vania-janet/multiturn-rag-retrieval-data huggingface dataset:
* [Resource Aliases APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerlist-resource-aliases)
* [IAM Policy APIs](https://cloud.ibm.com/apidocs/iam-policy-managementlist-policies)
* [Global Search APIs](https://cloud.ibm.com/apidocs/search)
* Global Tagging [Attach](https://cloud.ibm.com/apidocs/taggingattach-tag) and [Detach](https://cloud.ibm.com/apidocs/taggingdetach-tag) APIs
* [Context-based Restriction Rule APIs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule)
* [Secrets Manager APIs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2)







 Creating network zones 

By creating network zones, you can define an allowlist of network locations where access requests originate to determine when a rule can be applied. The list of network locations can be specified by the following attributes:



* IP addresses, which include individual addresses, ranges, or subnets.
* VPCs
* Service references, which allow access from other IBM Cloud services.



Make sure to add Secrets Manager to network zones for rules that target other IBM Cloud resources, or some operations in your workflow might fail.

If you created an IBM Cloud virtual server on classic infrastructure in your Virtual Private Cloud, the private IP address that you must use for the CBR rule is a Virtual Private Cloud gateway IP. Do not use the internal IP address for the virtual server on classic infrastructure. To find the gateway IP address, select the relevant IBM Cloud service endpoint source IP address in your Virtual Private Cloud Infrastructure.



 Creating network zones by using the API 

You can create network zones by using the create-zone command. For more information, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-zone).
logging = false
priority = 90
enabled = true
},
snat-to-internet-1 = {
rule_type = "SNAT"
description = "SNAT rule to application-network-1"
external_address_target = "public-ip-0"
external_address = ""
internal_address_target = "application-network-1"
internal_address = ""
snat_destination_address = ""
logging = false
priority = 100
enabled = true
},
snat-to-internet-2 = {
rule_type = "SNAT"
description = "SNAT rule to db-network-1"
external_address_target = "public-ip-0"
external_address = ""
internal_address_target = "db-network-1"
internal_address = ""
snat_destination_address = ""
logging = false
priority = 100
enabled = true
},
}
Show more
8. Create IP Sets and Static Groups, which are needed in the defining firewall rules.

The Terraform template creates IP Sets for the public IP addresses used in NAT rules. You can also define additional IP sets, for example for your on-premises networks or other private or public IP addresses.

 Note. You need to create IP sets to be used in firewall rules.
 You can use the public_ips keys here as address_targets,
 but you can define IP sets using real IP addresses using a
 list ip_addresses.

ip_sets = {
ip-set-on-public-ip-0 = {
description = "Public IP 0 - used for SNAT"
ip_addresses = []
address_target = "public-ip-0"
},
ip-set-on-public-ip-1 = {
description = "Public IP 1 - used for DNAT to app-server-1"
ip_addresses = []
address_target = "public-ip-1"
},
Creating your new traffic flows 

Now that you've created the new zone (CUSTOMER-PUBLIC), you'll need to configure policies to control the network traffic flow. The first one configured allows all traffic within the CUSTOMER-PUBLIC zone. The second allows all traffic from CUSTOMER-PUBLIC out to the public internet, while the third flow allows only SSH and PING traffic from the public internet to CUSTOMER-PUBLIC, and drops the rest (as the default action is drop).

Scroll to the right to view the entire command.

set security policies from-zone CUSTOMER-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_INTERNAL description "Allow all traffic within CUSTOMER_PUBLIC zone"
set security policies from-zone CUSTOMER-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_INTERNAL match source-address any
set security policies from-zone CUSTOMER-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_INTERNAL match destination-address any
set security policies from-zone CUSTOMER-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_INTERNAL match application any
set security policies from-zone CUSTOMER-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_INTERNAL then permit

set security policies from-zone CUSTOMER-PUBLIC to-zone SL-PUBLIC policy ALLOW_OUTBOUND description "Allow all outbound traffic from CUSTOMER-PUBLIC to the internet"
set security policies from-zone CUSTOMER-PUBLIC to-zone SL-PUBLIC policy ALLOW_OUTBOUND match source-address any
set security policies from-zone CUSTOMER-PUBLIC to-zone SL-PUBLIC policy ALLOW_OUTBOUND match destination-address any
set security policies from-zone CUSTOMER-PUBLIC to-zone SL-PUBLIC policy ALLOW_OUTBOUND match application any
set security policies from-zone CUSTOMER-PUBLIC to-zone SL-PUBLIC policy ALLOW_OUTBOUND then permit

set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH description "Allow ping and SSH from the internet to the public subnet"
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH match source-address any
set security policies from-zone SL-PUBLIC to-zone CUSTOMER-PUBLIC policy ALLOW_PING_SSH match destination-address VSI_PUB_NET
[Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) 
 Organization vDC Distributed Firewall: View Rules ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) !
family inet {
address 10.188.111.70/26;
}
}
}
ae1 {
description PUBLIC_VLAN;
flexible-vlan-tagging;
native-vlan-id 985;
unit 0 {
vlan-id 985;
family inet {
address 169.60.101.121/28;
}
family inet6 {
address 2607:f0d0:3901:0063:0000:0000:0000:000f/64;
}
}
}
fxp0 {
unit 0;
}
lo0 {
unit 0 {
family inet {
filter {
input PROTECT-IN;
}
address 127.0.0.1/32;
}
}
}
}
firewall {
filter PROTECT-IN {
term PING {
from {
destination-address {
169.60.101.121/32;
10.188.111.70/32;
}
protocol icmp;
}
then accept;
}
term SSH {
from {
destination-address {
169.60.101.121/32;
10.188.111.70/32;
}
protocol tcp;
destination-port ssh;
}
then accept;
}
term WEB {
from {
destination-address {
169.60.101.121/32;
10.188.111.70/32;
}
protocol tcp;
port 8443;
}
then accept;
}
term DNS {
from {
protocol udp;
source-port 53;
}
then accept;
}
}
}
routing-options {
static {
route 166.9.0.0/16 next-hop 10.188.111.65;
set interfaces reth2 unit 1898 family inet address 10.208.237.97/29
set security zones security-zone SL-PRIVATE interfaces reth2.1898 host-inbound-traffic system-services all
set security address-book global address VSI_PRIV_NET 10.208.237.96/29
set security address-book global address VSI_PRIV_NET1 10.186.228.144/28
set security address-book global address VSI_PRIV_NET2 10.208.110.120/29

Public side configuration example:

set interfaces reth3 vlan-tagging
set interfaces reth3 redundant-ether-options redundancy-group 1
set interfaces reth3 unit 1523 vlan-id 1523
set interfaces reth3 unit 1523 family inet address 169.47.211.153/29
set security zones security-zone CUSTOMER-PUBLIC interfaces reth3.1523 host-inbound-traffic system-services all
set security address-book global address VSI_PUB_NET 169.47.211.152/29



 Filtering on loopback considerations 

The PROTECT-IN filter on loopback blocks (by default) all local traffic traveling to and from the vSRX that hasn't been explicitly allowed. As a result, in order to ping the subnet gateways defined previously, or to ping servers on those subnets from the vSRX, the subnet gateways must be added to PROTECT-IN. This is configured by default for the reth1 and reth0 IP addresses and is why they are accessible after provisioning.

set firewall filter PROTECT-IN term PING from destination-address 10.208.237.97/32
set firewall filter PROTECT-IN term PING from destination-address 10.208.110.121/32
set firewall filter PROTECT-IN term PING from destination-address 10.186.228.145/32
set firewall filter PROTECT-IN term PING from destination-address 169.47.211.153/32
set firewall filter PROTECT-IN term PING from protocol icmp
set firewall filter PROTECT-IN term PING then accept
address SL17 10.2.48.0/20;
address SL14 10.1.208.0/20;
address SL15 10.2.80.0/20;
address SL12 10.2.112.0/20;
address SL13 10.2.160.0/20;
address SL10 10.2.32.0/20;
address SL11 10.2.64.0/20;
address SL_PRIV_MGMT 10.129.33.87/32;
address SL_PUB_MGMT 161.202.136.77/32;
address-set SERVICE {
address SL8;
address SL9;
address SL4;
address SL5;
address SL6;
address SL7;
address SL1;
address SL2;
address SL3;
address SL20;
address SL18;
address SL19;
address SL16;
address SL17;
address SL14;
address SL15;
address SL12;
address SL13;
address SL10;
address SL11;
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
queue-size 2000; Warning: 'queue-size' is deprecated
timeout 20;
}
land;
}
}
}
policies {
from-zone SL-PRIVATE to-zone SL-PRIVATE {
policy Allow_Management {
match {
source-address any;
destination-address [ SL_PRIV_MGMT SERVICE ];
application any;
}
then {
permit;
}
}
}
from-zone SL-PUBLIC to-zone SL-PUBLIC {
policy Allow_Management {
Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=uicbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID zone can access the cluster. Since no operations are specified, resources in the NETWORK-ZONE-ID zone can access both the cluster and management APIs.

{
"description": "Example rule 1",
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT-ID"
},
{
"name": "serviceName",
"value": "containers-kubernetes"
},
{
"name": "serviceInstance",
"value": "CLUSTER-ID"
}
]
}
],
"contexts": [
{
"attributes":
{
"name": "networkZoneId",
"value": "NETWORK-ZONE-ID"
},
{
"name": "endpointType",
"value": "private"
}
]
}
]
}

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only the resources defined in the NETWORK-ZONE-ID zone can access the cluster. Since the cluster API type is specified, resources in the NETWORK-ZONE-ID zone can access the cluster through the cluster APIs over the private network.

{
"description": "Example rule 2",
Review the [limitations](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr&interface=clicbr-limitations) before you create rules.



 Creating rules by using the API 

Review the following example requests to create rules. For more information about the v1/rules API, see the [API docs](https://cloud.ibm.com/apidocs/context-based-restrictionscreate-rule).

After you create a rule, it might take up to 10 minutes to before you can update that rule due to IAM TTL response caching.

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID zone can access the cluster. Since no operations are specified, resources in the NETWORK-ZONE-ID zone can access both the cluster and management APIs.

{
"description": "Example rule 1",
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT-ID"
},
{
"name": "serviceName",
"value": "containers-kubernetes"
},
{
"name": "serviceInstance",
"value": "CLUSTER-ID"
}
]
}
],
"contexts": [
{
"attributes":
{
"name": "networkZoneId",
"value": "NETWORK-ZONE-ID"
},
{
"name": "endpointType",
"value": "private"
}
]
}
]
}

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only the resources defined in the NETWORK-ZONE-ID zone can access the cluster. Since the cluster API type is specified, resources in the NETWORK-ZONE-ID zone can access the cluster through the cluster APIs over the private network.

{
"description": "Example rule 2",
You can use the default group for this access control list, or select from the resource group list (if defined). For more information, see [Best practices for organizing resources in a resource group](https://cloud.ibm.com/docs/account?topic=account-account_setup).



After provisioning is complete, you cannot change the resource group.



* Tags - Add user tags. User tags are visible account-wide. For more information, see [Working with tags](https://cloud.ibm.com/docs/account?topic=account-tag).
* Access management tags - Add access management tags to help organize access control relationships. For more information, see [Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial).
* VPC - Select a VPC. You can use the default VPC for this public gateway, or select from the list (if defined). For more information, see [Getting started with Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&interface=ui).



6. Under Rules, click the Create + button to configure inbound and outbound rules that define what traffic is allowed in or out of the subnet. For each rule, specify the following information:



* Select whether to allow or deny the specified traffic.
* Select the protocol to which the rule applies.
* For the source and destination of the rule, specify the IP range and ports for which the rule applies. For example, if you want all inbound traffic to be allowed to the IP range 192.168.0.0/24 in your subnet, specify Any as the source and 192.168.0.0/24 as the destination. However, if you want to allow inbound traffic only from 169.168.0.0/24 to your entire subnet, specify 169.168.0.0/24 as the source and Any as the destination for the rule.
* Specify the rule's priority. Rules with lower numbers are evaluated first and override rules with higher numbers.
}
]
}
],
"contexts": [
{
"attributes":
{
"name": "networkZoneId",
"value": "NETWORK-ZONE-ID"
},
{
"name": "endpointType",
"value": "private"
}
]
}
]
}

After you create rules, you can [update](https://cloud.ibm.com/apidocs/context-based-restrictionsreplace-rule) and [delete](https://cloud.ibm.com/apidocs/context-based-restrictionsdelete-rule) them.





 Creating rules by using the UI 

After you set the prerequisites and requirements, you can create rules in the UI.



1. Determine the resources that you want add to your allowlist.
2. Follow the steps to [create context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=uicontext-restrictions-create-rules) in the console. Add the Secrets Manager service to your network zones to allow IBM Cloud® Secrets Manager to access services and resources in your account.



After you create rules, you can [update](https://cloud.ibm.com/apidocs/context-based-restrictionsreplace-rule) and [delete](https://cloud.ibm.com/apidocs/context-based-restrictionsdelete-rule) them.





 Create rules by using the CLI 

Review the following examples to learn how to create rules for Secrets Manager. For more information, see the CBR [CLI reference](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugin).



1. To create rules from the CLI, [install the CBR CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-cbr-plugininstall-cbr-plugin).
2.
* [Allowing the cluster to access resources through Calico network policies](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_calico_egress)
* [Allowing traffic from your cluster in other services' allowlists or in on-premises allowlists](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_workers)
* [Updating IAM allowlists for Kubernetes Service IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-firewalliam_firewall)



* [Getting your Kubernetes Service subnet IP addresses](https://cloud.ibm.com/docs/openshift?topic=openshift-firewalliam_cidr_ip)





[Restricting network traffic to edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge)



* [Isolating networking workloads to edge nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_nodes)
* [Preventing app workloads from running on edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgeedge_workloads)
* [Deploying the Sysdig agent on edge worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-edgesysdig-edge)







 Controlling traffic in VPC clusters with ACLs, security groups, and network policies 

[Overview of network security options](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policyvpc-network-policy)



* [Comparison of network security options](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policycomparison)
* [Access control lists (ACLs) or security groups?]
* You can add existing network zones to your rule or create new zones to add to your rule. For more information, see [Creating network zones](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-createnetwork-zones-create).



8. Click Continue.
9. Provide a unique description.
10. Select how you want to enforce the rule. You can decide how you want to enforce a rule upon creation and update the rule enforcement at any time.



* Enable: Enforce the rule. Denied access attempts are reported in Activity Tracker.
* Disable: Don't enforce the rule. Restrictions don't apply to your account resources. Select this option if you're not ready to enable the rule.
* Report-only: Monitor how the rule affects users without enforcing it. All attempts to access resources in the account are logged in Activity Tracker. Monitoring is recommended for 30 days before you enforce the rule.



11. Click Create.







 Creating rules by using the CLI 

To define restrictions to your cloud resources by creating rules, use the [ibmcloud cbr rule-create](https://cloud.ibm.com/docs/account?topic=cli-cbr-plugin&interface=clicbr-cli-rule-create-command) command. The following example creates a rule that targets the Kubernetes Service and allows only private endpoints from the specified network zone to access the service.

ibmcloud cbr rule-create --description 'Example Rule Description' --service-name kms --context-attributes endpointType=private --zone-id 93de8d3f588ab2c457ff576c364d1145 --enforcement-mode report

For the enforcement-mode option, the CLI accepts the values enabled, disabled, and report. If no enforcement is specified, the rule is enabled by default. For more informaiton, see [Rule enforcement](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatisrule-enforcement).





 Creating rules by using the API
ibmcloud is network-acl-rule-add my_web_acl_rule200 $webacl deny inbound all 0.0.0.0/0 0.0.0.0/0 --before-rule-id $in-rule

At each step, save the ID of the ACL rule in a variable so the ID can be used in later commands. For example, you can use the variable acl200:

acl200="0738-90930627-1a1d-447b-859f-ac9431986b6f"

Now add the rule to acl200:

ibmcloud is network-acl-rule-add my_web_acl_rule100 $webacl allow inbound all 10.10.20.0/24 0.0.0.0/0 --before-rule-id $acl200

Add more rules until your ACL setup is complete, saving each ID as a variable.

acl100="0738-78340627-1a1d-447b-859f-ac9431986b6f"
ibmcloud is network-acl-rule-add my_web_acl_rule20 $webacl allow inbound tcp 0.0.0.0/0 0.0.0.0/0 --source-port-min 443 --source-port-max 443 --before-rule-id $acl100
acl20="32450627-1a1d-447b-859f-ac9431986b6f"
ibmcloud is network-acl-rule-add my_web_acl_rule10 $webacl allow inbound tcp 0.0.0.0/0 0.0.0.0/0 --source-port-max 80 --source-port-min 80 --before-rule-id $acl20

Insert new outbound rules before the default outbound rule.
[Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) 
 Organization vDC Distributed Firewall: Configure Rules ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/5bdb37c0149145723c5437e8176651928565e722/vmwaresolutions/includes/icons/checkmark-icon.svg) !
Firewall appliance 

You have the following options for your firewall appliance:



*  Gateway cluster with Juniper vSRX - Order a dedicated cluster for the network edge and firewall components and install Juniper® vSRX on it.
*  Gateway cluster with FortiGate Virtual Appliance - Order a dedicated cluster for the network edge and firewall components and install FortiGate® Virtual Appliance on it.
*  Bring your own gateway appliance - Order a dedicated cluster for the network edge and firewall components.
*  FortiGate Security Appliance - Use an IBM Cloud service, which is an enterprise-class hardware firewall for enhanced and granular control over your network.



The steps that you must follow differ depending on your selection.



  Related links 



*  [Gateway cluster](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-orderinginstance-edge)
*  [Procedure to order VMware Regulated Workloads](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-orderinginstance-procedure)
*  [VMware Regulated Workloads reference architecture overview](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vrw-archi-overview)
* [Prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-prereqs)
* [Creating your network zone](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-create-zone)
* [Creating your CBR rule](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-create-rule)
* [Testing your context-based restrictions](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-create-test)
* [Additional scenarios](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-create-additional-scenarios)



* [Allowing different IPs to access the public and private service endpoints](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-scenarios-pub-priv-one-ip)
* [Allowing different IPs to access different API types over the public and private service endpoints](https://cloud.ibm.com/docs/openshift?topic=openshift-cbr-tutorialcbr-tutorial-scenarios-pub-priv-api-types)









 Managing access control 

[Understanding access control for clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-overview)



* [Access control checklist](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-checklist)



* [IBM Cloud access control](https://cloud.ibm.com/docs/openshift?topic=openshift-access-overviewaccess-checklist-iam)