vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Digest. CKM_SHA_1, CKM_SHA224, CKM_SHA256, CKM_SHA384, CKM_SHA512, CKM_SHA512_224, CKM_SHA512_256 
 Generate key or generate key pair. CKM_RSA_PKCS_KEY_PAIR_GEN, CKM_RSA_X9_31_KEY_PAIR_GEN, CKM_DSA_KEY_PAIR_GEN, CKM_DSA_PARAMETER_GEN, CKM_EC_KEY_PAIR_GEN (CKM_ECDSA_KEY_PAIR_GEN), CKM_DH_PKCS_KEY_PAIR_GEN, CKM_DH_PKCS_PARAMETER_GEN, CKM_GENERIC_SECRET_KEY_GEN, CKM_AES_KEY_GEN, CKM_DES2_KEY_GEN, CKM_DES3_KEY_GEN, CKM_IBM_DILITHIUM 
 Wrap and unwrap. CKM_RSA_PKCS, CKM_RSA_PKCS_OAEP, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_CBC_PAD, CKM_DES3_ECB, CKM_DES3_CBC, CKM_DES3_CBC_PAD 
 Derive. CKM_ECDH1_DERIVE, CKM_DH_PKCS_DERIVE, CKM_DES3_ECB_ENCRYPT_DATA, CKM_SHA1_KEY_DERIVATION, CKM_SHA224_KEY_DERIVATION, CKM_SHA256_KEY_DERIVATION, CKM_SHA384_KEY_DERIVATION, CKM_SHA512_KEY_DERIVATION 



1: This mechanism supports only single-part operations that are not able to utilize any of the Update Cryptotoki functions, such as C_EncryptUpdate, C_DecryptUpdate, and C_DigestUpdate.

2: This mechanism is not supported by the IBM 4768 crypto card and is not available for C_SignUpdate and C_VerifyUpdate operations.





 Supported attributes and key types
Before you can rotate the master key with the IBM TKE CLI plug-in, all the current master key registers in both [operational crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeunderstand-operational-crypto-unit) and [recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-instance-modeunderstand-recovery-crypto-unit) need to be in Valid state with the current master key loaded and all the new master key registers needs to be empty.

Comparing to the option where you load a new master key value from your local workstation files, the main difference in this mode is that a new master key value is first randomly generated within a recovery crypto unit and then exported to other crypto units.

The following flow shows how master key rotation works in this mode:



1. A new random master key value is generated in the new master key register of a recovery crypto unit assigned to the service instance. The state of the new master key register is changed from Empty to Full uncommitted.
2. The new master key value is copied to the new master key registers of the crypto units that are assigned to the service instance and other recovery crypto units for the service instance. All the new master key registers now are in Full uncommitted state.
3. The new master key is committed, and all the new master key registers state are changed to Full committed.
4. Key storage is reencrypted. Encryption keys that are managed in the service instance are decrypted using the current master key in the current master key registers and reencrypted using the new master key in the new master key registers.
5. The new master key is loaded to the current master key registers of the operational and recovery crypto units for the service instance in Valid state, and the new master key registers are cleared and back to Empty state.
* [How the IBM Cloud console reflects master key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-how-console-display-progress)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-master-key-rotation-next)



[Managed key rotation - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managed-key-rotation-intromanaged-key-rotation-intro)



* [How managed key rotation works](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managed-key-rotation-introhow-managed-key-rotation-works)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managed-key-rotation-intromanaged-key-rotation-next)









 Managing regulated workloads with Hyper Protect Crypto Services 

[Managing regulated workloads with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsmanage-regulated-workloads)



* [Encrypting your regulated workloads with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsencrypt-regulated-workloads)
* [Regulated workloads use cases](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-regulated-workloadsregulated-workloads-use-cases)
After a short period of initialization, your Event Streams instance is restarted and starts accepting connections again. All data is retained, subject to the normal retention limits configured in your instance.

An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-at_eventsevents).





 Rotating the key 

Key Protect and Hyper Protect Crypto Services support the rotation of root keys, either on demand or on a schedule. When rotating the key, Event Streams adopts the new key by rewrapping the DEK as described previously in [how customer-managed encryption works](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryptionencryption_how).

An activity tracker event is generated to report the action. For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-at_eventsevents).







 Disabling customer-managed encryption 

After you enable customer-managed encryption, it is not possible to disable it. Instead, you must delete the service instance and create a new instance.
"attach_user_tags": [
"hourly-backups"
],
"copy_user_tags": false,
"created_at": "2023-05-09T15:16:37Z",
"cron_spec": "0 /2 * * ",
"deletion_trigger": {
"delete_after": 5
},
"href": "https://us-south.iaas.cloud.ibm.com/v1/backup_policies/8758bd18-344b-486a-b606-5b8cb8cdd044/plans/6e251cfe-6f7b-4638-a6ba-00e9c327b178",
"id": "6e251cfe-6f7b-4638-a6ba-00e9c327b178",
"lifecycle_state": "stable",
"name": "my-hourly-plan-2",
"remote_region_policies": {
"delete_over_count": 5,
"encryption_key": "crn:v1:bluemix:public:kms:us-south:a/dffc98a0f1f0f95f6613b3b752286b87:e4a29d1a-2ef0-42a6-8fd2-350deb1c647e:key:5437653b-c4b1-447f-9646-b2a2a4cd617" ,
"region": [
{
"name": "us-east"
},
{
"href": "https://us-east.iaas.cloud.ibm.com/v1/regions/us-east/zones/us-east-2"
}
],
},
"resource_type": "backup_policy_plan"
}





 Deleting a backup policy and plans with the API
[checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) N/A 
 IBM Cloud KMS keys N/A ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) N/A N/A 
 IBM Key Protect keys N/A ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) N/A N/A 





 What happens to the previous key versions? 

After key rotation, the service retains the previous key versions and materials until the managed key is deleted, but you can no longer edit these key materials and the key state might change. The following table lists the detailed changes and the corresponding actions that are available for previous key versions.



Table 3. Previous key versions changes

 Key type Key state changes Available for encryption Available for decryption Description 

 AWS Key Management Service keys Remain the same. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) !
For more information, check out [Retrieving an instance ID](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key is a part of. If unspecified, Key Protect will search for the key in every key ring associated with the specified instance. It is therefore recommended to specify the key ring ID for a more optimized request. Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. For more information, check out [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 



A successful restore request returns an HTTP 201 Created response, which indicates that the key was restored to the _Active_ key state and is now available for encrypt and decrypt operations. All attributes and policies that were previously associated with the key are also restored.

You will have access to data associated with the key as soon as the key is restored.
{: note}



 Optional: Verify key restoration 

You can verify that the key has been restored by getting details about the key by issuing:

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/metadata" -H "accept: application/vnd.ibm.kms.key+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Where the <keyID_or_alias> is the ID or alias of the key, the <instance_ID> is the name of your instance, and your <IAM_token> is your IAM token.

Review the state field in the response body to verify that the key transitioned to the Active key state. The following JSON output shows example metadata details for an Active key.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "test-root-key",
"aliases":
"alias-1",
"alias-2"
],
"state": 5,
"extractable": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": false,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "Deprecated",
"algorithmMetadata": {
"bitLength": "256",
"mode": "Deprecated"
},
"algorithmBitSize": 256,
"algorithmMode": "Deprecated",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"dualAuthDelete": {
"enabled": false
},
"deleted": true,
"deletionDate": "2020-03-16T21:46:53Z",
"deletedBy": "..."
}
]
}
Severity Actions 

 Critical kms.secrets.delete <br>kms.registrations.delete 
 Warning kms.secrets.rotate, kms.secrets.restore <br>kms.secrets.enable, kms.secrets.disable <br>kms.secrets.setkeyfordeletion, kms.secrets.unsetkeyfordeletion <br>kms.policies.write, kms.instance-policies.write 
 Normal kms.secrets.create, kms.secrets.read <br>kms.secrets-metadata.read, kms.secrets.head <br>kms.secrets.list, kms.secrets.wrap <br>kms.secrets.unwrap, kms.secrets.rewrap <br>kms.secrets-key-versions.list, kms.secrets-event.ack <br>kms.policies.read, kms.instance-policies.read <br>kms.import-token.create, kms.import-token.read <br>kms.registrations.create, kms.registrations.write <br>kms.registrations.merge, kms.registrations.list <br>kms.secrets.ack-delete, kms.secrets.ack-restore <br>kms.secrets.ack-rotate, kms.secrets.ack-enable <br>kms.secrets.ack-disable 



The following table lists the status codes associated with each severity level:



Table 11. Describes the severity level for Key Protect response status codes.

 Severity Status Code 

 Critical 401, 403, 503, 507 
 Warning 400, 409, 424, 502, 504, 505
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:21:55Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 disable the root key
$ ibmcloud kp key disable 264fadc3-7667-4b25-916e-5825fe70de0b

Disabling key: '264fadc3-7667-4b25-916e-5825fe70de0b', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK

 show key details - a state of "2" is "suspended"
$ ibmcloud kp key show 264fadc3-7667-4b25-916e-5825fe70de0b --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
[Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Rewrap key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Disable key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Enable key ![Check mark icon](https://cloud.ibm.com/docs-content/v1/content/0bc8db34a3d90b2a5103c9c71b08a96de9525bbc/icons/checkmark-icon.svg) 
 Delete key !
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "...",
"description": "...",
"tags":
"..."
],
"state": 2,
"extractable": false,
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": true,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "AES",
"algorithmMetadata": {
"bitLength": "128",
"mode": "CBC_PAD"
},
"algorithmBitSize": 128,
"algorithmMode": "CBC_PAD",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"keyVersion": {
"id": "30372f20-d9f1-40b3-b486-a709e1932c9c",
"creationDate": "2020-03-12T03:37:32Z"
},
"dualAuthDelete": {
"enabled": false
},
"deleted": false
}
]
}







 Enabling a disabled root key
"attach_user_tags":
"hourly-backups"
],
"copy_user_tags": false,
"created_at": "2023-05-09T15:16:37Z",
"cron_spec": "0 /2 * * ",
"deletion_trigger": {
"delete_after": 5
},
"href": "https://us-south.iaas.cloud.ibm.com/v1/backup_policies/8758bd18-344b-486a-b606-5b8cb8cdd044/plans/6e251cfe-6f7b-4638-a6ba-00e9c327b178",
"id": "6e251cfe-6f7b-4638-a6ba-00e9c327b178",
"lifecycle_state": "stable",
"name": "my-hourly-plan-2",
"remote_region_policies": {
"delete_over_count": 5,
"encryption_key": "crn:v1:bluemix:public:kms:us-south:a/dffc98a0f1f0f95f6613b3b752286b87:e4a29d1a-2ef0-42a6-8fd2-350deb1c647e:key:5437653b-c4b1-447f-9646-b2a2a4cd617" ,
"region":
{
"name": "us-east"
},
{
"href": "https://us-east.iaas.cloud.ibm.com/v1/regions/us-east/zones/us-east-2"
}
] ! ! ,
},
"resource_type": "backup_policy_plan"
}
Previous key versions changes

 Key type Key state changes Available for encryption Available for decryption Description 

 AWS Key Management Service keys Remain the same. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) For more information, see [Rotating AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). 
 Azure Key Vault keys Remain the same. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) For more information, see [Configure cryptographic key auto-rotation in Azure Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation) 
 Google Cloud KMS keys - Other key types except AES keys Remain the same. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) !
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 disable the root key
$ ibmcloud kp key disable 264fadc3-7667-4b25-916e-5825fe70de0b

Disabling key: '264fadc3-7667-4b25-916e-5825fe70de0b', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK

 show key details - a state of "2" is "suspended"
$ ibmcloud kp key show 264fadc3-7667-4b25-916e-5825fe70de0b --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:23:26Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 disable the root key identified by alias
$ ibmcloud kp key disable example-alias-1

Disabling key: '264fadc3-7667-4b25-916e-5825fe70de0b', in instance: '390086ac-76fa-4094-8cf3-c0829bd69526'...
OK

 show key details - a state of "2" is "suspended"
$ ibmcloud kp key show example-alias-1 --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "root-key-with-alias",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-09T21:21:55Z",
"lastUpdateDate": "2020-06-09T21:23:26Z",
"keyVersion": {
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"creationDate": "2020-06-09T21:21:55Z"
},
"extractable": false,
"state": 2,
For more information, see [Regional service endpoints](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsservice-endpoints). 
 port Required. The port number of the API endpoint. 
 key_ID Required. The unique identifier for the key that you want to restore. 
 IAM_token Required. Your IBM Cloud access token. Include the full contents of the IAM token, including the Bearer value, in the cURL request. For more information, see [Retrieving an access token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-access-token). 
 instance_ID Required. The unique identifier that is assigned to your Hyper Protect Crypto Services service instance. For more information, see [Retrieving an instance ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-retrieve-instance-ID). 
 key_ring_ID Optional. The unique identifier of the key ring that the key belongs to. If unspecified, Hyper Protect Crypto Services will search for the key in every key ring that is associated with the specified instance. Therefore, it is suggested to specify the key ring ID for a more optimized request. \n \n Note: The key ring ID of keys that are created without an x-kms-key-ring header is default. <br> <br>For more information, see [Managing key rings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-managing-key-rings). 



A successful restore request returns an HTTP 201 Created response, which indicates that the key was restored to the Active key state and is now available for encrypt and decrypt operations. All attributes and policies that were previously associated with the key are also restored.

You will have access to data associated with the key as soon as the key is restored.
5. Optional: Verify that the key was restored by retrieving details about the key.
Review the state field in the response body to verify that the root key transitioned to the Active key state. The following JSON output shows the metadata details for an active key.

The integer mapping for the Active key state is 1. Key States are based on NIST SP 800-57.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "...",
"description": "...",
"tags":
"..."
],
"state": 1,
"extractable": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": true,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "AES",
"algorithmMetadata": {
"bitLength": "128",
"mode": "CBC_PAD"
},
"algorithmBitSize": 128,
"algorithmMode": "CBC_PAD",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"keyVersion": {
terraform destroy --target ibm_is_backup_policy_plan.example.id

The following example deletes the example-backup-policy.

terraform destroy --target ibm_is_backup_policy.example.id

For more information, see [terraform destroy](https://developer.hashicorp.com/terraform/cli/commands/destroy).







 Backup policy statuses 

Table 1 defines the statuses for backup policies.



Table 1. Backup policy statuses.

 Status Description 

 Stable A policy and plan are actively creating backups or are available for creating new backups. 
 Pending A policy and plan are being created. 
 Deleting A policy and plan are being deleted. 
 Deleted A policy and plan no longer exist. 







 IAM roles for creating and managing backups 

Backups require IAM permissions for role-based access control. Table 2 describes these roles as they pertain to the backup actions.



Table 2. IAM roles for snapshots

 Backup action IAM role 

 Create backup policies. Administrator, editor 
 Add tags to a volume resource <br><br>[1]<br><br>. Administrator, editor 
 Delete backup policies. Administrator, editor 
 Restore a volume from a backup <br><br>[2]<br><br>. Administrator, editor, operator 
 List backups. Administrator, editor, operator, viewer 
 View backup policy details. Administrator, editor, operator, viewer 







 Activity Tracker events 

When a backup is created, an event is triggered in Activity Tracker for the [Backup service](https://cloud.ibm.com/docs/vpc?topic=vpc-at-events&interface=uievents-backup-service) and [Snapshots service](https://cloud.ibm.com/docs/vpc?topic=vpc-at-events&interface=uievents-snapshots). For more information, see [Activity Tracker events](https://cloud.ibm.com/docs/vpc?topic=vpc-at-events).





 Next steps
"CRN": "crn:v1:bluemix:public:kms:us-south:a/dffc98a0f1f0f95f6613b3b752286b87:e4a29d1a-2ef0-42a6-8fd2-350deb1c647e:key:5437653b-c4b1-447f-9646-b2a2a4cd617"
}
],
"region": [
{
"name":"us-east"
}
]
},
"name": "my-hourly-plan-2"
}'
Show more

A successful response shows that the clone policy is created.

{
"active": true,
"attach_user_tags": [
"hourly-backups"
],
"copy_user_tags": false,
"created_at": "2023-05-09T15:16:37Z",
"cron_spec": "0 /2 * * ",
"deletion_trigger": {
"delete_after": 5
},
"href": "https://us-south.iaas.cloud.ibm.com/v1/backup_policies/8758bd18-344b-486a-b606-5b8cb8cdd044/plans/6e251cfe-6f7b-4638-a6ba-00e9c327b178",
"id": "6e251cfe-6f7b-4638-a6ba-00e9c327b178",
"lifecycle_state": "stable",
"name": "my-hourly-plan-2",
"remote_region_policies": {
"delete_over_count": 5,
The integer mapping for the Active key state is 1. Key States are based on NIST SP 800-57.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "...",
"description": "...",
"tags":
"..."
],
"state": 1,
"extractable": false,
"crn": "crn:v1:bluemix:public:hs-crypto:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": true,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "AES",
"algorithmMetadata": {
"bitLength": "128",
"mode": "CBC_PAD"
},
"algorithmBitSize": 128,
"algorithmMode": "CBC_PAD",
"lastUpdateDate": "2020-03-16T20:41:27Z",
"keyVersion": {
"id": "30372f20-d9f1-40b3-b486-a709e1932c9c",