vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Using private endpoints 

Create and manage Key Protect resources on IBM Cloud's private network by targeting a private service endpoint.

To get started, enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint) for your infrastructure account. After you enable VRF for your account, you can connect to Key Protect by using a private IP that is accessible only through the IBM Cloud private network. To learn more about private connections on IBM Cloud, see [Service endpoints for private connections](https://cloud.ibm.com/docs/account?topic=account-service-endpoints-overview).

To connect to Key Protect by using a private network connection, you must use the Key Protect API or the [Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference). This capability is not available from the Key Protect GUI.



 Before you begin 

Before you target a private endpoint for Key Protect:



1. Ensure that your IBM Cloud infrastructure account is enabled for [virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointvrf).

When you enable VRF, a separate routing table is created for your account, and connections to and from your account's resources are routed separately on the IBM Cloud network. To learn more about VRF technology, see [Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/dl?topic=dl-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud).

Enabling VRF permanently alters networking for your account. Be sure that you understand the impact to your account and resources. After you enable VRF, it cannot be disabled.
2.
Risk assessments also take into account risk from external parties (e.g., service providers, contractors operating information systems on behalf of the organization, individuals accessing organizational information systems, outsourcing entities). In accordance with OMB policy and related E-authentication initiatives, authentication of public users accessing federal information systems may also be required to protect nonpublic or privacy-related information. As such, organizational assessments of risk also address public access to federal information systems. Risk assessments (either formal or informal) can be conducted at all three tiers in the risk management hierarchy (i.e., organization level, mission/business process level, or information system level) and at any phase in the system development life cycle. Risk assessments can also be conducted at various steps in the Risk Management Framework, including categorization, security control selection, security control implementation, security control assessment, information system authorization, and security control monitoring. RA-3 is noteworthy in that the control must be partially implemented prior to the implementation of other controls in order to complete the first two steps in the Risk Management Framework. Risk assessments can play an important role in security control selection processes, particularly during the application of tailoring guidance, which includes security control supplementation.
Key Protect meets Service Organization Control (SOC) compliance for the following types:



* SOC 1 Type 2
* SOC 2 Type 1
* SOC 2 Type 2
* SOC 3



For information about requesting an IBM Cloud SOC report, see [Compliance on the IBM Cloud](https://ibm.com/cloud/compliance).





 PCI DSS 

Key Protect meets controls for the Payment Card Industry (PCI) data security standards to protect cardholder data. For information about requesting an attestation of compliance, see [Compliance on the IBM Cloud](https://ibm.com/cloud/compliance) or contact an IBM representative.
[Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).

To retrieve the private endpoint port associated with your allowed IP policy, you must be assigned a Manager access policy for your Key Protect instance. To learn how IAM roles map to Key Protect service actions, check out [Service access roles](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-accessmanage-access-roles).
2. Retrieve the private endpoint port assigned to your allowed IP policy by running the following curl command.

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/instance/allowed_ip_port" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>" -H "content-type: application/vnd.ibm.kms.allowed_ip_port+json"

Replace the variables in the example request according to the following table.





Table 3. Describes the variables that are needed to retrieve the private endpoint port associated with your Key Protect instance.

 Variable Description 

 region Required. The region abbreviation, such as us-south or eu-gb, that represents the geographic area where your Key Protect instance resides. <br> <br>For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-regionsservice-endpoints). 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the curl request. <br> <br>For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Key Protect service instance.
[Topology of KMIP for VMware](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/kmip-topology.svg)

Figure 1. Topology of KMIP for VMware



 KMIP for VMware and Key Protect 

When your KMIP for VMware instance is connected to Key Protect, your VMware vCenter Server® is connecting to a multitenant KMIP service that is deployed on two private network endpoints in the same IBM Cloud MZR as your Key Protect instance. The two endpoints are distributed across separate availability zones for high availability, and you must configure both endpoints as a key provider cluster in your vCenter configuration. For more information about the endpoints in each MZR and the KMIP server certificate signatures, see [Ordering KMIP for VMware instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_ordering).

KMIP for VMware also connects to IBM Cloud Key Protect by using the IBM Cloud private network rather than the public internet, and is additionally protected by TLS encryption and authentication.

When integrated with IBM Cloud Key Protect, KMIP for VMware periodically validates that your service ID has sufficient permission to your Key Protect instance and Customer Root Key. In Activity Tracker, you might occasionally see wrap events from Key Protect for these checks. The checks are started by the service ID and are not paired with corresponding key creation events from KMIP for VMware.





 KMIP for VMware and Hyper Protect Crypto Services 

When you use IBM Cloud Hyper Protect Crypto Services (HPCS), your vCenter Server is connecting to a single-tenant KMIP service that is hosted within HPCS by using IBM Secure Service Containers running on IBM LinuxOne servers, and your keys are stored in an IBM Z HSM. The KMIP endpoint is exposed by using a single DNS name and port. If you have multiple HPCS crypto units, this DNS name is load balanced to separate availability zones.









 Related links
* UI
* API







 Creating standard keys 

You can create a standard encryption key with the IBM Cloud® console, or programmatically with the Hyper Protect Crypto Services key management service API.



 Creating standard keys with the console 

[After you create an instance of the service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-provision), complete the following steps to create a standard key with the Hyper Protect Crypto Services console.

If you enable [dual authorization settings for your Hyper Protect Crypto Services instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-dual-auth), keep in mind that any keys that you add to the service require an authorization from two users to delete keys.



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. To create a new key, select the KMS keys tab in the side menu.
5. In the Keys table, click Add key, and select Create a key.

Specify the key's details:



Table 1. Describes the settings to create a key

 Setting Description 

 Key type The type of key that you would like to manage in Hyper Protect Crypto Services. From the list of key types, select [Standard key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsstandard-key-concept). 
 Key name A unique, human-readable alias for easy identification of your key. To protect your privacy, ensure that the key name does not contain personally identifiable information (PII), such as your name or location. 
 Key alias (Optional) One or more unique, human-readable aliases that you want to assign to your key for easy recognition. Alias size can be 2 - 90 characters.
Before you can set your Satellite location, you must retrieve it, which you can do by issuing: ibmcloud sat endpoint get --location {Your_Satellite_Location} --endpoint KP-SATLINK-ENDPOINT --output json | jq -r .server_host
3. You can then set your Satellite location by issuing: export KP_PRIVATE_ADDR=<Value output from step 2>"







 High availability and fault tolerance 

Because your Satellite location is an extension of the host IBM Cloud MZR, it maintains periodic communication to the host MZR using [IBM Cloud Satellite Link connectivity](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud). To avoid Key Protect availability impacts due to possible communication disruptions, it is important to follow high availability best practices.

Key Protect caches authorization requests for up to 30 minutes to maintain availability to existing active users. As a result, if the link goes down for less than 30 minutes, existing active users will not be affected, since their authorizations can be verified from the cache. However, new policy changes (for example, to revoke access from a user) made during the down time will not be effective and Key Protect will continue to allow access based on the previous policy. Similarly, users added during the down time remain unknown to Key Protect and will be denied access until communication is restored.

Auditing logs cannot be sent to your [IBM Cloud Activity Tracker instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-satellite-aboutsatellite-about-before-begin-activity) during the down time. However, these logs are stored and when the link has been restored will resume at the interruption point

If the disruption between the Satellite location and IBM Cloud lasts longer than 30 minutes, the authorization cache will expire and Key Protect on Satellite will be unavailable. Similarly, if the storage limit for auditing logs is reached, additional logs can no longer be stored. At this point, only the logs that have already been stored are sent when service is resumed.







 Deploying or modifying an HSM to work with Key Protect
Control access Assign platform and services access permissions to your projects in IBM Cloud Identity and Access Management to control who can provision and manage resources in your IBM Cloud account. 
 Based on open source Code Engine is built on a set of open source technologies such as Kubernetes, Knative, Istio, and Tekton, keeping your apps and jobs portable. 
 DDoS protection Code Engine provides out-of-the-box DDoS protection for your application. Code Engine's DDoS protection is provided by Cloud Internet Services (CIS) at no additional cost to you. DDoS protection covers System Interconnection (OSI) Layer 3 and Layer 4 (TCP/IP) protocol attacks, but not Layer 7 (HTTP) attacks. See [DDoS protection](https://cloud.ibm.com/docs/codeengine?topic=codeengine-securesecure-ddos). 







 Code Engine terminology 

Learn the basics about Code Engine by reviewing the following key terms. Afterward, you can test your knowledge and [!take a quiz](https://ibm.biz/BdfFxR)



Table 2. Code Engine Terms

 Term Description 

 Application An application, or app, runs your code to serve HTTP requests. In addition to traditional HTTP requests, IBM Cloud® Code Engine also supports applications that use WebSockets as their communications protocol. The number of running instances of an app are automatically scaled up or down (to zero) based on incoming requests and your configuration settings. An app contains one or more revisions. A revision represents an immutable version of the configuration properties of the app. Each update of an app configuration property creates a new revision of the app. 
 Build A build, or image build, is a mechanism that you can use to create a container image from your source code. Code Engine supports building from a Dockerfile and Cloud Native Buildpacks. 
 Code repository A code repository, such as GitHub or GitLab, stores source code. With Code Engine, you can add access to a private code repository and then reference that repository from your build. 
 Configmap A configmap provides a method to include non-sensitive data information to your deployment.
* Restore key: If you have Manager access permissions, you can now use the the Key Protect UI to restore a previously imported root key that was deleted. For more information, see [Restoring keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-restore-keysrestore-ui).
* Set an instance level dual authorization policy: You can now use the Key Protect UI to require two users to safely delete a key from your Key Protect instance. For more information, see [Enabling a dual authorization policy for an instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-authenable-dual-auth-instance-policy-ui).
* Set an instance level network policy: You can now use the Key Protect UI to restrict requests to public or private networks. For more information, see [Managing Network Access Policies](https://cloud.ibm.com/docs/key-protect?topic=key-protect-managing-network-access-policiesenabling-network-access-to-your-service-instance-ui).







 19 June 2020 

Announcing Key Protect CLI plug-in v.0.5.0
: The Key Protect CLI plug-in is used to manage keys in your instance. To install the Key Protect CLI plug-in, see [setting up the CLI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli). For a detailed explanation of changes in version 0.5.0, see the [CLI changelog](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-changelog).







 May 2020 



 29 May 2020 

Announcing new IBM Cloud Activity Tracker event field support
: Beginning in late May 2020, Key Protect will return updated event fields in [IBM Cloud Activity Tracker](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-monitor_events) logs. These updates will be available across all supported regions by 29 May 2020.
: Key Protect is updating its user access roles and how they correspond to Key Protect service actions. Effective 13 November 2019, Key Protect will update access roles accordingly:



* Create keys service action has current role assignments: Administrator, Editor, Writer, Manager; will have new Writer, Manager role or roles.
* Retrieve a key by ID service action has current role assignments: Administrator, Editor, Writer, Manager; will have new Writer, Manager role or roles.
* Retrieve a list of keys service action has current role assignments: Administrator, Editor, Writer, Manager, Viewer, Reader; will have new Reader, Writer, Manager role or roles.
* Wrap keys service action has current role assignments: Administrator, Editor, Writer, Manager, Viewer, Reader; will have new Reader, Writer, Manager role or roles.
* Unwrap keys service action has current role assignments: Administrator, Editor, Writer, Manager, Viewer, Reader; will have new Reader, Writer, Manager role or roles.
* Rewrap keys service action has current role assignments: Administrator, Editor, Writer, Manager, Viewer, Reader; will have new Reader, Writer, Manager role or roles.
* Rotate keys service action has current role assignments: Administrator, Editor, Writer, Manager; will have new Writer, Manager role or roles.
* Set rotation policies service action has current role assignments: Administrator, Manager; will have new Manager role or roles.
* Retrieve rotation policies service action has current role assignments: Administrator, Manager; will have new Manager role or roles.
* Delete a key by ID service action has current role assignments: Administrator, Manager; will have new Manager role or roles.



As an account owner or admin, review the existing access policies for all Key Protect users in your account to ensure that they are assigned the appropriate levels of access. To learn more about Key Protect roles and permissions, see [Managing user access](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-access).







 September 2019 



 27 September 2019 

Key Protect supports fine-grain access
: As an account admin, you can now assign fine-grained access to individual keys within a Key Protect instance.
: Added topics for [verifying your Block Storage for VPC file system](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockvpc-block-fs-verify), [enabling every user to customize the default PVC settings](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockcustomize-with-secret), and [enforcing base64 encoding for the Key Protect root key CRN](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-blockstatic-secret).

Classic-enabled VPCs
: Added steps in [Creating VPC subnets for classic access](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-subnetsca_subnet_cli) for creating a classic-enabled VPC and VPC subnets without the automatic default address prefixes.

Disabling remote health reporting
: Added [steps to disable the remote, anonymized health reporting](https://cloud.ibm.com/docs/openshift?topic=openshift-health-monitoroc_disable_telemetry_reports) of your cluster by OpenShift Container Platform to comply with privacy laws, organizational standards, or data governance practices.

Gateway firewalls and Calico policies
: For classic clusters in Dallas and Frankfurt, updated the required IP addresses and ports that you must open in a [public gateway firewall device](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_outbound), [private gateway device firewall](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_private), or [Calico network isolation policies](https://github.com/IBM-Cloud/kube-samples/tree/master/calico-policies).





 2 November 2020 

Persistent storage
: Added the following topics.
* -s --starting-offset

Retrievies the key versions from the offset as specified by the supplied integer value.
* -t --total-count

Used to reterieve total number of key versions for a key by the supplied integer value.
* -a --all-key-states

An optional flag to return the number of versions for all key states, including keys that are not active.









 kp key wrap 

[Wrap a data encryption key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-wrap-keys) (DEK) using a root key that is stored in the Key Protect instance. A DEK is typically used to encrypt "other" pieces of information.

When you wrap a DEK with a root key, Key Protect combines the strength of multiple algorithms to protect the privacy and the integrity of your encrypted data.

You cannot wrap a standard key, that is, a key created using the -s parameter (ibmcloud kp key create my-key-name -s).

ibmcloud kp key wrap KEY_ID_OR_ALIAS
-i, --instance-id INSTANCE_ID
[--key-ring KEY_RING_ID]
[-a, --aad ADDITIONAL_DATA]
[-o, --output OUTPUT]
[-p, --plaintext DATA_KEY]



 Best practices 

Wrapping a data encryption key (DEK) creates a ciphertext. The ciphertext is encrypted information that, when unwrapped, reveals the original DEK.

The Key Protect service does not store your DEK. Save, or persist to storage, the ciphertext to make sure you can retrieve the DEK with the kp key unwrap command.

It is recommended that you never save, or persist to storage, the plaintext DEK. In your application, load the ciphertext from storage, call Key Protect to get the plaintext DEK, and use the DEK to encrypt, or wrap, "other" pieces of information.

Do not save the DEK to persistent storage.
But they can also decide to create a private data collection on the smart contract that governs their business interactions to maintain privacy over sensitive aspects of the sale, such as the price, without having to create a secondary channel. To learn more about when to use private data within a blockchain, visit the [Private Data](https://hyperledger-fabric.readthedocs.io/en/release-2.2/private-data/private-data.htmlprivate-data) concept article in the Fabric documentation.

In order to use private data with IBM Blockchain Platform, the following three conditions must be satisfied:



1. Define the private data collection. A private data collection file can be added to your smart contract. Then, at run time, your client application can use private data-specific chaincode APIs to input and retrieve data from the collection. For more information about how to use private data collections with your smart contract, see the Fabric [Secured asset transfer in Fabric](https://hyperledger-fabric.readthedocs.io/en/release-2.2/secured_asset_transfer/secured_private_asset_transfer_tutorial.html).
2. Install, propose, approve and commit. After you define the smart contract private data collection, you need to use the smart contract lifecycle process to install the smart contract package along with its private data collection on your organization peers.
3. Configure anchor peers. Because cross-organizational [gossip](https://hyperledger-fabric.readthedocs.io/en/release-2.2/gossip.html) must be enabled for private data to work, an anchor peer must exist for each organization in the collection definition. Refer to this information for [how to configure anchor peers](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-governibp-console-govern-channels-anchor-peers) on your network.



Your channel is now configured to use private data.





 Implicit data collections 

Along with the new chaincode lifecycle, Fabric v2.0 introduced the support for "implicit data collections".
* [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial)*
* [Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-security)*
* [Log Analysis](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-adoptionadoption_acc_settings)*
* [Red Hat® OpenShift® on IBM Cloud®](https://cloud.ibm.com/docs/openshift?topic=openshift-security)*
* Satellite
* [Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-access)
* [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)
* [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-getting-started)*
* [Virtual Private Cloud (VPC)](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started)*



* Application Load Balancer for VPC
* Auto Scale for VPC
* Block Storage for VPC
* Security Groups for VPC
* VPN for VPC





*The services that are noted with an asterisk can be evaluated by using the IBM Cloud for Financial Services profile.