vania-janet/multiturn-rag-retrieval-data huggingface dataset:
To enable access to environments across instances, the user must at least have Reader level privileges to the App Configuration instances in the account.





 Granting access to a specific environment in an instance 

Take the following steps on the IBM Cloud console:



1. From the menu bar, click Manage > Access (IAM), and select Users to browse the existing users in your account.
2. Select the name of the user to assign the access.
3. Click Access policies tab in the Manager page view.
4. Click Assign access.
5. Select the Assign users additional access section if it is not already expanded.
6. From the list of services, select App Configuration.
7. Select the Resource based on selected attributes option.
8. Select the serviceInstance attribute and provide the service instance ID as the value.
9. Select the environment and provide the environment ID as the value.
10. Choose a combination of [platform and service access roles](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-service-access-management) to assign access for the user.
11. Click Add.
12. Continue to add platform and service access roles as needed and when you are finished, click Assign.



Zoom

![Access to a specific environment in an instance](https://cloud.ibm.com/docs-content/v1/content/f3dada89f147af3b88388a2218ddbf64b3c41e5f/app-configuration/images/rbac-inst.png)

Figure 2. Access to a specific environment in an instance

To enable access to a specific environment in an instance, the user must at least have Reader level privileges to the particular App Configuration instance.
Identification and Authentication (IA) [IA-2 User Identification and Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2) <br>[IA-3 Device Identification and Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-3) <br>[IA-5 Authenticator Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5) 







 17. Tag all IBM Cloud resources with security attributes 

Requirement: Tag all IBM Cloud resources with security attributes.

Purpose & value: All IBM Cloud resources in your account should be tagged with security attributes you define. You can apply user tags to organize your resources and easily find them later, to help you with identifying specific team usage or cost allocation, and to control access to your resources without requiring updates to your IAM policies.

Implementation guidance:



* [VPC reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resources)
* [Satellite reference architecture](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-tagging-resources)



Most Relevant Controls:



Table 17. Related controls for non-production environments

 Family Control 

 Access Control (AC) [AC-16 Security Attributes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-16) 
 System and Communications Protection (SC) [SC-16 Transmission of Security Attributes](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-16) 







 18. Monitor for security and compliance against a baseline configuration 

Requirement: Deploy and use tooling for monitoring and reporting of security and compliance.
Understanding user access permissions 

When you [assign cluster permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-perms), it can be hard to judge which role you need to assign to a user. Use the tables in the following sections to determine the minimum level of permissions that are required to perform common tasks in Red Hat® OpenShift® on IBM Cloud®.



 Permissions to create a cluster 

Review the minimum permissions in IBM Cloud IAM that the account owner must set up so that users can create clusters in Red Hat OpenShift on IBM Cloud.

IAM Services
: 

* Administrator platform access role for the Kubernetes Service in the console (containers-kubernetes in the API or CLI) in All resource groups.
* Writer or Manager service access role for Kubernetes Service in the console (containers-kubernetes in the API or CLI) in All resource groups.
* Administrator platform access role for Container Registry in the console (container-registry in the API or CLI) at the Account level. Do not limit policies for IBM Cloud Container Registry to the resource group level.
* Administrator platform access role for Cloud Object Storage in the console (cos in the API or CLI) for the standard instance that you want to use to back up the internal registry images in a VPC cluster.
* If you plan to [expose apps with Ingress](https://cloud.ibm.com/docs/containers?topic=containers-managed-ingress-about), assign the user Administrator or Editor platform access role and the Manager service access role for Secrets Manager in All resource groups.
* Viewer platform access role for the resource group access.
* If your account [restricts service ID creation](https://cloud.ibm.com/docs/account?topic=account-restrict-service-id-create), the Service ID creator role to IAM Identity Service in the console (iam-identity in the API or CLI).
Note: Any services that were deployed to an IP address from the subnet remain active after the subnet is removed.

ibmcloud oc cluster subnet detach --cluster CLUSTER --subnet-id SUBNET_ID [-f] [-q]

Minimum required permissions
: Operator platform access role for the cluster in IBM Cloud Kubernetes Service

Command options:

-c, --cluster CLUSTER
: Required: The name or ID of the cluster. To list your clusters, use the ibmcloud oc cluster ls[command](https://cloud.ibm.com/docs/openshift?topic=openshift-kubernetes-service-clics_clusters).

--vlan VLAN_ID
: The ID of the public or private subnet that you want to detach. To find the subnet ID, first run ibmcloud oc cluster get --cluster <cluster> --show-resources and look for the subnet CIDR in the Subnet VLANs section of the output. Then, using the subnet CIDR, run ibmcloud oc subnets --provider classic and look for the subnet's ID.

-f
: Optional: Force the command to run with no user prompts.

-q
: Optional: Do not show the message of the day or update reminders.



 Example cluster subnet detach command 

ibmcloud oc cluster subnet detach --cluster my_cluster --subnet-id 1602829







 Deprecated: ibmcloud oc cluster user-subnet add 

Classic infrastructure

Bring your own private subnet to your IBM Cloud Kubernetes Service clusters. This private subnet is not one provided by IBM Cloud infrastructure. As such, you must configure any inbound and outbound network traffic routing for the subnet.

This command is deprecated.
Enabling MFA in your account 

As an Administrator on the IAM Identity Service or All IAM Account Management services, you can choose to require multifactor authentication (MFA) for every user in the account, just users with IBMids who do not use single sign-on (SSO), or individual users. This document covers how to work with [ID-based MFA](https://cloud.ibm.com/docs/account?topic=account-typesid-based), which is the recommended MFA method.

Starting 3 May 2023, by default CLI logins with only a username and password are disabled for all users that have MFA set to None. This applies to users in new and existing accounts. Administrators can opt-out before that date in the IBM Cloud console. For more information, see [Disabling CLI logins with only a password](https://cloud.ibm.com/docs/account?topic=account-enablemfadisabling-cli)

View the MFA requirement for each user in your account to determine if they fulfill the requirement by generating an MFA status report. For more information, see [Identifying a user's MFA status](https://cloud.ibm.com/docs/account?topic=account-id-user-mfa).



 Before you begin 

The following information is helpful to consider before you enable ID-based MFA for your account to ensure that you know how it affects all users in your account:



* Enabling MFA for all users in your account affects all members of the account. If users in your account are members of multiple IBM Cloud accounts, they must enroll for MFA at their next login even if they don't intend to use resources in the account where MFA is enabled.
* API keys for users and service IDs continue to work after MFA is enabled.
* MFA for your account applies to a user's login, but does not apply to API calls. If a user has permission to make API calls to resources in your account, the user can do so without completing MFA. If the user belongs to other accounts, the user can make API calls to resources in your account by using an API key from an account that did not require MFA.
See the sample of the requestData field when the Require MFA security questions at login: property is enabled. The requestData.security_questions_setup field is set to true.

{
"action": "user-management.user-setting.update",
"message": "IAM User Management: update user-setting user@company.com",
"requestData": {
"totalNumberChanges": 1,
"update": [
{
"initialValue": false,
"newValue": true,
"updateType": "security_questions_setup update"
}
]
}





 User accepts an account invitation 

When a user accepts an account invitation, you get the following event:



* Event with action user-management.user-invitation.accept that reports which user accepted the account invitation.



See the sample of the responseData field when the user accepts the invitation:

    "action": "user-management.user-invitation.accept",
    "message": "IBM User Management: accept user invitation to account Joe Test's Account",
    "responseData": {
        "update": [
            {
                "initialValue": "BSS-3f6af42016b440e087025542cbd9cb91",
                "newValue": "IBMid-663003Z105",
                "updateType": "IAM ID Update during Accept"
            }
        ]
    }





 requestData fields 

The following table lists requestData fields that you can find in events that are generated when user details are modified from the Users dashboard:



Table 15. User management requestData fields

 Field Type Description 

 2FA Boolean Defines the MFA requirements for users in the account. <br>This field is set to true when MFA is enabled for users. 
 allowed_ip_addresses String List of IP addresses from where a user is allowed to access account resources. 
 ips_added String The new IP adresses that are added to the allowed_ip_addresses.
Restrict IP addresses from which a user can access the IBM Cloud account. For more information, see [Allowing specific IP addresses for an account](https://cloud.ibm.com/docs/account?topic=account-ipsips_account) for more information.

The following table shows the controls that are most related to this step.



Table 4. Related controls in IBM Cloud Framework for Financial Services for restricting IP addresses

 Family Control 

 Access Control (AC) [AC-4 Information Flow Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4) 
 System and Communications Protection (SC) [SC-7 Boundary Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7) <br>[SC-7 (5) Boundary Protection | Deny By Default - Allow By Exception](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-7.5) 



6. While optional, it is recommended that you [enable authentication from an external identity provider (IdP)](https://cloud.ibm.com/docs/account?topic=account-idp-integration) to securely authenticate external users to your IBM Cloud account. This provides a way for your employees to use your company's single sign-on (SSO) solution.
7. Enable the IBM Cloud for Financial Services Validated setting in your account. With this setting, you can [filter the catalog](https://cloud.ibm.com/catalog?search=label%3Afs_ready) for services that are designated as Financial Services Validated and indicates that your account stores regulated financial services information. If you enable Financial Services Validated, your account still has access to the full public catalog. For more information, see [Enabling your account to use Financial Services Validated products](https://cloud.ibm.com/docs/account?topic=account-enabling-fs-validated).
"host": "76838001-b883-444d-90d0-46f89e942a15-bluemix.cloudant.com",
"iam_apikey_description": "Auto generated apikey during resource-key [...]",
"iam_apikey_name": "auto-generated-apikey-050d21b5-5f[...]",
"iam_role_crn": "crn:v1:bluemix:public:iam::::serviceRole:Manager",
"iam_serviceid_crn": "crn:v1:staging:public:iam-identity::[...]",
"password": "8fb6a16b48903e87b769e7f4968521e85c2394ed8f0e69b2769e56dcb27d2e76",
"port": 443,
"url": "https://<username>:<password>@76838001-b883-444d-90d0-46f89e942a15-bluemix.cloudant.com",
"username": "apikey-v2-58B528DF5397465BB6673E1B79482A8C"
}

The service credentials include the following fields:

username
: The username that is required for applications to access the service instance.

password
: The legacy credentials password that is required for applications to access the service instance. This field displays only if the Use both legacy credentials and IAM option is chosen.

host
: The hostname that is used by applications to locate the service instance. This field displays only if the Use both legacy credentials and IAM option is chosen.

port
: The HTTPS port number for accessing the service instance on the host. It's 443 as only HTTPS access is allowed by IBM Cloudant.
* Normal user: Normal users are the ones who have access to the normal user API key. The normal user API key needs to be distributed only to a limited group of people, who need access to the keystore where more sensitive keys are stored, such as keys for signing and encrypting contracts. In this case, the PKCS #11 application calls the C_Login function by using the normal user API key as the PIN and becomes a normal user to access the keystore.
* Anonymous user: The anonymous user API key can be distributed to anyone in the enterprise so that anonymous users can access the keystore to perform daily work, such as signing a document. The API key is configured in the PKCS #11 library configuration file grep11client.yaml and the anonymous user does not need to call the C_Login function.



A PKCS #11 application works as only one of the three user types at any time, no matter how many sessions are opened. Each user type needs an API key for authentication. To create the API keys, you need to first create two custom IAM roles. And then, create service IDs for the three user types, and map the custom IAM roles to the service IDs.

To perform the following steps, you need to have the Administrator[platform access](https://cloud.ibm.com/docs/account?topic=account-userrolesplatformroles) in your IBM Cloud® account.





 Step 1: Create custom IAM roles 

You need to create two custom roles, one for operating keys and one for operating keystores.



 1. Create a custom role for operating keys 

This role is used to generate and manage keys in the Enterprise PKCS #11 (EP11) keystores. However, this role does not have permissions to manage EP11 keystores.



1. In the IBM Cloud console, go to Manage > Access (IAM), and select Roles.
2. Click Create.
3. Enter a name for your role; for example, key operator. This name must be unique within the account. Users see this role name in the console when they assign access to the service.
4.
For example, to get the ID of a team that is available in a monitoring instance in US-South, you can run the following command:

curl -v https://us-south.monitoring.cloud.ibm.com/api/teams -H "Authorization: $AUTH_TOKEN" -H "content-type: application/json" -H "IBMInstanceID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

The response includes information about all the teams where the user is a member. To get the ID of a team, identify the team in the response.

For example, a sample response looks as follows:

{
"teams": [
{
"version": 4,
"name": "Monitor Operations",
"properties": {},
"id": 26055,
"default": true,
"products":
"SDC"
],
"origin": "SYSDIG",
"description": "Immutable Monitor team with full visibility",
"dateCreated": 1599751614000,
"lastUpdated": 1610313489000,
"entryPoint": {
"module": "Overview"
},
"customerId": 99999,
"namespaceFilters": {
"ibmPlatformMetrics": null
},
"theme": "7BB0B2",
"show": "host",
"defaultTeamRole": "ROLE_TEAM_EDIT",
"immutable": true,
"canUseSysdigCapture": true,
"canUseCustomEvents": true,
"canUseAwsMetrics": false,
"canUseBeaconMetrics": true,
"userCount": 3
}
]
}
Now that the setting is enabled to restrict users from creating API keys, you can assign the required access to enable specific users to continue creating user API keys. Remember, the account owner is also required to be assigned this explicit access.





 Enabling the API key creation setting by using Terraform 

If you turn on the API key creation setting, users in your account require specific access to create API keys, including the account owner.

To turn on the setting to restrict users from creating user API keys, you must have the following assigned access:



* An IAM policy with the Administrator, Operator, or Editor role on the [IAM Identity Service](https://cloud.ibm.com/docs/account?topic=account-account-servicesidentity-service-account-management).



Before you can set limits for login sessions by using Terraform, make sure that you have completed the following:



* Install the Terraform CLI and configure the IBM Cloud Provider plug-in for Terraform. For more information, see the tutorial for [Getting started with Terraform on IBM Cloud®](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-getting-started). The plug-in abstracts the IBM Cloud APIs that are used to complete this task.
* Create a Terraform configuration file that is named main.tf. In this file, you define resources by using HashiCorp Configuration Language. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).



To restrict who can create API keys, use the following steps:

Enabling this setting affects only the creation of user API keys. It does not affect API keys for service IDs.



1. Create an argument in your main.tf file. The following example enables the API key creation setting by using the ibm_iam_account_settings and iam_account_settings_instance resources.
2. Defines whether or not creating platform API keys is access controlled. Supported valid values are:



* RESTRICTED - to apply access control
"plan_id": "ecc19311-aba2-49f7-8198-1e450c8460d4", //your plan's GUID from onboarding
"context": {
"platform": "ibmcloud",
"account_id": "003e9bc3993aec710d30a5a719e57a80",
"crn": "crn:v1:bluemix:public:compose-redis:us-south:a/003e9bc3993aec710d30a5a719e57a80:416d769b-682d-4833-8bd7-5ef8778e5b52",
"resource_group_crn": "crn:v1:bluemix:public:resource-controller::a/003e9bc3993aec710d30a5a719e57a80::resource-group:b4570a825f7f4d57aa54e8e1d9507926",
"target_crn": "crn:v1:bluemix:public:resource-catalog::a/e97a8c01ac694e308ef3ad7795c7cdb3::deployment:e62e2c19-0c3b-41e3-b8b3-c71762ecd489:us-south38399"
},
"parameters": {
"location": "us-south",
"optional-param":"parameter required by your service"
}
}
Show more





 Creating a service instance by using the CLI 

When a user wants to create a service instance, they can use ibmcloud cli [ ibmcloud resource service-instance-create NAME SERVICE_NAME SERVICE_PLAN_NAME LOCATION ].

The IBM Cloud platform validates that the user has permission to create the service instance by using IBM Cloud IAM.
For more information about service IDs, see: [Introducing IBM Cloud IAM Service IDs and API Keys](https://www.ibm.com/blogs/bluemix/2017/10/introducing-ibm-cloud-iam-service-ids-api-keys/) and [Increase Information Security for Db2 on IBM Cloud](https://www.ibm.com/cloud/blog/increase-information-security-for-db2-on-ibm-cloud).







 Roles and actions 

Every user that accesses the Db2 on Cloud service in your account must be assigned an access policy with an IAM role. The access policy that you assign to users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by Db2 on Cloud as operations that are allowed to be performed on the service. Each action is mapped to an IAM platform or service role that you can assign to a user. If a specific role and its actions don't fit the use case that you're looking to address, you can [create a custom role](https://cloud.ibm.com/docs/account?topic=account-custom-rolescustom-access-roles) and pick the actions to include.

For information about the exact actions mapped to each role, see [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions) and [Db2](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actionsdb2).





 Prerequisites 



* Db2 Client V11.1 FP3 or later.
* Must use SSL connections through port 50001.
* [Configure your Db2 client](https://cloud.ibm.com/docs/Db2onCloud?topic=Db2onCloud-ssl_supportssl_cfg_client).
* Catalog your database.
o Modification to system time / time-synchronization configuration,

o Log files: access to logs files; initialization, stopping or pausing of logging, log modification, changes to access permission on log files,

o Files and system level objects creation and deletion,

o Attempts to perform unauthorized functions or access data the user is not authorized to access,

o Modification of security rules,

o Application and related systems start-ups and shut-downs



* For privileged accounts:



o Attempts to execute privilege elevation

o System errors relevant to security events, including but not limited to SQL errors that indicate a SQL injection, fuzzing, multiple failed logins, failed configuration change, failed/disabled anti-virus software, service failures

o Web access events in extended log format

The above security audit logging events are required for all environments, e.g., production, development, user acceptance testing.





 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



Rules for AU-2 in IBM Cloud for Financial Services v1.2.0 profile

 Requirement ID Rules 

 AU-2 (a) <br><br> * Check whether App ID runtime activity capture is enabled<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br> 
 AU-2 (d) <br><br> * Check whether App ID runtime activity capture is enabled<br> * Check that Activity Tracker Event Routing is configured to collect global events generated by IBM Cloud services<br><br><br> 







 NIST supplemental guidance 

An event is any observable occurrence in an organizational information system. Organizations identify audit events as those events which are significant and relevant to the security of information systems and the environments in which those systems operate in order to meet specific and ongoing audit needs.