Crypto Services with the following supported services.



 Storage service integrations 

The data that you store in IBM Cloud storage services is encrypted by default by using randomly generated keys. If you want to control the encryption keys and use your own keys to encrypt your storage, you can associate root keys that you manage in Hyper Protect Crypto Services to your storage service and leverage [envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption) to add another layer of protection to your data. As root keys are encrypted by the master key that is owned by the user, no one else including IBM Cloud administrators can access your data.



Table 1. Supported storage services

 Service Description Integration instruction 

 [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage) IBM Cloud Object Storage is a highly available, durable, and secure platform for storing unstructured data. Object storage is the most efficient way to store PDFs, media files, database backups, disk images, or even large structured datasets. <br><br> * Demo video: [Integrating IBM Cloud Object Storage with Hyper Protect Crypto Services](https://mediacenter.ibm.com/media/0_mgxwp16v)<br> * Instruction: [Server-side encryption with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-hpcs)<br><br><br>
* [Getting started with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started)
* [Monitoring the lifecycle of encryption keys in Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-key-states)
* [Creating vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaults)
* [Creating internal keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-internal-keystores)
* [Connecting to external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-connect-external-keystores)
* [Creating and installing managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys)







 23 February 2022 

Added: Using IBM Cloud Monitoring to measure Hyper Protect Crypto Services metrics
: By enabling metrics instance policy, you can now use IBM Cloud Monitoring to measure how users and applications interact with Hyper Protect Crypto Services. For more information, see [Managing metrics](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-monitoring-metrics) and [Monitoring operational metrics](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-operational-metrics).





 15 February 2022 

Added: Hyper Protect Crypto Services expands into the São-Paulo region
: You can now create Hyper Protect Crypto Services instances in the São-Paulo (br-sao) region where the infrastructure is based on IBM Cloud Virtual Private Cloud (VPC). For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).





 21 January 2022
Creating COS Cross Region bucket with a root key from a Hyper Protect Crypto Services instance requires that instance to be [configured with failover configuration](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-add-failover).

You can confirm that failover is properly configured for the selected Hyper Protect Crypto Services instance correctly using either the IBM Cloud console or CLI.

From IBM Cloud console, navigate to a Hyper Protect Crypto Services instance and click on Overview. A "Failover" section will indicate the status of crypto units in the corresponding failover regions.

Ensure the failover section is present, all validation checks are green and there are no warnings for that Hyper Protect Crypto Services instance. If you see any errors or warnings, or if the failover section is not present, [refer to the Hyper Protect Crypto Services documentation for further guidance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-add-failover).

You can also use the CLI to list all the crypto units for all instances belong to the targeted resource group:

ibmcloud tke cryptounits

To get status of crypto units for the selected instance, create a list of crypto units associated with that instance and compare them:

ibmcloud tke cryptounit-add

After the units have been selected, you can check their verification patterns:

ibmcloud tke cryptounit-compare

Make sure all of them are valid and have same verification pattern.

Once the presence of the failover configuration is verified, you may proceed to create the Cross Region bucket using the key from that Hyper Protect Crypto Services instance.

If the Cross Region bucket creation in US Cross Region with a Hyper Protect Crypto Services root key fails with a 500 error, then the user is advised to check if the status of failover configuration for that Hyper Protect Crypto Services instance (using the methods detailed above) before reattempting the bucket creation.







 Key lifecycle management 

Hyper Protect Crypto Services offers various ways to manage the lifecycle of encryption keys.
curl -X DELETE "https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>?force=true" -H 'authorization: Bearer <IAM_token>' -H 'bluemix-instance: <instance_ID>' -H "x-kms-key-ring: <key_ring_ID>" -H 'prefer: <return_preference>'

Replace the variables in the example request according to the following table.



Table 2. Describes the variables needed to delete keys with the API

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-de, that represents the geographic area where your Hyper Protect Crypto Services instance resides. For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The unique identifier for the key that you would like to delete. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services searches for the key in every key ring that is associated with the specified instance.
* [Policy-based key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policy).
* [Viewing root key versions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-versions).
* [Disabling and enabling root keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys).
* Dual authorization policies for Hyper Protect Crypto Services [instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth) and [keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-dual-auth-key-policy).
* [Viewing details about an encryption key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-key-details).
* [Viewing associations between root keys and IBM Cloud resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-view-protected-resources).
* [Restoring a deleted key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-keys).



Added: Hyper Protect Crypto Services expands into the Washington DC region
: You can now create Hyper Protect Crypto Services resources in the Washington DC (US East) region. For more information, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).





 30 June 2020 

Added: Support for quorum authentication
Security <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-drcross-region-disaster-recovery)<br><br><br> <br><br> * [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-ha-drcross-region-disaster-recovery)<br><br><br> <br><br> * [App ID](https://cloud.ibm.com/docs/appid?topic=appid-ha-dr)<br><br><br> 
 Logging and monitoring <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ha-dr)<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ha-dr)<br> * [Flow Logs for VPC](https://cloud.ibm.com/vpc?topic=vpc-ha-dr-vpc)<br><br><br> <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ha-dr)<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ha-dr)<br><br><br> 
 Integration <br><br> * [Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-disaster_recovery_scenario)<br><br><br>
Using service endpoints to privately connect to Hyper Protect Crypto Services 

To ensure that you have enhanced control and security over your data when you use Hyper Protect Crypto Services, you have the option of using private routes to IBM Cloud® service endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud private service endpoints feature, you can protect your data from threats from the public network and logically extend your private network.



 Understanding the network access policy 

A network access policy for Hyper Protect Crypto Services instances is an extra policy that customers can use to block a Hyper Protect Crypto Services instance from getting API requests from public or private networks.

The network access policy applies to newly provisioned and existing instances. For existing instances the network access policy is enforced after it is set.

Two options control network access to Hyper Protect Crypto Services instances:



* Public and private network access - this is the default
* Private network access only





 Public and private network access 

The Hyper Protect Crypto Services instance accepts API requests from both public and private endpoints.

Public and private network access is the default setting and is used if a policy is not set.

For example, multiple teams are testing a solution that uses Hyper Protect Crypto Services instances. Development and test teams issue API requests from both outside (public endpoints) and inside (private endpoints) the IBM Cloud. You allow public and private API requests to ensure each team has access to Hyper Protect Crypto Services instances during this phase of the project.





 Private network access only 

The Hyper Protect Crypto Services instance accepts API requests from only private endpoints.

For example, development and testing are complete and the solution that uses Hyper Protect Crypto Services instances is in production. You want to limit API requests to private networks for security reasons. All Hyper Protect Crypto Services API requests must originate from within the IBM Cloud.

After the network access policy is set to private-only, you cannot make any Hyper Protect Crypto Services API calls from the public network, including the API to change the policy. Make sure that the private environment is set up before setting the network access policy to private-only.

There are several ways for you to update the network settings.
Once the presence of the failover configuration is verified, you may proceed to create the Cross Region bucket using the key from that Hyper Protect Crypto Services instance.

If the Cross Region bucket creation in US Cross Region with a Hyper Protect Crypto Services root key fails with a 500 error, then the user is advised to check if the status of failover configuration for that Hyper Protect Crypto Services instance (using the methods detailed above) before reattempting the bucket creation.







 Key lifecycle management 

Hyper Protect Crypto Services offers various ways to manage the lifecycle of encryption keys. For more details, see [the Hyper Protect Crypto Services documentation](https://cloud.ibm.com/docs/services/hs-crypto?topic=hs-crypto-overview).



 Rotating Keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. The frequency of key rotations varies by organization and depends on a number of variables, such as the environment, the amount of encrypted data, classification of the data, and compliance laws. The [National Institute of Standards and Technology (NIST)](https://www.nist.gov/topics/cryptography) provides definitions of appropriate key lengths and provides guidelines for how long keys should be used.

For more information, see the documentation for rotating keys in [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-root-key-rotation-intro).





 Disabling and re-enabling keys 

As an admin, you might need to [temporarily disable a root key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-disable-keys) if you suspect a possible security exposure, compromise, or breach with your data. When you disable a root key, you suspend its encrypt and decrypt operations. After confirming that a security risk is no longer active, you can reestablish access to your data by enabling the disabled root key.





 Deleting keys and cryptographic erasure
For more information about the service architecture, see [How does Hyper Protect Crypto Services work](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overviewhow-hpcs-work).





 What are the responsibilities of users and IBM Cloud for Hyper Protect Crypto Services? 

Hyper Protect Crypto Services is a platform-as-a-service on IBM Cloud. IBM Cloud is responsible for management of servers, network, storage, virtualization, middleware, and runtime, which ensures good performance and high availability. Customers are responsible for the management of data and applications, specifically encryption keys that are stored in Hyper Protect Crypto Services and user applications that use keys or cryptographic functions for cryptographic operations.





 How is this service different from IBM Cloud HSM? 

IBM has an IaaS IBM Cloud HSM service, which is different from the Hyper Protect Crypto Services. IBM Cloud HSM is FIPS 140-2 Level 3 compliant. Hyper Protect Crypto Services provides a managed HSM service where no special skills are needed to manage the HSM other than loading of the keys. Hyper Protect Crypto Services is the only cloud service that provides HSMs that are built on FIPS 140-2 Level 4 certified hardware and that allow users to have control of the master key.





 How is Hyper Protect Crypto Services different from Key Protect? 

IBM Key Protect for IBM Cloud is a shared multi-tenant key management service that supports the Bring Your Own Key (BYOK) capability. The service is built on FIPS 140-2 Level 3 certified HSMs, which are managed by IBM.

Hyper Protect Crypto Services is a single-tenant key management service and cloud HSM for you to fully manage your encryption keys and to perform cryptographic operations. This service is built on FIPS 140-2 Level 4 certified HSMs and supports the Keep Your Own Key (KYOK) capability. You can take the ownership to ensure your full control of the entire key hierarchy with no access even from IBM Cloud administrators. Hyper Protect Crypto Services also supports industry standards such as Public-Key Cryptography Standards #11 (PKCS #11) for cryptographic operations like digital signing and Secure Sockets Layer (SSL) offloading.





 How is Keep Your Own Key different from Bring Your Own Key?
* [Creating vaults with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaultscreate-vaults-ui)
* [Creating vaults through the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaultscreate-vaults-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaultscreate-vaults-next)



[Editing vault details](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-vaultsedit-vaults)



* [Editing vault details with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-vaultsedit-vaults-ui)
* [Editing vault details with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-vaultsedit-vaults-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-edit-vaultsedit-vaults-next)



[Deleting vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults)



* [Deleting vaults with the IBM Cloud console](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults-ui)
* [Deleting vaults with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults-api)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-vaultsdelete-vaults-next)
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"createdBy": "...",
"creationDate": "2020-03-11T16:30:06Z",
"lastUpdateDate": "2020-03-11T16:30:06Z",
"algorithmMetadata": {
"bitLength": "256",
"mode": "CBC_PAD"
},
"extractable": false,
"imported": true,
"algorithmMode": "CBC_PAD",
"algorithmBitSize": 256,
"dualAuthDelete": {
"enabled": false
}
},
{
"id": "2291e4ae-a14c-4af9-88f0-27c0cb2739e2",
"type": "application/vnd.ibm.kms.key+json",
"name": "Standard-key",
"state": 1,
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:30372f20-d9f1-40b3-b486-a709e1932c9c:key:2291e4ae-a14c-4af9-88f0-27c0cb2739e2",
"createdBy": "...",