vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To see a full list of services that can use context-based restrictions to define and enforce access restrictions on their resources, see [Services integrated with context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatiscbr-adopters).





 25 January 2023 

Time-based conditions in IAM access policies
: IBM Cloud IAM is excited to give customers the ability to set access controls based on a specified time and date. You can now create policies that grant employees access to a resource during only their working hours, or grant automated processes temporary access for a specified duration. Implementing such limitations helps you to apply the principle of least privilege for assigning access and reduces the opportunity for attack in the event of a security breach. For more information, see [Limiting access with time-based conditions](https://cloud.ibm.com/docs/account?topic=account-iam-time-based&interface=ui).

IAM Policy Management API V2 release
: A new version (v2) of the IAM Policy Management API is now available. This version adds a new JSON schema to support a conditional policy construct and several time-based comparison operators. These operators provide the capability to restrict access based on time and date. With time-based access control, customers can establish granular policy enforcement based on a specified time period. For more information, see the [IAM Policy Management API change log](https://cloud.ibm.com/docs/account?topic=account-api-change-log&interface=ui)





 09 January 2023 

Save and share multiple estimates by using the IBM Cloud Cost Estimator
: The IBM Cloud Cost Estimator now allows a customer to save multiple estimates to their account and share those estimates with users that belong to the same account. For more information, see [Estimating your costs](https://cloud.ibm.com/docs/billing-usage?topic=billing-usage-cost).







 December 2022 



 15 December 2022 

Checklist for getting started on IBM Cloud
Editor Create private catalogs<br><br>Set filters for private catalogs<br><br>Add and update software<br><br>View account-level filters 
 Administrator Set account-level filters for the IBM Cloud catalog<br><br>Create, update, and delete private catalogs<br><br>Publish IBM-approved products<br><br>Assign access policies 
 Publisher Publish products that are approved by IBM from a private catalog 







 Context-Based Restrictions 

You can give users access to view, create, update, and remove network zones. To create a context-based restriction rule for a service, you must be assigned an IAM policy with the Administrator role the service you are creating a rule against. For example, if you want to create a rule to protect a Key Protect instance, you must be assigned the Administrator role on the Key Protect service and the Viewer role or higher on the Context-based restrictions service.

The Viewer role on the Context-based restrictions service allows you to add network zones to your rule.



Table 5. Roles and example actions for the context-based restrictions service

 Roles Actions 

 Viewer View network zones 
 Editor View network zones<br><br>Create network zones<br><br>Update network zones<br><br>Remove network zones 
 Administrator View network zones<br><br>Create network zones<br><br>Update network zones<br><br>Remove network zones 







 Enterprise 

You can use the Enterprise service to assign users access to manage an enterprise by creating accounts within the enterprise, assigning accounts to account groups, naming account groups, and more. This type of policy works only if it is assigned within the enterprise account.



Table 6. Roles and example actions for the Enterprise service

 Roles Actions 

 Viewer View the enterprise, account groups, and accounts 
 Operator Not applicable 
 Editor View and update the enterprise name and domain, create accounts and account groups, view usage reports, and import accounts. 
 Administrator View and update the enterprise name and domain, create accounts and account groups, move accounts between account groups, import existing accounts, and view usage reports 
 Usage report viewer View the enterprise, accounts, and account groups and view usage reports for all accounts in the enterprise. 







 Global catalog
For more information, see Protecting Cloud Databases resources with context-based restrictions.

IBM Cloud Databases



* 30 minutes
* 2022-10-26



[Setting up disk alerts for disk utilization](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-disk-util-alert-tutorial)Setting up disk alerts for disk utilization

Getting timely alerts about resource utilization is key to managing your database, avoiding problems, and mitigating downtime. If you know in advance that your database is running out of disk, take steps to scale those resources.

IBM Cloud Databases



* 30 minutes
* 2023-05-22



[Setting up Amazon Web Services Location](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-satellite-aws)Setting up Amazon Web Services Location

Follow these steps to set up IBM Cloud™ Databases (ICD) enabled by IBM Cloud Satellite in an on-premises location.

IBM Cloud Databases



* 15 minutes
* 2023-05-18



[Setting up On-Premises Location with NetApp ONTAP-SAN storage](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-satellite-on-prem)Setting up On-Premises Location with NetApp ONTAP-SAN storage

To deploy the ICD enabled by IBM Cloud Satellite service, prepare your Satellite location. Follow these steps to set up IBM Cloud™ Databases (ICD) enabled by IBM Cloud Satellite in an on-premises location.

IBM Cloud Databases



* 15 minutes
* 2022-12-09



[Provision a Databases for MongoDB Enterprise Edition instance with Terraform](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-tutorial-provision-mongodbee-tf)Provision a Databases for MongoDB Enterprise Edition instance with Terraform

In this tutorial, you learn how to use Terraform to provision a Databases for MongoDB Enterprise Edition instance that includes the Databases for MongoDB Enterprise Edition Analytics Add-On.
Review what compute resources your cluster uses by default and calculate the remaining cluster capacity that you can use for your workloads.



1. With the IBM Cloud IAM Manager service access role for the cluster in all namespaces: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)
2. Find the CPU and memory usage across all worker nodes. From the [Kubernetes clusters console](https://cloud.ibm.com/kubernetes/clusters), you can also click your cluster and review the Cluster Insights card.

kubectl top nodes

Example output

NAME CPU(cores) CPU% MEMORY(bytes) MEMORY%
10.xxx.xx.xxx 149m 7% 2402Mi 84%
10.xxx.xx.xxx 122m 6% 2395Mi 83%
10.xxx.xx.xxx 144m 7% 2376Mi 83%
3. Add the CPU and memory usage amounts to the [worker node resource reserves](https://cloud.ibm.com/docs/containers?topic=containers-planning_worker_nodesresource_limit_node) that are set for each worker node by default.
4. Subtract the worker node reserved and default app usage amounts from the total worker node size. This amount represents the total compute resources of your worker nodes before you deploy any apps or other workloads.



3. [Deploy your apps](https://cloud.ibm.com/docs/containers?topic=containers-deploy_app) to the cluster, and make sure to [set resource requests and limits](https://cloud.ibm.com/docs/containers?topic=containers-appresourcereq) based on the [app size that you previously estimated](https://cloud.ibm.com/docs/containers?topic=containers-strategysizing_resources) for your apps, to limit the amount of compute resources the apps can consume.
4.
Add a service reference for the Event Streams service to the required network zone.
2. Ensure that access from this zone is permitted by way of the context-based restrictions rules applicable to other Cloud services.



For more information about service reference creation, see [Service references](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatisservice-attribute).





 Coexistence of context-based restrictions rules and private IP allowlists 

Context-based restrictions rules now supersede the use of private IP allowlists as the recommended approach for implementing allowlists against an Event Streams instance. The use of private IP allowlists continues to be supported but is now deprecated.

If both context-based restrictions rules and IP allowlists are defined against the same Event Streams instance, the IP allowlist is ignored because the context-based restrictions rules override any previous private IP allowlist.





 Migrating from private IP allowlists to context-based restrictions 

The customer is responsible for migration. You can create IP allowlist definitions again as context-based restrictions network zones and apply them to the service instance by creating a context-based restrictions rule. You can then delete the previous private IP allowlist.
All the above zones and rules can be deployed in either report-only or enforced mode with a single Terraform command. Note that the rules are not meant for production use, but as a sample to investigate usage and traffic in report-only mode.

The documentation has a [list of resources which are supported as service references](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatisservice-attribute). You can also retrieve the list using the [CLI command service-ref-targets](https://cloud.ibm.com/docs/cli?topic=cli-cbr-plugincbr-cli-service-ref-targets-command) or the related API function [List available service reference targets](https://cloud.ibm.com/apidocs/context-based-restrictionslist-available-serviceref-targets).





 Step 6: Use Terraform to configure context-based restrictions 

Instead of manually creating the network zones and context rules for a project, it is recommended to automate the deployment. Context-based restrictions can be deployed utilizing Infrastructure as Code (IaC) - namely [Terraform code](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform). You can first deploy the zones and rules with rules in report-only mode for testing. Then, after thorough tests, switch to enforced mode by updating the deployed configuration.



 Terraform resources for zones and rules 

In the following, you will deploy the Terraform code to create a basic set of network zones and context rules. The code for zones is using the [ibm_cbr_zone](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/cbr_zone) resource. The following shows a zone specification which identifies the Kubernetes cluster. Such a cluster is one of the [supported service references](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatisservice-attribute).

resource "ibm_cbr_zone" "cbr_zone_k8s" {
Configuring the usage alert 

In IBM Cloud® Activity Tracker, you can define an alert to notify when the data usage in the instance reaches the data usage threshold that you set for the instance.



  Prereqs 

You must have the service role manager to configure data threshold alerts.





  Configure an alert 

Complete the following steps to configure an alert that informs you when you reach a specific data volume in the instance:



1.  [Launch the IBM Cloud Activity Tracker web UI](https://cloud.ibm.com/docs/services/activity-tracker?topic=activity-tracker-launch).
2.  Select the Settings icon ![Configuration icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/admin.png). Then select Usage.

In the Dashboard section, you can see your data usage.
3.  Define a Usage Alert to set the Usage Limit threshold for data usage in the instance. When the usage reaches the percentage of the threshold you selected, the email recipient will be notified.

![Panel to define usage alert](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/control-usage-instance-1.png)
4.  In the Add recipient section, enter one or more emails where the notification will be sent.

![Panel to define usage alert recipients](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/control-usage-instance-2.png)
For more information, see [SAP Note 2947579 - SAP HANA on IBM Power Virtual Servers](https://launchpad.support.sap.com//notes/2947579).





 Understanding IBM Power Virtual Server profile names 

The IBM Power Virtual Server for SAP HANA have profile names that are contextual and sequential. SAP HANA has multiple families of profiles, each associated with the required Service Level Agreements (SLAs):



* cnp1 = Nonproduct development for testing or development use only. Not intended for production deployments; not supported or certified for SAP production.
* ush1 = Small for OLAP/OLTP workloads that don't require as much CPU and storage consumption
* umh = Ultra Memory HANA for OLTP that use 1:240 as the cpu:memory ratio
* mh1 = High Memory for OLAP that use 1:180 as the cpu:memory ratio
* bh1 = Balanced for OLAP that use 1:100 as the cpu:memory ratio
* ch1 = Compute Intensive for OLAP that use 1:50 as the cpu:memory ratio



The Virtual Server profile names are contextual and sequential. The following table uses an SAP HANA certified server as an example:



Table 6. Profile naming scheme for SAP HANA

 Profile name Naming convention component What it means 

 umh-16x3840 umh Ultra Memory SAP HANA for OLTP (higher on the CPU to Memory ratio), 1:240 ratio 
 <br><br> * <br><br><br> spacer 
 16 16 CPU Cores 
 x spacer 
 3840 3840 GiB RAM 





Table 7. Directory information for profiles

 Directory Purpose 

 root volume 100 GiB fixed 
 /usr/sap 52 GiB required in the test system 
 /hana/data Matches the GiB RAM value 
 /hana/log Matches the GiB RAM value up to a maximum of 512 GiB 
 /hana/shared Matches the GiB RAM value up to a maximum of 1 TB 
 /export Local storage for exported images 
 /backup A preliminary backup on disk 







 Profiles available on Hourly Consumption Billing 

All IBM Power Virtual Server are available with Hourly pro-rata on Monthly Billing.
CM-10 - Software Usage Restrictions 



  Control requirements 

The organization:

CM-10 (a)
:   Uses software and associated documentation in accordance with contract agreements and copyright laws;

CM-10 (b)
:   Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution; and

CM-10 (c)
:   Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.





  NIST supplemental guidance 

Software license tracking can be accomplished by manual methods (e.g., simple spreadsheets) or automated methods (e.g., specialized tracking applications) depending on organizational needs.
Enter the IP addresses the team must use:



1. Team members in Austin use the following IP addresses: 4.4.4.1-4.4.4.99
2. An Austin team member in another building uses the following subnet: 204.17.5.0/24
3. A remote team member uses the following IP address: 3.3.3.56



5. Click Next.
6. Review the details of the network zone.
7. Click Create.







 Step 2: Create a rule 

Now, Xander can use the network zone that he created in a rule.



1. Go to Rules and click Create.
2. To restrict access to the creation of IAM policies, select the IAM Access Management Service.
3. Click Continue.
4. Xander has public endpoints in his network zone, so he keeps the endpoint type toggle switch set to No, which allows requests from any endpoint type.
5. Select the network zone management-team-zone.
6. Click Add to include your context configuration in the rule.
7. Click Continue.
8. Name the rule Management team
9. Set the enforcement to Report only so that you can monitor the impact of the rule before you enable it. You can update the enforcement at any time after you create the rule. For more information, see [Updating context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-update&interface=ui).
10. Click Continue.
11. Then, click Create.



Xander is logging and monitoring policy management requests by using report-only mode. Since the management team has the right access policies and use allowed IP addresses, they are authorized to execute policy management operations. All policy management requests that come from IP addresses that don't match the conext that Xander defined are denied when the rule is enabled.





 Next steps 

After 30 days of monitoring, update the rule to Enabled to begin enforcing your restrictions.
Use SpEL expressions to define standard math equations, where the operators are represented by using these symbols:

 Arithmetic operation Symbol 

 addition + 
 division / 
 multiplication * 
 subraction 

For example, in a dialog node response, you might add a context variable that captures a number specified in the user input (@sys-number), and saves it as $your_number. You can then add the following text as a text response:

 {: codeblock}
I'm doing math. Given the value you specified ($your_number), when I add 5, I get: <? $your_number + 5 ?>.
When I subtract 5, I get: <? $your_number - 5 ?>.
When I multiply it by 5, I get: <? $your_number * 5 ?>.
When I divide it by 5, I get: <? $your_number/5 ?>.
Show more

If the user specifies 10, then the resulting text response looks like this:

I'm doing math. Given the value you specified (10), when I add 5, I get: 15.
When I subtract 5, I get: 5.
When I multiply it by 5, I get: 50.
When I divide it by 5, I get: 2.





 Java number support 





 java.lang.Math() 

Performs basic numeric operations.

You can use the the Class methods, including these:



* max()



{
"context": {
"bigger_number": "<? T(Math).max($number1,$number2) ?>"
},
"output": {
"generic": [
{
"values":
{
"text": "The bigger number is $bigger_number."
}
],
"response_type": "text",
"selection_policy": "sequential"
}
]
}
}
Show more



* min()



{
"context": {
All commands have an Example section, which shows how to use the command in the context of a workflow.

The examples assume you have [openssl](https://www.openssl.org/) and [jq](https://stedolan.github.io/jq/) installed.

Many examples take advantage of an environment variable set for the session regarding the Key Protect Instance ID instead of the -i parameter. Variables set in this manner will be automatically used by the plug-in where appropriate and when needed.

 export the Key Protect instance id in the command line
$ export KP_INSTANCE_ID=<INSTANCE_ID>







 ibmcloud kp command summary 

ibmcloud kp supports the commands listed here.



 kp import-token command 

The kp import-token command prepares a root key for secure import.



Table 1. Sub-commands for managing import tokens

 Sub-command Status v0.8 Description 

 [create](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-import-token-create) Create an import token 
 [key-encrypt](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-import-token-key-encrypt) Encrypt the key that you import into the service 
 [nonce-encrypt](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-import-token-nonce-encrypt) Encrypt the nonce that is generated by kp import-token create
For instructions, see [Key Protect: Getting started with encryption keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial) or [HPCS: Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keys).

If you use HPCS, it is important to note that the "extractable": <key_type> value is set to true for standard keys.
2. After you create encryption keys for Direct Link, use IBM Cloud Identity and Access Management (IAM) to grant authorization between your instance and the Direct Link service. You can grant access at the instance level, which grants the Direct Link service access to all the keys inside that instance. You can also grant access on a key-by-key basis. For instructions, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth).

If you use Key Protect, select Resources based on selected attributes after you select Direct Link as the Source service. Then, select either Resource type > Direct Link Connect or Resource type > Direct Link Dedicated before selecting Key Protect as the Target service.

You should grant access to all keys in the instance; otherwise, you must grant a new service-to-service authorization each time that you want to use a different key for Direct Link. As long as a key is in use by your gateway, you should never delete it, nor should you revoke the service-to-service authorization.
3. If the Key Protect or HPCS instance has a context-based restriction (CBR) rule, a Direct Link Service Reference must be added to the network zone of that rule. For instructions, see [How Direct Link integrates with context-based restrictions](https://cloud.ibm.com/docs/dl?topic=dl-cbr&interface=clicbr-overview).







 Creating base64-encoded encryption keys 

This section describes how to base64 encode your key value for proper key creation.
Backend.run Runtime Primitives 

 Simplified algorithm building blocks X ✔ 
 Flexible interface ✔ ✔ 
 Elastic compute integration ✔ ✔ 
 Queuing efficiency X ✔ 
 Data caching X  
 Error mitigation support X ✔ 
 SAAS enablement X  



Key:



* ✔ - Full support
* X - No support
*  - Future support



Benefits of using Qiskit Runtime:



* Simplify algorithm design and optimization.
* Run circuits faster by using sessions - a context manager designed to efficiently manage iterative workloads and minimize artificial latency between quantum and classical sub-components.
* Access our most powerful quantum systems with our latest performance and hardware optimization, including capabilities like error suppression and mitigation.
* Easily integrate Qiskit Runtime with your cloud or on-premise classical compute resources by using the quantum serverless toolkit.



Simplified interface:

Use primitive programs to write code more efficiently. For details, see the examples topics, such as [Using Estimator to design an algorithm](https://cloud.ibm.com/docs/quantum-computing?topic=quantum-computing-migrate-estimator).

Zoom

![Code without primitives, and the same code after being rewritten to use primitives.](https://cloud.ibm.com/docs-content/v1/content/5f399fa794584e8a662591b494b9a99aa927c74c/quantum-computing/images/compare-code.png)

Figure 2. Code without primitives, and the same code after being rewritten to use primitives.





 FAQs 

Users might have the following questions when planning to migrate their code to Qiskit Runtime:



* Which channel should I use?

After deciding to use Qiskit Runtime primitives, the user must determine whether to access Qiskit Runtime through IBM Cloud or IBM Quantum Platform. Some information that might help you decide includes:

- The available plans:
- Qiskit Runtime is available in both the Open (free access) or Premium (contract-based paid access) plan on IBM Quantum Platform.