vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Figure 6. Select Service for Access Group
3. In Resources, select Specific resources. For Attribute type, choose Service Instance.
4. From the drop-down list, select the service instance that you want to add to the access group, for example, QR-ml. If you are using resource groups, select the resource group instead of selecting individual service instances. Click Next.

Zoom

![Select Resources for Access Group](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-create-access-group-2.png)

Figure 7. Select Resources for Access Group
5. For Roles and actions, select Viewer and the custom role that was created previously. Click Add, then Assign.

Zoom

![Select Roles and actions for Access Group](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/org-guide-create-access-group-3.png)

Figure 8. Select Roles and actions for Access Group
6. Repeat this step if you want to give an access group permission to several service instances.









 Step 5: Set up your ID provider and assign users 

Follow the steps in the appropriate topic, depending on the ID provider you chose to use:



* [Use IBM Cloud as the ID provider for users that have IBM Cloud accounts](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-cloud-provider-org)
* [Use IBM Cloud as the ID provider for users that do not have IBM Cloud accounts](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-appid-cloud-org)
Log in to the [IBM Cloud console](https://cloud.ibm.com/). From the menu bar, select Manage > Access (IAM).
2. Select users individually or create an access group of users.



* To assign roles to an individual user



1. Click the Users page, and then click the name of the user that you want to set permissions for. If the user isn't shown, click Invite users to add them to the account.
2. Click the Access policies tab, and then click Assign access. Now, the breadcrumbs on the page are Users / Manage User.
3. Optional: Add the user to an access group that has access to IBM Cloud Kubernetes Service.



* To assign roles to multiple users in an access group



1. Click the Access groups page.
2. Click Create and give your group a Name and Description. Click Create.
3. Click Add users to add people to your access group. A list of users that have access to your account is shown.
4. Check the box next to the users that you want to add to the group. A dialog box displays.
5. Click Add to group.
6. Click the Access policies tab.
7. Click Assign access. Now, the breadcrumbs on the page are Groups / Manage Group.





3. Assign an access policy to IBM Cloud Kubernetes Service.



1. Click the IAM services tile.
2. In the services drop-down list, select Kubernetes Service. You can enter text in the drop-down list instead of scrolling through the list.
3. Optional: To scope the access policy to a resource group, select the resource group from the resource group drop-down list. If you want to scope the policy to a Kubernetes namespace, make sure to clear the resource group drop-down list. You can't scope an access policy to both a Kubernetes namespace and a resource group at the same time.
4.
Create a resource group for this network or project provides more flexibility. For additional details see the [Preparing Your IBM Cloud Account](https://cloud.ibm.com/docs/vpc-journey?topic=vpc-journey-vpc-prep-account) page of this deployment journey guide.
5. Validate the information entered and click on Create to retrieve the Terraform code and create the Schematics workspace.







 Configure Terraform Variables 



1. If not already there, navigate to the Settings page of your new Schematics workspace where you will see a list of variables (and their default values) which were found in the Terraform code.
2. Enter a value for the IBM Cloud API Key variable (if it exists) by clicking on the action menu. ![WorkspaceVariables](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/roks-on-vpc/images/provision/schematics-workspace-variables.png)

The API key is the credential the terraform code will run under and may we associated with a userid or a serviceid. To generate an API Key, click on Manage (located in top menu bar), select IAM, and then API keys. When entering the value in Schematics, be sure to select the Sensitive checkbox.
3. Inspect the remaining variables and update the values for vpc-name, resource_group, and other variables as needed.

Refer to the readme which accompanies the Terraform code for descriptions on variable names and their usage. In this example, you will see variables for configuring the subnet tiers, whether or not public gateways for a zone are enabled, subnet acl rules, etc.







 Apply ROKS-VPC Terraform Code 



1. Click the Generate plan to validate the configuration. This is similar to running terraform plan when using the CLI. No changes will be made nor any resources deployed.
The account owner for the service instance completes the following steps to assign permissions for my-user.



1. [Create an IAM resource group](https://cloud.ibm.com/docs/account?topic=account-rgs&interface=uicreate_rgs) for users who create Code Engine service bindings.



1. Launch [Access (IAM) Overview](https://cloud.ibm.com/iam/overview).
2. Select Manage > Account > Resource Groups > Create resource group.
3. Create a resource group; for example, CodeEngine_servicebindings_resourcegroup.



2. Create the service instances that you want to bind to in the same resource group. For this example, create an IBM Cloudant service instance in the CodeEngine_servicebindings_resource group resource group.
3. [Create an IAM access group](https://cloud.ibm.com/docs/account?topic=account-groups&interface=ui) for users who create Code Engine service bindings.



1. Launch [Access (IAM) Overview](https://cloud.ibm.com/iam/overview).
2. Select Manage > Access(IAM) > Access groups.
3. Create a group; for example, CodeEngine_servicebindings_accessgroup.
4. From within this new access group, click the Access tab and assign the following two access policies to the access group. For the first access policy,



* For Service, select All Identity and Access enabled services.
* For Resources, select the specific resource group that you created in the previous step; for example, CodeEngine_servicebindings_resourcegroup.
* For Resource group access, select Viewer.
* For Roles and actions, select Platform access of Administrator.
* Click Add to add the access policy to this access group.



5. Assign the second access policy for this access group.



* For Service, select Code Engine.
In addition, you must be assigned the following access on the project tooling resources within the account:



* The Viewer role on the resource group for the project, which allows a resource group for the project to be selected to deploy the tooling services.







 Assigning access in the console 

To assign access to the IBM Cloud Projects service, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and then select Access groups.
2. Select the access group that you want to assign access to, then go to Access > Assign access.
3. For the service, select IBM Cloud Projects. Then, click Next.
4. Scope the access to All resources or Specific resources. Then, click Next.
5. Select any combination of roles or permissions, and click Next.
6. Optionally, add conditions to the policy. Then, click Review.
7. Click Add to add your policy configuration to your access summary.
8. Click Assign.



It's a best practice to [assign access to an access group](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-access-enterprisesbp-enterprise-access-include-how_access) and then add users to the access group, instead of assigning access to users one by one. However, you can assign access to a single user by going to Manage > Access (IAM) > Users and selecting the user you want to assign access to.





 Granting access between the Projects service and other IBM Cloud services 

Before a project can validate or deploy configurations, the Projects service must be authorized in your account to communicate with other IBM Cloud services. The following table lists the required authorizations. An IAM administrator or a user with the required roles on those services can automatically grant authorizations by creating a project in your account, or they can [create the service to service authorizations manually](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-serviceauth&interface=ui). This authorization is only required once.



Table 2. Projects service to service authorizations
Generate an API key, then request a refresh token. For more information, see [Generating an IBM Cloud IAM token by using an API key](https://cloud.ibm.com/docs/account?topic=account-iamtoken_from_apikey).
2. Copy one of the following example requests and replace the variables that you want to use.

Example request to create a version 1.4.0 configuration.

curl -X POST "https://containers.cloud.ibm.com/global/v2/storage/satellite/createStorageConfigurationByController" -H "accept: application/json" -H "Authorization: TOKEN" -H "Content-Type: application/json" -d "{ "config-name": "string", "controller": "string", "storage-class-parameters": [ { "additionalProp1": "string", "additionalProp2": "string", "additionalProp3": "string" } ], "storage-template-name": "azuredisk-csi-driver", "storage-template-version": "1.4.0", "update-assignments": true, "user-config-parameters": { "entry.name": "LOCATION", { "entry.name": "RESOURCEGROUP", { "entry.name": "VMTYPE", { "entry.name": "SECURITYGROUPNAME", { "entry.name": "VNETNAME","user-secret-parameters": { "entry.name": "TENANTID",{ "entry.name": "SUBSCRIPTIONID",{ "entry.name": "AADCLIENTID",{ "entry.name": "AADCLIENTSECRET",}

Example request to create a version 1.18.0 configuration.
[Log in to your IBM Cloud account](https://cloud.ibm.com/login) as the account owner that will be configuring IBM Cloud Activity Tracker Event Routing targets.

After you log in with your user ID and password, the IBM Cloud dashboard opens.
2. Click Manage > Access (IAM). Manage access and users is displayed.
3. Click Authorizations.
4. Click Create.
5. For Source service select Activity Tracker and for How do you want to scope the access? select All resources.
6. For Target service select Cloud Object Storage for How do you want to scope the access? select Resources based on selected attributes.
7. Select Service instance and string equals the name of your COS instance.
8. For Service access select Object writer.
9. Click Authorize. Your new service-to-service authorization will be listed in the Manage authorizations view.



You will only be able to authorize to the IBM Cloud Object Storage instance using the UI. If you want to limit authorization to a specific IBM Cloud Object Storage bucket, you need to configure authorization using the [API](https://cloud.ibm.com/docs/atracker?topic=atracker-target_v2_coscos_s2s_api).





 Configuring S2S authorization using the CLI 

Do the following to configure a service-to-service authorization using the IBM Cloud CLI.



1. [Log in to your IBM Cloud account] (/docs/cli?topic=cli-ibmcloud_cli#ibmcloud_login) as the account owner that will be configuring IBM Cloud Activity Tracker Event Routing authorization.
2. Create an authorization policy defining your service-to-service authorization.

ibmcloud iam authorization-policy-create atracker cloud-object-storage "Object Writer" [--target-service-instance-id <COS_SERVICE_INSTANCE>

Where:

COS_SERVICE_INSTANCE is the bucket instance CRN]] ! ! ! !
* account_id: Returns the ID of the account in IBM Cloud that is creating the service instance.
* crn: When a customer creates your service in IBM Cloud, a service instance is created, and this instance is identified by its IBM Cloud Resource Name (CRN). The CRN is used in all aspects of the interaction with IBM Cloud including creating instances, binding (creating credentials and endpoints), metering, dashboard display, and access control. From a product provider perspective, the CRN can largely be treated as an opaque string to be used with the IBM Cloud APIs. It can also be decomposed by using the following structure:

crn:version:cname:ctype:service-name:location:scope:service-instance:resource-type:resource

In the provisioning sample we see that the compose-redis service CRN is:

crn:v1:bluemix:public:compose-redis:us-south:a/46aa677e-e83f-4d17-a2b6-5b752564477c:416d769b-682d-4833-8bd7-5ef8778e5b52::

In this sample, this compose-redis instance is part of IBM Cloud account with ID. The unique ID for the instance is 416d769b-682d-4833-8bd7-5ef8778e5b52, and the instance is hosted in the us-south region of the public IBM Cloud.
* resource_group_crn: Returns the resource group that includes the service instance. For more details, see [Managing resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs).

You typically aren't concerned with the resource_group_crn except in unique circumstances. Consult your IBM representative on your use case before you use that field.
Provisioning your Planning Analytics as a Service account 

IBM Planning Analytics® as a Service can now be auto-provisioned into your own IBM Cloud account.

To provision your environment, complete the following steps:



1.  Log into your Cloud account.
2.  In Dashboard, click Create resource.
3.  In Catalog, type "Planning Analytics" into the search bar, and select the Planning Analytics in the dropdown results.
4.  Select your Service Name. This will be the name of the first dev environment created for you.
5.  Read and agree to the terms by clicking Agree.
6.  Click Create.
7.  Your Service Instance will be created. You will be redirected to the Manage page.



To launch Planning Analytics, click Launch Planning Analytics to be logged into Planning Analytics Workspace.
All identities in a single access group inherit the same access.

A logical way to assign access to your resource groups and the included resources is by [creating one access group](https://cloud.ibm.com/docs/account?topic=account-groups) per required level of access. Then, you can map each access group to the previously created resource groups. For example, to control access to the CustApp project, you might create the following access groups:



* Auditor-Group
* Developer-Group
* Admin-Group



For the Auditor-Group, assign two access policies that grant viewer access to the CustApp-Test and the CustApp-Prod resources and resource groups. For the Developer-Group, assign two access policies that grant editor access to the CustApp-Dev and CustApp-Test resources and resource groups. For the Admin-Group, assign three access policies that grant administrator access to all three CustApp resource groups and their resources.

You can assign administrator access to everything in an account by creating an access group and assigning two policies to it. To create the first policy, select All Identity and Access enabled services in Account with the Administrator platform role and Manager service role. To create the second policy, select All Account Management Services with the Administrator role assigned.

For more best practices from IBM Garage for Cloud, see [Managing access to resources in IBM Cloud](https://cloudnativetoolkit.dev/resources/ibm-cloud/access-control/).







 Platform roles and service roles 

The word "object" is used in this section as a broad term for things like keys or key rings or service instances or accounts.

As mentioned earlier, roles exist at both the platform (account) and service level. If you are unsure about what a platform or a service role allows a user to do, remember that platform roles interact mainly with IBM Cloud services like the [resource controller](https://cloud.ibm.com/docs/account?topic=account-overview) or Cloud Identity and Access Management. Roles inside of a service, on the other hand, interact mainly with the relevant API, which in this case is the Key Protect API.
If you select Specific resources, you can establish trust with one or more existing compute resource instances directly without conditions. For example, a Kubernetes cluster.



5. Click Continue.
6. (Optional) [Assign access to the trusted profile](https://cloud.ibm.com/docs/account?topic=account-create-trusted-profiletp-access).
7. Or, click Create without assigning any access.



For more information about the fields that are used to create conditions for trusted profiles, see [IAM condition properties](https://cloud.ibm.com/docs/account?topic=account-iam-condition-properties).





 Establishing trust with IBM Cloud services in the console 

An IBM Cloud service in your account or another account might need a token to run an operation in your account.

For example, a Project service instance can assume a trusted profile to securely deploy an architecture in your account or another account without the need for key rotation. For more information, see [Using trusted profiles to authorize a project to deploy an architecture](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-project).

Complete the following steps to define how an IBM Cloud service can access specific resources in your account:



1. Ask the administrator of the service for the Cloud Resource Name (CRN) that uniquely identifies the service instance. The CRN is used to authorize operations.



* The service administrator can find the CRN by going to the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/secure-enterprise/includes/account/includes/icons/icon_hamburger.svg) > Resource list and clicking the name of the service that you're targeting. In the Details section, copy the CRN.



2. In the IBM Cloud console, click Manage > Access (IAM), and select Trusted profiles.
3. Click Create profile.
4.
For more information, see [Understanding API keys](https://cloud.ibm.com/docs/account?topic=account-manapikey).

Access groups
: You can create an access group to organize a set of users, service IDs, and trusted profiles into a single entity and easily assign permissions. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID. For more information, see [Setting up access groups](https://cloud.ibm.com/docs/account?topic=account-groups).

Resource groups
: You can use a resource group to organize your account resources in customizable groupings so that you can quickly assign users access to more than one resource at a time. Any account resource that is managed by using IAM access control belongs to a resource group within your account. Users are not added to resource groups, but users are provided access to the resources within or can manage the resource group. Users given access to manage the resource group can create new instances within the group, manage other user's access to work with the group, or edit the group name based on the assigned IAM role. You can have a maximum of 1000 resource groups per account. For more information, see [Best practices for organizing resources and assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup).

Another important aspect of the previous diagram is the depiction of the two types of access management systems that you can use to provide account users access to resources within the account.



* You can use IAM [access roles](https://cloud.ibm.com/docs/account?topic=account-userroles) to provide users access to all resources that belong to a resource group. You can also give users access to manage resource groups and create new service instances that are assigned to a resource group.
* You can use [classic infrastructure permissions](https://cloud.ibm.com/docs/account?topic=account-mngclassicinfra) to grant users more granular permissions for classic infrastructure resources. You assign device access and VPN subnet access separately.
* UI
* API







 Grouping keys together using key rings 

You can use IBM® Key Protect for IBM Cloud® to create a group of keys for a target group of users that require the same IAM access permissions.

As an account admin, you can bundle the keys in your Key Protect service instance into groups called "key rings". A key ring is a collection of keys, within your service instance, that all require the same IAM access permissions. For example, if you have a group of team members who will need a particular type of access to a specific group of keys, you can create a key ring for those keys and assign the appropriate IAM access policy to the target user group. The users that are assigned access to the key ring can create and manage the resources that exist within the key ring.

Key rings are also useful in cases where it is important for one business unit to have access to a set of keys that another business unit should not have. An account admin can create key rings for each business unit and [assign](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keysgrant-access-key-ring) the appropriate level of access to the appropriate users. In the case that the account admin would like to delegate platform management of a specific key ring to someone else, they can assign a user a [platform administrator role at the key ring level](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles). The sub administrator will then have the ability to manage the key ring and grant access to the appropriate users.

You can grant access to key rings within a Key Protect instance by using the IBM Cloud console, IAM API, or IAM CLI.

Before you create a key ring for your Key Protect instance, keep in mind the following considerations:



* Every Key Protect instance comes with a default key ring. Each newly created Key Protect instance comes with a generated key ring with an ID of default. All keys that are not associated with an otherwise specified key ring exists within the default key ring.
* Key rings can hold standard and root keys. Key rings can contain both standard and root keys.
Create a resource group for this network or project provides more flexibility. For additional details see the [Preparing Your IBM Cloud Account](https://cloud.ibm.com/docs/vpc-journey?topic=vpc-journey-vpc-prep-account) page of this deployment journey guide.
5. Validate the information entered and click on Create to retrieve the Terraform code and create the Schematics workspace.







 Configure Terraform Variables 



1. If not already there, navigate to the Settings page of your new Schematics workspace where you will see a list of variables (and their default values) which were found in the Terraform code.
2. Enter a value for the IBM Cloud API Key variable (if it exists) by clicking on the action menu. ![WorkspaceVariables](https://cloud.ibm.com/docs-content/v1/content/b7b9235ce6abd45b66931867c388cf107d38e15b/cloud-native-journey/kubernetes-on-vpc/images/provision/schematics-workspace-variables.png)

The API key is the credential the terraform code will run under and may we associated with a userid or a serviceid. To generate an API Key, click on Manage (located in top menu bar), select IAM, and then API keys. When entering the value in Schematics, be sure to select the Sensitive checkbox.
3. Inspect the remaining variables and update the values for vpc-name, resource_group, and other variables as needed. For example, you will most likely need to update the resource group name.

Refer to the readme which accompanies the Terraform code for descriptions on variable names and their usage. In this example, you will see variables for configuring the subnet tiers, whether or not public gateways for a zone are enabled, subnet acl rules, etc.







 Apply IKS-VPC Terraform Code 



1. Click the Generate plan to validate the configuration. This is similar to running terraform plan when using the CLI.