vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Platform management roles also apply to account management services that enable users to invite users, manage service IDs, access policies, catalog entries, and track billing and usage depending on their assigned role on an account management service.
* Service access roles define a user or service’s ability to perform actions on a service instance. The service access roles are manager, writer, and reader.



To manage the IBM Log Analysis service, a user needs the following roles:



* Platform role: Viewer.
* Service role: Reader.



[Learn more](https://cloud.ibm.com/docs/services/log-analysis?topic=log-analysis-iamiam).

Complete the following steps to assign a policy to an access group through the UI:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Access policies.
4. Click Assign access.
5. Grant permissions. Choose one of the following options:





 Option 1. Grant permissions on the service 

Complete the following steps:



1. Select Assign access to resources.
2. Select IBM Log Analysis.
3. Select All current regions.
4. Select All current service instances.
5. Select the platform role Viewer.
6. Select the service role Reader.
7. Click Assign.







 Option 2. Grant permissions within the context of a resource group 

Complete the following steps:



1. Select Assign access within a resource group.
2. Select a resource group.
3. If the user does not have a role that is already granted for the selected resource group, choose a role for the Assign access to a resource group field.

Depending on the role that you select, the user can view the resource group on their dashboard, edit the resource group name, or manage user access to the group.

You can select No access, if you want the user to have access only to the IBM Log Analysis service in the resource group.
4. Select IBM Log Analysis.
Managing users 

Management of users that were given access to the database is the sole responsibility of the user or users with the administrator role. The administrator has the responsibility to manage how other users in your organization access your database.

The database administrator role manages the following types of user access:



*  Web console. From the web console, users can run queries against the database.
*  Database. The administrator can grant granular access permissions to the database, including being able to access only certain tables, schemas, or even rows or columns.



For more information about user management, see:



*  [Database user management](https://www.ibm.com/support/knowledgecenter/SS6NHC/com.ibm.swg.im.dashdb.security.doc/doc/user_mgmnt.html)
Managing Juniper vSRX 

To manage the Juniper® vSRX service, use one of the following ways:



*  Log in to the J-Web Web Client by using the credentials that you can find on the Juniper vSRX service details page.
*  Access the console through an SSH connection by using the credentials that you can find on the Juniper vSRX service details page.



For more information, see [Ordering services for vCenter Server instances](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vc_addingservices).



  Juniper vSRX security and ease of use features 

Juniper vSRX provides various features for security and ease of use on VMware® vCenter Server®. The following are some considerations:



*  Any Juniper vSRX that is deployed with public access comes with its public interfaces deactivated. The deactivation ensures that the vSRX is not made available to the public internet before users are ready.
*  The default deny policy is set to permit, so you can identify any necessary flows before you lock down the vSRX traffic.
*  It is recommended that you change the default credentials that IBM® created in the service details page for Juniper vSRX: the root and admin passwords.
*  On gateway cluster installations, protectable VLANs are associated, but not routed, with the edge gateway.







  Related links 



*  [Juniper vSRX overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-juniper-overview)
*  [General FAQ about VMware Solutions](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-faq-vmwaresolutions)
*  [Contacting IBM Support](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-trbl_support)
*  [Juniper vSRX Virtual Firewall](https://www.juniper.net/us/en/products-services/security/srx-series/vsrx/)
*  [Juniper vSRX Documentation](https://www.juniper.net/documentation/product/en_US/vsrx)
Managing service keys by using terraform 

You can use the LogDNA Terraform provider to manage and rotate service keys for a Activity Tracker instance by using HashiCorp Configuration Language (HCL).



 Prereqs 



* Ensure that you have the [required access](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam) to create and work with Activity Tracker resources.
* You must have a paid service plan for the IBM Log Analysis service. [Learn more](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).
* [Install the Terraform CLI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-terraform-setupterraform-install-cli).
* [Check the IBM Cloud Provider plug-in for Terraform supported versions](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_cli).
* Get the service key that you must use to validate your credentials with the auditing instance.



* For more information on how to get a service key by using the API, see [Service keys by using the API](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api).
* For more information on how to use terraform to manage resource keys and get a service key, see [ibm_resource_key](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_key).









 Step 1. Set up the LogDNA Provider plug-in 

Complete the following steps to set up the LogDNA Provider plug-in for Terraform so that you can start managing resources:



1. Create a versions.tf file and specify the LogDNA Provider plug-in version that you want to use with the version parameter.

terraform {
required_providers {
logdna = {
source = "logdna/logdna"
Managing ALBs 

Manage the Ingress ALBs in your cluster to ensure that traffic flows uninterrupted.



 Updating ALBs 

Manually keep your ALBs up to date with the latest version, or enable automatic updates.



 Manually updating ALBs 

You can manually apply a one-time update of your Ingress ALB pods with the ibmcloud ks ingress alb update command. By default, this command applies the latest ALB image version, but you can apply a different version by including the --version option. For more information or command options, see the [CLI reference](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-clics_alb_update).

If you want to update your ALB image to a specific version with the --version option, you must [disable automatic ALB updates](https://cloud.ibm.com/docs/containers?topic=containers-ingress-alb-manageautoupdate) and then keep them disabled for as long as you want to run the specified version. Automatic updates always apply the latest version and overwrite any manual updates you apply. If you want to use a different version, you cannot enable automatic updates.



* To update all ALB pods in the cluster, run the following command.

ibmcloud ks ingress alb update -c <cluster_name_or_ID> --version <image_version>
* To update the ALB for specific ALBs, run the following command.

ibmcloud ks ingress alb update -c <cluster_name_or_ID> --version <image_version> --alb <ALB_ID> [--alb <ALB_2_ID> ...]







 Managing automatic updates 

By default, automatic updates to Ingress ALBs are enabled. If your ALBs run the Kubernetes Ingress image, your ALBs are automatically updated to the latest version of the Kubernetes Ingress NGINX image.
Managing port speeds 

You can modify the speed that your server is negotiating at without opening a support ticket.



  Before you begin 

First, go to the device menu and make sure that you have the correct account permissions to complete the task.



*  Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-navigating-devices).
*  Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-infrapermission) and [Managing device access](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-device-access).





  Managing port speeds 

Complete the following steps to update port speeds.



1.  From the Devices menu, select Device List.
2.  Select the server that you want to update.
3.  In the Overview tab, go to Network details.
4.  Select the drop-down menu in Speed (for either public or private network) to update port speed.



A manual configuration change for your server's network settings is required to complete the port speed change.
Managing a device in snapshot view 

From the device list, you can view a limited amount of information, or snapshot, for one or more devices. You can perform multiple actions on a device in snapshot view. The actions include viewing the username and password for the device, adding tags, and viewing tickets.



  Before you begin 

First, go to the device menu and ensure you have the correct account permissions to complete the tasks.



*  Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-navigating-devices).
*  Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-infrapermission) and [Managing device access](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-device-access).





  Managing a device in snapshot view 



1.  From the Devices menu, select Device List.
2.  Click the arrow next to the device that you want to expand into snapshot view.
3.  Determine what you want to do with the device.





Table 1. Snapshot view actions

 If you want to...                              Then...                                                                                                                                                

 View the username and password for the device  Select the Show Password checkbox.                                                                                                                     
 Enter tags to be associated with a device      Enter each tag for the device in the Tags field, which separated by a comma.                                                                           
 View a recent case associated with a device    Click the case number that you want redirected to the details of the case.                                                                             
 Add a case for a device                        Click Add a Case for this Device to be redirected to the Add Case page. For more information about getting support, see [Getting support](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar).
Managing service keys by using terraform 

You can use the LogDNA Terraform provider to manage and rotate service keys for a Log Analysis instance by using HashiCorp Configuration Language (HCL).



 Prereqs 



* Ensure that you have the [required access](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam) to create and work with Log Analysis resources.
* You must have a paid service plan for the IBM Log Analysis service. [Learn more](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).
* [Install the Terraform CLI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-terraform-setupterraform-install-cli).
* [Check the IBM Cloud Provider plug-in for Terraform supported versions](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_cli).
* Get the service key that you must use to validate your credentials with the logging instance.



* For more information on how to get a service key by using the API, see [Service keys by using the API](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api).
* For more information on how to use terraform to manage resource keys and get a service key, see [ibm_resource_key](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_key).









 Step 1. Set up the LogDNA Provider plug-in 

Complete the following steps to set up the LogDNA Provider plug-in for Terraform so that you can start managing resources:



1. Create a versions.tf file and specify the LogDNA Provider plug-in version that you want to use with the version parameter.

terraform {
required_providers {
logdna = {
source = "logdna/logdna"
Managing ingestion key by using terraform 

You can use the LogDNA Terraform provider to manage and rotate ingestion keys for a Log Analysis instance by using HashiCorp Configuration Language (HCL).



 Prereqs 



* Ensure that you have the [required access](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam) to create and work with Log Analysis resources.
* You must have a paid service plan for the IBM Log Analysis service. [Learn more](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).
* [Install the Terraform CLI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-terraform-setupterraform-install-cli).
* [Check the IBM Cloud Provider plug-in for Terraform supported versions](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_cli).
* Get the service key that you must use to validate your credentials with the logging instance.



* For more information on how to get a service key by using the API, see [Service keys by using the API](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api).
* For more information on how to use terraform to manage resource keys and get a service key, see [ibm_resource_key](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_key).









 Step 1. Set up the LogDNA Provider plug-in 

Complete the following steps to set up the LogDNA Provider plug-in for Terraform so that you can start managing resources:



1. Create a versions.tf file and specify the LogDNA Provider plug-in version that you want to use with the version parameter.

terraform {
required_providers {
logdna = {
Managing ingestion key by using terraform 

You can use the LogDNA Terraform provider to manage and rotate ingestion keys for a Activity Tracker instance by using HashiCorp Configuration Language (HCL).



 Prereqs 



* Ensure that you have the [required access](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-iam) to create and work with Activity Tracker resources.
* You must have a paid service plan for the IBM Log Analysis service. [Learn more](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_plans).
* [Install the Terraform CLI](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-terraform-setupterraform-install-cli).
* [Check the IBM Cloud Provider plug-in for Terraform supported versions](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-setup_cli).
* Get the service key that you must use to validate your credentials with the auditing instance.



* For more information on how to get a service key by using the API, see [Service keys by using the API](https://cloud.ibm.com/docs/log-analysis?topic=log-analysis-service_keysservice_keys_api).
* For more information on how to use terraform to manage resource keys and get a service key, see [ibm_resource_key](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_key).









 Step 1. Set up the LogDNA Provider plug-in 

Complete the following steps to set up the LogDNA Provider plug-in for Terraform so that you can start managing resources:



1. Create a versions.tf file and specify the LogDNA Provider plug-in version that you want to use with the version parameter.

terraform {
required_providers {
logdna = {
* [Managing DNS records](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-records)
* [Configuring custom resolver](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-ui-create-cr). Specify VPE subnet of IBM Cloud VPC for workload services as location in the resolver.



Make sure that all required ports in the security group in IBM Cloud VPC for workload services that are used by host for private services are open. The needed ports are configured for private services. Required port for DNS is: 53 (TCP and UDP). As result, you get a private IP address that you can specify in Power® Systems Virtual Server instances as DNS endpoints by private subnet configuration. These IP addresses are entered into /etc/resolf.conf in the operating system.





 Setting up DNS forwarder (DNS option 2) 

If you use your own DNS service, its IP must be reachable from VPC for workload services. If the IP is not directly reachable from IBM Power Systems Virtual Servers, a DNS forwarder on the host for critical management services is required. Use the following steps to complete the configuration:



1. Make sure that all required ports in the security group in IBM Cloud VPC for workload services that are used by host for private services are open. The needed ports are configured for private services. Required port for DNS is: 53 (TCP and UDP).
2. Log in to the private services instance. You can use the following SSH command example:

ssh -A -o ServerAliveInterval=60 -o ServerAliveCountMax=600 -o ProxyCommand="ssh -W %h:%p root@<access_host_floating_ip>" root@<workload_services_host_private_ip>
3. Make sure that the required DNS software is available. On SUSE: zypper update -y; zypper install -y bind.
Managing port control for a device 

Each device that is associated with an account has two network ports that receive incoming traffic – one for public network traffic and one for private network traffic. You can enable or disable these ports at any time to control the network traffic that a device receives.



  Before you begin 



*  Go to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/docs/bare-metal?topic=virtual-servers-navigating-devices).
*  Make sure that you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.



For more information about permissions, see [Classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-infrapermission) and [Managing device access](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-managing-device-access).





  Manage the port control for a device 

Complete the following steps to update the port control settings for a device.



1.  Access the Device list and select the Device name to update.
2.  Click Actions to select one of the following available actions.



Table 1. Device port control options

 Action                         Description                                                                                                       

 Enable                         Sets port to Active on all available interfaces.                                                                  
 Enable (Degraded)              Sets port to Active on only the primary interface.                                                                
 Upgrade port speed             Updates the port speed to the maximum available speed and sets port to Active on all available interfaces.        
 Upgrade port speed (Degraded)  Updates the port speed to the maximum available speed and sets port to Active on only the primary interface.      
 Disable                        Sets device to Off.                                                                                               



3.  Click Update to confirm your selection.







  Next steps 

If you selected Disabled, network access for the disabled port ceases for the device interface. If you selected Enabled, network access is available for the enabled port. Port control remains in the selected setting until manually changed.
The access status will be updated to “PENDING REMOVAL”.

![SSP-AM-Remove-User-6](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-6.png)

![SSP-AM-Remove-User-7](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-7.png)

![SSP-AM-Remove-User-7](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-7.png)
8. The status of the access will be updated to “REMOVED” once the access removal process is completed.

![SSP-AM-Remove-User-8](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Remove-User-8.png)







 How to Grant a User Access to a Customer 

Managers in the Access Management application are able to grant existing users access to the customer they are managing. This process is similar to adding a new user to the Access Management tool. Once a user is granted access to a customer they can submit access requests for that customer. All access requests must be approved by a Manager User for that customer before they are granted.

Follow these steps to grant a user access to the customer you are assigned to manage.



1.
[SSP-AM-Overview-Access-Approvals-Tab](https://cloud.ibm.com/docs-content/v1/content/bd177462727ef0a849ddcf8c842a6203b41f0625/mas-ms/images/SSP-AM-Overview-Access-Approvals-Tab.png)







 Obtaining Access to the Access Management Tool 

Follow the steps below to obtain access to the Access Management Tool.



1. Create an IBMid

An IBMid is required to login to the Access Management Tool. To create an IBMid click [here](https://myibm.ibm.com)
2. Request Access

A user managing the customer you want access to must add you to the tool. Contact one of your [manager users](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-sspaccess-management-user-roles) to request they add you to the Access Management Tool. If you do not know who the manager users are for your account, submit a [support case](https://www.ibm.com/mysupport) requesting this information.

If you are new customer and [manager users](https://cloud.ibm.com/docs/mas-ms?topic=mas-ms-sspaccess-management-user-roles) were not created for your account during the onboarding process, you must submit a [support case](https://www.ibm.com/mysupport) designating at least two (2) managers for your account (1 primary, 1 backup). The case must include the email address and first and last name for each of the users. All email adresses must be associated with an [IBMid](https://myibm.ibm.com).
3. Navigate to the Access Management Tool

Navigate to the Access Management Tool by logging into the [Self-Service Portal](https://devops.maximo.com) with your IBMid. Once logged in, select Security > Access Management from the navigation menu.







 Supported Access Requests