vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Provide account and access management to enable a zero-trust environment 

Requirement: Enable operators to implement a system of zero-trust where account, identity, and access management is based on the principles of separation of duties and least privilege.

Purpose & value: The design of the IBM Cloud for Financial Services is intended to enable a zero-trust model for deployments of the reference architectures. The scope of any one individual operator or administrator is strictly limited to those actions necessary and appropriate to perform their assigned roles. Overlap of duties is minimized or eliminated to prevent the need for privilege escalation that may result in undesired flows of information into or out of the operator's deployment. It is guided by two major principles:



* [Separation of duties](https://csrc.nist.gov/glossary/term/separation_of_duty) - No user should be given enough privileges to misuse the system on their own. For example, no one user should have the authority/ability to develop, compile, and/or move object code from non-production environments into production environments.
* [Least privilege](https://csrc.nist.gov/glossary/term/least_privilege) - Restrict the access privileges of authorized personnel (e.g., program execution privileges, file modification privileges) to the minimum necessary to perform their jobs. Access must be granted based only on a need to know. Access that has not been explicitly permitted is denied by default. Role-based access controls (RBAC) are used to allocate logical access to a specific job function or area of responsibility, rather than to an individual. Administrative access is only granted to individuals whose job roles have been approved for administration responsibilities.



Implementation guidance: As a software provider, you must provide facilities to accomplish these goals as appropriate. As a simple example, if your software provides a database, you should provide the ability to create database users with different roles (e.g., viewer, editor, administrator).

Ideally, you should support integration with an external (to the application) identity and access management provider for validating users and their associated access group membership.

Most Relevant Control Groups or Controls:



Table 1. Related controls for zero trust

 Family Control
Cloud Resource Names 

A Cloud Resource Name (CRN) uniquely identifies IBM Cloud® resources. A CRN is used to specify a resource in an unambiguous way that is guaranteed to be globally unique.

A CRN is formed from a concatenation of "segments" that hierarchically identify the resource, its location, and the service it belongs to. The segment delimiter is set to a colon (:). All CRNs begin with the segment identifier crn.



 CRN format 

The base canonical format of a CRN is:

crn:version:cname:ctype:service-name:location:scope:service-instance:resource-type:resource





 version 

The version segment identifies the version of the CRN format. Currently, the only valid version segment value is v1.





 cname 

The cname segment identifies the cloud instance and is an alphanumeric identifier that uniquely identifies the cloud instance that contains the resource. A cname effectively identifies an independent control plane that owns the identified resource. The value for the cname segment must be bluemix for IBM Cloud users.





 ctype 

The ctype segment identifies the type of cloud instance that is represented by the specified cname segment.

Valid values:



* public: All services that are available from the public catalog
* dedicated: Only for current IBM Cloud dedicated environments
* local: All services that are deployed locally in your own environment







 service-name 

IBM Cloud enforces global uniqueness of service names. The service-name segment identifies a capability (service, component, or product) that is offered by the cloud. The capability can be a user-provided service, such as with the services that are listed in the IBM Cloud catalog, or an internal architectural component critical to the IBM Cloud functionality.

The service-name segment indicates the service that the resource belongs to. The service-name segment must be alphanumeric, lowercase, and have no spaces or special characters other than -. If you're identifying a service name for a child service, you must have a period . that separates the parent service name from the child.
iex (New-Object Net.WebClient).DownloadString('https://clis.cloud.ibm.com/install/powershell')

If you encounter errors like The underlying connection was closed: An unexpected error occurred on a send, make sure you have .Net Framework 4.5 or later installed. Also try to enable TLS 1.2 protocol by running the following command:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12







 Installing to a custom directory 

When you use installers or a shell script to install the IBM Cloud CLI, it is installed in your system directories. If you want to specify a different directory, use the following steps.

If you install the IBM Cloud CLI to a custom directory, the ibmcloud update command can't be used to update the CLI.



1. Use a browser to access the official [ibm-cloud-cli-releases](https://github.com/IBM-Cloud/ibm-cloud-cli-release/releases/) GitHub repository, and select the matching binary of your platform to begin the download. The following platforms are supported: macOS, linux32, linux64, ppc64le, win32, and win64.
2. Extract the package to a directory that you specify.

You can see the following extracted content:

For Linux™ and Mac:

IBM_Cloud_CLI
├── LICENSE
├── NOTICE
├── autocomplete
│ ├── bash_autocomplete
│ └── zsh_autocomplete
├── ibmcloud
└── ibmcloud-analytics

For Windows™:

IBM_Cloud_CLI
├── LICENSE
├── NOTICE
├── ibmcloud-analytics.exe
└── ibmcloud.exe
3. Add to the PATH environment variable and enable shell autocompletion.



* Add the {YOUR_DIRECTORY}/IBM_CLOUD_CLI to the PATH environment variable.
Additionally, the IBM Cloud® pay-as-you-go pricing model and full integration with the Content Delivery Network (CDN) offers the ability to store and distribute data across 24 geographically diverse nodes.



 IBM Cloud Object Storage 

To access the data files that are backed up to IBM Cloud Object Storage, data files are requested by the following ways:



* The AltaVault appliance already that is located on-premises
* A secondary AltaVault appliance that is located within IBM Cloud



Follow this procedure to deploy a secondary AltaVault appliance within IBM Cloud to recover a primary, on-premises AltaVault appliance that failed.

The IBM Cloud environment consists of a single ESXi host with local storage to house and run the secondary AltaVault appliance. The infrastructure is representative of the basic single-site architecture with a single ESXi host that is managed by a vCenter server within an IBM Cloud virtual server instance.

If you have a more substantial infrastructure that requires shared storage and or support for these features



* vSphere High Availability (HA)
* vSphere Distributed Resource Scheduler (DRS)
* vSphere vMotion





 Prerequisites 

Verify that the following prerequisites are met before you proceed: Note: For this example, a trial version of an AltaVault AVA-v8 appliance was used with AltaVault Cloud-Integrated Storage 4.1.



* Make sure that the existing environment consists of a single ESXi host that is managed by a vCenter server within an IBM Cloud virtual server instance.
* Knowledge of VMware Sphere terminology and administering vSphere ESXi environments. This knowledge includes, but is not limited to, use of the vSphere web client, vSphere client, and assignment of hardware resources to include networking and storage.







 Before you begin 



* Navigate to your console's device menu. For more information, see [Navigating to devices](https://cloud.ibm.com/doc/virtualization?topic=virtual-servers-navigating-devices).
* Ensure you have any necessary account permissions and device access. Only the account owner, or a user with the Manage Users classic infrastructure permission, can adjust the permissions.
Now free text and regex customer response types have a setting to allow a customer to digress and change topics. For details, see [Enabling changing the topic for free text and regex customer responses](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-change-topicchange-topic-free-text-regex).

Adding and using multiple environments
: Each assistant has a draft and live environment. You can now add up to three environments to test your assistant before deployment. You can build content in the draft environment and test versions of your content in the extra environments. For details, see [Adding and using multiple environments](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-multiple-environments).

Display formats for variables
: In the Global settings page for actions, you can use the Display formats tab to specify the display formats for variables that use date, time, numbers, currency, or percentages. You can also choose a default locale to ensure that the format of a variable that's displayed in the web chat is what you want for your assistant. For example, you can choose to have the output of a time variable appear in HH:MM format instead of HH:MM:SS. For details, see [Display formats](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-actions-global-settingsactions-global-settings-display-formats).

Debug custom extensions
: You can use the new extension inspector in the action editor Preview pane to debug problems with custom extensions. The extension inspector shows detailed information about what data is being sent to and returned from an external API. For details, see [Debugging failures](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-call-extensionextension-debug).

New expression choice for setting a session variable
: Previously, to use an expression to set or modify a variable value, you needed to pick an existing variable or create a new one and select the expression option.
[Use and maintain nonproduction environments for development and testing](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-non-production-environments) <br><br> * Create a separate IBM Cloud account with a duplicate deployment of the Satellite reference architecture and use it for testing all changes before you promote to your production Satellite location.<br> * Do not put anything into production that has not been tested in an equivalent nonproduction environment.<br> * Treat all nonproduction environments as if they were for production environments by following all of the best practices and Framework controls for each environment you create.<br><br><br> <br><br> * Provide a separate set of hosts that are dedicated to your dev or test Satellite location that are isolated from your production Satellite location.<br><br><br> 
 [Enforce information flow policies and protect the boundaries of your application](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-boundary-protection) <br><br> * Use separate network areas for control plane hosts and workload hosts for more specific network flow restrictions.<br> * Only allow network access to control plane for components (for example, management plane) that use services provided by control plane hosts.<br> * Identify interconnects between your Satellite workloads and your other services outside of the Satellite components and allow required network flows only.<br> * Use Satellite Link endpoints to provide secure access to private endpoints of IBM Cloud services.<br> * Use edge plane and restrict access to workloads deployed on your Red Hat OpenShift on IBM Cloud cluster so that security and management-related services can be accessed from the management plane only.<br><br><br> <br><br> * Plan your virtual or physical network infrastructure for Satellite deployment to facilitate clear network flow restrictions based on proper identification of source and destination network areas.<br><br><br>
Managing access levels for App Configuration environments 

You can enable different levels of access to an App Configuration environment in your IBM Cloud account by creating and modifying IBM Cloud® Identity and Access Management (IAM) access policies.



 Granting access to an environment across instances in the account 

Take the following steps on the IBM Cloud console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select the name of the user to assign the access.
3. Click the Access tab in the Manager page view.
4. Click Assign access.
5. Select the Access policy if it is not already expanded.
6. From the list of services, select App Configuration, and click Next.
7. Scope the access to Specific resources.
8. Select the environment attribute type and provide the environment ID as the value, and click Next.
9. Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-service-access-management) to assign access for the user, and click Finish.
10. Click Add.
11. Repeat these steps as needed, and click Assign.



Zoom

![Access to an environment across instances](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/rbac-env.png)

Figure 1. Access to an environment across instances

To enable access to environments across instances, the user must at least have Reader level privileges to the App Configuration instances in the account.





 Granting access to a specific environment in an instance 

Take the following steps on the IBM Cloud console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select the name of the user to assign the access.
3.
ibmcloud plugin list
Listing installed plug-ins...

Plugin Name Version Status
cloud-functions/wsk/functions/fn 1.0.30
container-registry 0.1.380
container-service/kubernetes-service 0.2.99 Update Available
doi 0.1.0

 java -version
openjdk version "1.8.0_191"
OpenJDK Runtime Environment (build 1.8.0_191-8u191-b12-2ubuntu0.16.04.1-b12)
OpenJDK 64-Bit Server VM (build 25.191-b12, mixed mode)

 ant -version
Apache Ant(TM) version 1.10.5 compiled on July 10 2018

 mvn -version
Apache Maven 3.6.0 (97c98ec64a1fdfee7767ce5ffb20918da4f719f3; 2018-10-24T18:41:47Z)
Maven home: /opt/IBM/maven
Java version: 1.8.0_191, vendor: Oracle Corporation, runtime: /usr/lib/jvm/java-8-openjdk-amd64/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "4.4.0-141-generic", arch: "amd64", family: "unix"

 gradle -version

Welcome to Gradle 5.2.1!

Here are the highlights of this release:
- Define sets of dependencies that work together with Java Platform plugin
- New C++ plugins with dependency management built-in
- New C++ project types for gradle init
- Service injection into plugins and project extensions

For more details see https://docs.gradle.org/5.2.1/release-notes.html
Console URL: https://cloud.ibm.com/codeengine/project/us-south/01234567-abcd-abcd-abcd-abcdabcd1111/application/myhelloapp/configuration
Status Summary: Application deployed successfully

Environment Variables:
Type Name Value
Literal CE_APP myhelloapp
Literal CE_DOMAIN us-south.codeengine.appdomain.cloud
Literal CE_SUBDOMAIN 8aaon2dfwa0
Image: us.icr.io/mynancesnamespace/codeengine-helloworld
Resource Allocation:
CPU: 1
Ephemeral Storage: 400M
Memory: 4G
Registry Secrets:
myregistry

Revisions:
helloapp-00003:
Age: 2m46s
Latest: true
Traffic: 100%
Image: us.icr.io/mysnamespace/codeengine-helloworld (pinned to eeca2b)
Running Instances: 1
[...]
To retrieve and prepare your credentials for later steps, you also set the credentials as environment variables in your terminal.



1. In your terminal window, set the Key Protect API endpoint as an environment variable.

export KP_API_URL=https://<region>.kms.cloud.ibm.com
2. Generate an IBM Cloud access token using the Key Protect CLI Plugin, and set it as an environment variable.

The environment variable should begin with the authorization type, Bearer. The CLI command, as shown in the example, will automatically include the correct type.

export ACCESS_TOKEN=ibmcloud iam oauth-tokens | grep IAM | cut -d : -f 2 | sed 's/^ //'

IBM Cloud access tokens are valid for 1 hour, but you can regenerate them as needed. To generate a new access token, run the ibmcloud iam oauth-tokens command. To find out more about retrieving IBM Cloud access tokens, see [Retrieving an access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token).
3. Retrieve the identifier that is associated with your Key Protect instance, and then set the value as an environment variable.

export INSTANCE_ID=ibmcloud resource service-instance "import-keys-demo" --output json | jq -r '.[].guid'
4. Optional: Verify that the environment variables are set correctly by printing them to your terminal screen.

$ echo $KP_API_URL
https://us-east.kms.cloud.ibm.com
$ echo $ACCESS_TOKEN
Bearer eyJraWQiOiIyM...
$ echo $INSTANCE_ID
c1cf624b-6bed-4d4d-bd54-8e2534258a88

Success! You're now set with the service credentials that you need to authenticate to the Key Protect API. Continue to the next step.







 Step 3.
Refer to the section [Apply changed to a blueprint environment](https://cloud.ibm.com/docs/schematics?topic=schematics-apply-blueprint) for guidance applying the config via the CLI or UI. .



* Based on your blueprint configuration, Schematics creates an internal deployment plan and runs the IaC module code in dependency order to create the environment and resources. In a future release the deployment plan will be presented for review in a separate step before it can be applied.



5. For each module, Schematics runs a Terraform Apply to create cloud resources.
6. After all the modules are applied, Schematics returns the blueprint outputs.



* The outputs can be used as input to further configuration steps or used directly to access resources in the environment.







 Next steps 

The next stage of working with blueprint is [Maintaining blueprint environments](https://cloud.ibm.com/docs/schematics?topic=schematics-update-op-blueprints).

Explore deploying [Schematics blueprints by using the command-line](https://cloud.ibm.com/docs/schematics?topic=schematics-deploy-schematics-blueprint-cli) tutorial to create cloud resources with a blueprint.
[HCX with single source over Public Network](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/hcx-public.svg)

Figure 1. HCX with single source over Public Network

Alternatively, the architecture also allows site peering over Private Internet.

Zoom

![HCX with single source over Private Network](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/hcx-private.svg)

Figure 2. HCX with single source over Private Network

The source can be placed within the IBM Cloud environment as well; spokes are always cloud deployments within this design as shown in the following figure.

Zoom

![HCX with multiple sources](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/images/hcx_multiple_sources.svg)

Figure 3. HCX with multiple sources





 Base design dependencies 

The base deployment must follow the minimum requirements:



* The source environment must contain a vSphere implementation that is managed by a vCenter Server. Supported vCenter of 5.5U3 or vCenter 6.0U2 and higher, with ESXi 5.5 or higher is required for Hybrid Cloud Services.
* If NSX is used, version 6.2.2 or higher. NSX is required for policy migration.
* If cross-cloud vMotion is intended, the same affinity restrictions apply across clouds as they do on-premises.
* The source environment must have a method to connect to cloud environments, which includes public internet access or private connections by using IBM Cloud Direct link.
[Large-scale environments](https://cloud.ibm.com/docs-content/v1/content/ba89e173287b28d1453d2a327d8a1f74ae2f1662/schematics/images/gs_scale.svg) <br>Deploy large-scale environments Deploy and manage large-scale environments with [Schematics Blueprints](https://cloud.ibm.com/docs/schematics?topic=schematics-get-started-blueprints). Manage the lifecycle of large and complex application infrastructures, created from reusable Terraform based automation modules. Reuse version templates and modules. [Link](https://cloud.ibm.com/docs/schematics?topic=schematics-get-started-blueprints)
Working with multiple sessions with the IBM Cloud CLI 

You can use the IBMCLOUD_HOME environment variable to work with multiple sessions at the same time in the IBM Cloud® CLI.

With the IBMCLOUD_HOME environment variable, you can set a path for the session metadata. You can specify a different directory for each session, and that's helpful when you want to run multiple IBM Cloud CLI sessions simultaneously.



  Before you begin 



*  Set up your [IBM Cloud® account](https://cloud.ibm.com/registration). For more information, see [Setting up your IBM Cloud account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started).
*  [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).







  Setting the IBMCLOUD_HOME environment variable 

To run multiple IBM Cloud CLI sessions in parallel, use different environments per session. You need to set up a different configuration directory for each session.

For your first environment, enter the following command:

export IBMCLOUD_HOME=/home/myuser/.ibmcloudenv1
ibmcloud login

For your second environment, enter the following command:

export IBMCLOUD_HOME=/home/myuser/.ibmcloudenv2
ibmcloud login

For more information about environment variables for the IBM Cloud CLI, see [Tips and Tricks for Using the IBM Cloud CLI](https://www.ibm.com/cloud/blog/tips-and-tricks-for-using-the-ibm-cloud-cli) and [IBM Cloud CLI (ibmcloud) environment variables](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_env_var).
IBM Cloud CLI requires Java™ 1.8.0. The prefix for running commands by using the IBM Cloud CLI is ibmcloud.
2. Install the latest TKE plug-in with the following command:

ibmcloud plugin install tke

You are notified on the command line when updates to the IBM Cloud CLI and plug-ins are available. Be sure to keep your CLI up to date so that you can use the latest commands. You can view the current version of all installed plug-ins by running ibmcloud plugin list.
3. Set the environment variable CLOUDTKEFILES on your workstation. Specify a directory where you want workstation files and signature workstation files to be created and saved. Create the directory if it does not exist.



* On the Linux™ operating system or MacOS, add the following line to the .bash_profile file:

export CLOUDTKEFILES=<path>

For example, you can specify the path to /Users/tke-files.
* On the Windows™ operating system, in Control Panel, type environment variable in the search box to locate the Environment Variables window. Create a CLOUDTKEFILES environment variable and set the value to the path to the key files. For example, C:userstke-files.









 TKE CLI plug-in commands 



Table 1. Describes the TKE CLI plug-in commands

 Command name Description Example 

 tke auto-init Automatically initializes the service instance. ibmcloud tke auto-init 
 tke auto-mk-rotate Automatically rotates the master key with a randomly generated master key value in the recovery HSM. ibmcloud tke auto-mk-rotate 
 tke auto-recover Automatically copies the current master key value from the recovery HSM to other crypto units in the same resource group. ibmcloud tke auto-recover 
 tke Manages crypto units in the IBM Cloud. ibmcloud tke 
 tke cryptounit-add Adds crypto units to the set of crypto units to work with. ibmcloud tke cryptounit-add