vania-janet/multiturn-rag-retrieval-data huggingface dataset:
sc.hadoopConfiguration.set("parquet.encryption.key.list" , "k1:iKwfmI5rDf7HwVBcqeNE6w== , k2:LjxH/aXxMduX6IQcwQgOlw== , k3:rnZHCxhUHr79Y6zvQnxSEQ==")
3. Call the regular parquet read commands, such as:

val dataFrame = spark.read.parquet("<path to encrypted files>")







 Key rotation 

If key rotation is required, the following Hadoop configuration properties must be set:



* The parameters "parquet.encryption.key.list", "parquet.encryption.new.key.list"
* The parameter "parquet.encryption.key.material.store.internally" must be set to "false"
* The parameter "parquet.encryption.kms.client.class" must be set to "com.ibm.parquet.key.management.InMemoryKMS"
* The parameter "parquet.crypto.factory.class" must be set to "com.ibm.parquet.key.management.IBMKeyToolsFactory"



For example:

sc.hadoopConfiguration.set("parquet.encryption.key.list", OLD_KEYS)
sc.hadoopConfiguration.set("parquet.encryption.new.key.list", NEW_KEYS)
sc.hadoopConfiguration.set("parquet.encryption.key.material.store.internally", "false")
sc.hadoopConfiguration.set("parquet.encryption.kms.client.class", "com.ibm.parquet.key.management.InMemoryKMS")
sc.hadoopConfiguration.set("parquet.crypto.factory.class","com.ibm.parquet.key.management.IBMKeyToolsFactory")

KeyToolkit.rotateMasterKeys("<path to encrypted files>", sc.hadoopConfiguration)
<br> <br>To rotate a key that was initially generated by Key Protect, omit the payload attribute and pass an empty request entity-body. To rotate an imported key, provide a key material that meets the following requirements: <br> <br>The key must be 128, 192, or 256 bits. The bytes of data, for example 32 bytes for 256 bits, must be encoded by using base64 encoding. 



A successful rotation request returns an HTTP 204 No Content response, which indicates that your root key was replaced by new key material.



 Optional: Verify key rotation 

You can verify that a key has been rotated by issuing a list keys request:

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys" -H "accept: application/vnd.ibm.collection+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Where the <instance_ID> is the name of your instance and your <IAM_token> is your IAM token.

Review the lastRotateDate and keyVersion values in the response entity-body to inspect the date and time that your key was last rotated.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "test-root-key",
"state": 1,
"extractable": false,
You can rotate the master key using TKE CLI plug-in regardless of whether your service instance has recovery crypto units assigned to it or not.

The following flow shows how master key rotation works in this mode:



1. Load the new master key register by using the cryptounit-mk-load command. The state of the new master key register is changed from Empty to Full uncommitted.
2. Commit the new master key value by using the cryptounit-mk-commit command. The new master key register state is changed to Full committed.
3. Reencrypt key storage and activate the new master key by using the cryptounit-mk-rotate command:



1. Encryption keys in key storage are decrypted by using the value in the current master key register and then reencrypted by using the value in the new master key register. The rewrapping takes place inside the HSM, so it's secure.
2. The new master key is activated and loaded to the current master key register in Valid state, and the new master key register is cleared and back to Empty state.





For detailed instructions, see [Rotating master keys by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-part).







 What's next 

For more detailed instructions on options to rotate master keys, see:



* [Rotating master keys by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-smart-cards).
* [Rotating master keys by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-recovery-crypto-unit).
* [Rotating master keys by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-part).
[Random number generation](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959750) C_GenerateRandom Yes Generates random data. The length of the random data cannot be zero and the pointer that points to the random data location cannot be NULL. 
 [Parallel function management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959751) C_GetFunctionStatus No Legacy function that always returns CKR_FUNCTION_NOT_PARALLEL. 
 [Parallel function management](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html_Toc416959751) C_CancelFunction No Legacy function that always returns CKR_FUNCTION_NOT_PARALLEL. 



1: The current implementation of the C_CreateObject function supports secret key objects, private key objects, public key objects, and X.509 Public Key Certificate objects.





 Supported mechanisms 

A mechanism is referred to as a process to implement a cryptographic operation. It can vary depending on the level of firmware in the crypto card. The following table shows the mechanisms that are supported and how they relate to common Cryptoki function categories.



Table 2. Describes the supported PKCS #11 mechanisms

 Function group Supported mechanisms 

 Encrypt and decrypt. CKM_RSA_PKCS^1^, CKM_RSA_PKCS_OAEP^1^, CKM_AES_ECB, CKM_AES_CBC, CKM_AES_CBC_PAD, CKM_DES3_ECB, CKM_DES3_CBC, CKM_DES3_CBC_PAD 
 Sign and verify.
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key

 rotate the key
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Rotating root key...
OK

 show key details
$ ibmcloud kp key show 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Grabbing info for key id: 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad...
OK
Key ID Key Name Description Creation Date Expiration Date
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key 2020-05-06 17:25:22 +0000 UTC Key does not expire

 create a new key material
$ NEW_KEY_MATERIAL=$(openssl rand -base64 32)

 Key Protect created the root key, providing a new key material will fail
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad -k $NEW_KEY_MATERIAL

Rotating root key...
FAILED





 Example 2 

Rotate a base64-encoded or an imported token key.

First, create a root key from a [base64 value](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-create-example-3) or an [imported token](https://cloud.ibm.com/docs/key-protect-cli-plugin?topic=key-protect-cli-plugin-key-protect-cli-referencekp-key-create-example-4).

 create a random, base64-encoded, 32-byte key material
To learn how IAM roles map to Hyper Protect Crypto Services service actions, check out [Service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles).
2. Retrieve the ID of the key that you want to rotate.

You can retrieve the ID for a specified key by making a GET /v2/keys request, or by viewing your keys in the IBM Cloud console.
3. [Create and retrieve an import token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokens).
4. Use the import token to encrypt the key material that you want to use to rotate the existing key.

To learn how to use an import token, check out [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keys).
5. Replace the existing key with new key material by running the following cURL command.

curl -X POST 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/rotate 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>' 
-H 'accept: application/vnd.ibm.kms.key_action+json' 
-H 'content-type: application/vnd.ibm.kms.key_action+json' 
-d '{
"type": "application/vnd.ibm.kms.key+json",
"name": "<key_alias>",
"description": "<key_description>",
"extractable": <key_type>,
"payload": "<encrypted_key>",
"encryptionAlgorithm": "RSAES_OAEP_SHA_1",
"labels" : [ "dev", "us-south" ],
"name" : "example-arbitrary-secret",
"secret_group_id" : "default",
"secret_type" : "arbitrary",
"payload" : "secret-data",
"version_custom_metadata" : {
"anyKey" : "anyValue"
}
}
Show more





 SecretVersionActionPrototype 

The following example shows the format of the SecretVersionActionPrototype object.

{
"action_type" : "private_cert_action_revoke_certificate"
}





 SecretVersionPrototype 

The following example shows the format of the SecretVersionPrototype object.

{
"payload" : "updated secret credentials",
"custom_metadata" : {
"anyKey" : "anyValue"
},
"version_custom_metadata" : {
"anyKey" : "anyValue"
}
}
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key

 rotate the key
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Rotating root key...
OK

 show key details
$ ibmcloud kp key show 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Grabbing info for key id: 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad...
OK
Key ID Key Name Description Creation Date Expiration Date
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key 2020-05-06 17:25:22 +0000 UTC Key does not expire

 create a new key material
$ NEW_KEY_MATERIAL=$(openssl rand -base64 32)

 Key Protect created the root key, providing a new key material will fail
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad -k $NEW_KEY_MATERIAL

Rotating root key...
FAILED





 Example 2 

Rotate a base64-encoded or an imported token key.

First, create a root key from a [base64 value](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create-example-3) or an [imported token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-referencekp-key-create-example-4).

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

 create a root key from a base64-encoded value
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key

 rotate the key
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Rotating root key...
OK

 show key details
$ ibmcloud kp key show 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Grabbing info for key id: 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad...
OK
Key ID Key Name Description Creation Date Expiration Date
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key 2020-05-06 17:25:22 +0000 UTC Key does not expire

 create a new key material
$ NEW_KEY_MATERIAL=$(openssl rand -base64 32)

 Key Protect created the root key, providing a new key material will fail
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad -k $NEW_KEY_MATERIAL

Rotating root key...
FAILED





 Example 2 

Rotate a base64-encoded or an imported token key.

First, create a root key from a [base64 value](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-create-example-3) or an [imported token](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-key-create-example-4).

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)

 create a root key from a base64-encoded value
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-recovery-crypto-unitrotate-master-key-cli-recovery-crypto-unit-next)



[Rotating master keys by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-partrotate-master-key-cli-key-part)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-partrotate-master-key-cli-key-part-prerequisites)
* [Rotating master keys by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-partrotate-master-key-cli-key-part-steps)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-master-key-cli-key-partrotate-master-key-cli-key-part-next)



[Recovering a master key from a recovery crypto unit](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unitrecover-master-key-recovery-crypto-unit)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unitrecover-master-key-prerequisites)
* [Recovering master keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unitrecover-master-key-step)
<br> <br>To learn more, see [Tutorial: Creating and importing encryption keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-tutorial-import-keystutorial-import-encrypt-nonce). 



A successful rotation request returns an HTTP 204 No Content response, which indicates that your root key was replaced by new key material.





 Optional: Verify import token key rotation 

You can verify that a key that was imported via import token has been rotated by issuing a get key metadata request:

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/metadata" -H "accept: application/vnd.ibm.kms.key+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Where the <keyID_or_alias> is the ID or alias of the key, the <instance_ID> is the name of your instance, and your <IAM_token> is your IAM token.

Review the lastRotateDate and keyVersion values in the response entity-body to inspect the date and time that your key was last rotated.

You can also list the versions that are available for the key by using the Key Protect API. To learn more, see [Viewing key versions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-key-versions).
Key ID Key Name
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key

 rotate the key
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Rotating root key...
OK

 show key details
$ ibmcloud kp key show 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad

Grabbing info for key id: 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad...
OK
Key ID Key Name Description Creation Date Expiration Date
1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad my-root-key 2020-05-06 17:25:22 +0000 UTC Key does not expire

 create a new key material
$ NEW_KEY_MATERIAL=$(openssl rand -base64 32)

 Key Protect created the root key, providing a new key material will fail
$ ibmcloud kp key rotate 1a6d5be8-287c-4eb3-9c44-cf0c2b0d67ad -k $NEW_KEY_MATERIAL

Rotating root key...
FAILED





 Example 2 

Rotate a base64-encoded or an imported token key.

First, create a root key from a [base64 value](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-create-example-3) or an [imported token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-five-twokp-key-create-example-4).

 create a random, base64-encoded, 32-byte key material
$ KEY_MATERIAL=$(openssl rand -base64 32)
Where the <keyID_or_alias> is the ID or alias of the key, the <instance_ID> is the name of your instance, and your <IAM_token> is your IAM token.

Review the state field in the response body to verify that the key transitioned to the Active key state. The following JSON output shows example metadata details for an Active key.

{
"metadata": {
"collectionType": "application/vnd.ibm.kms.key+json",
"collectionTotal": 1
},
"resources": [
{
"type": "application/vnd.ibm.kms.key+json",
"id": "02fd6835-6001-4482-a892-13bd2085f75d",
"name": "...",
"description": "...",
"tags":
"..."
],
"state": 1,
"extractable": false,
"crn": "crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:12e8c9c2-a162-472d-b7d6-8b9a86b815a6:key:02fd6835-6001-4482-a892-13bd2085f75d",
"imported": true,
"creationDate": "2020-03-10T20:41:27Z",
"createdBy": "...",
"algorithmType": "Deprecated",
"algorithmMetadata": {
"bitLength": "128",
"mode": "Deprecated"
},
"algorithmBitSize": 128,
"algorithmMode": "Deprecated",
Body for IBM Cloud one-time passcode grant_type: urn:ibm:params:oauth:grant-type:passcode <br>response_type: cloud_iam, uaa <br>passcode: <my_passcode> <br>uaa_client_id: cf <br>uaa_client_secret: <br>Note: Add the uaa_client_secret key with no value specified. 



Example API output:

{
"access_token": "<iam_token>",
"refresh_token": "<iam_refresh_token>",
"uaa_token": "<uaa_token>",
"uaa_refresh_token": "<uaa_refresh_token>",
"token_type": "Bearer",
"expires_in": 3600,
"expiration": 1493747503
}

You can find the IAM token in the access_token field of your API ouput.

The following example shows how to use IAM token while calling APIs.

GET https://org.domain/api/v0002/bulk/devices



 Input parameter Values 

 Headers Content-Type: application/json <br>Authorization: bearer <iam_token>
if (current.u_appconfiguration_tag == "appconfig-workflow" && (current.state == -1 || current.state == -5 || current.state == 4)) {
//creating the glider Encrypt object
var glideEncrypt = new GlideEncrypter();
//fetching the sys_property that contains the IAM key
var encryptedIbmIAMKey = gs.getProperty('<Add System property name which holds the IBM IAM key (Case Sensitive)>');
//example: var encryptedKey = gs.getProperty('WorkflowAppConfigIamKey');
//Decrypting the key
var decryptedIAMKey = glideEncrypt.decrypt(encryptedIbmIAMKey);
gs.addInfoMessage("IBM KEY DECRYPTION COMPLETED");
if (Object.keys(decryptedIAMKey).length !== 0) {
gs.addInfoMessage("CHANGE REQUEST IDENTIFIED AS WORKFLOW RELATED");
//Adding the decrypted key to the IAM token generation body
var bodyContent = "grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=" + decryptedIAMKey;
//Making POST call to IBM IAM to generate token
var ibmIamTokenRequest = new sn_ws.RESTMessageV2();
ibmIamTokenRequest.setHttpMethod('POST');
ibmIamTokenRequest.setEndpoint('https://iam.cloud.ibm.com/identity/token');
ibmIamTokenRequest.setRequestBody(bodyContent);
ibmIamTokenResponse = ibmIamTokenRequest.execute();
var ibmIamTokenResponseCode = ibmIamTokenResponse.getStatusCode();
"credential": {
"type": "token"
}
},
"target": {
"id": "crn:v1::public:is::a/ef0574dd126031eba03e554728ab939::snapshot:4e3252d7-cf32-4586-93e9-f7d9a497bed4",
"typeURI": "is.snapshot/snapshot",
"name": "my-snapshot-2"
},
"observer": {
"name": "ActivityTracker"
},
"reason": {
"reasonCode": 200,
"reasonType": "OK"
},
"severity": "normal",
"requestData": {
"generation": "2"
},
"responseData": {
"responseURI": "/v1/snapshots/4e3252d7-cf32-4586-93e9-f7d9a497bed4"
},
"dataEvent": false,
"logSourceCRN": "crn:v1::public:is::a/ef0574dd126031eba03e554728ab939::snapshot:4e3252d7-cf32-4586-93e9-f7d9a497bed4",
"saveServiceCopy": true
}







 IAM roles for creating and managing snapshots 

Snapshots require IBM Cloud® Identity and Access Management (IAM) permissions for role-based access control. Table 1 describes these roles as they pertain to snapshots actions.



Table 1. IBM Cloud® Identity and Access Management roles for snapshots.

 Snapshot action IAM role 

 Create snapshots Administrator, editor 
 Delete snapshots Administrator, editor 
 Create volume from a snapshot<br><br>[1] Administrator, editor, operator
IAM_TOKEN=curl -k -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" --data-urlencode "grant_type=urn:ibm:params:oauth:grant-type:apikey" --data-urlencode "apikey=$apikey" "https://iam.cloud.ibm.com/identity/token" |jq -r '(.token_type + " " + .access_token)'

To view the IAM token, run echo $IAM_TOKEN. The result should look like this:

Bearer <your_token>

The Authorization header expects the token to begin with Bearer. If the result doesn't include Bearer, update the iam_token variable to include it. These examples assume that Bearer is included in the IAM_TOKEN.

Because the IAM token expires, you must repeat the preceding step to refresh your token every hour.





 Step 3: Store the API endpoint as a variable 

Run the following command to store the API endpoint in a variable so that it can be reused later in your session.

Public endpoint:

directlink_api_endpoint="https://directlink.cloud.ibm.com"

Virtual private endpoint:

directlink_api_endpoint="https://private.directlink.cloud.ibm.com"

To verify that the variable was saved, run echo $directlink_api_endpoint and ensure that the response is not empty.





 Step 4: Store the API version as a variable 

Every API request must include the version parameter, in the format YYYY-MM-DD. Run the following command to store the version date in a variable so that it can be reused in your session. For more information about setting the version parameter, see Versioning in the [Direct Link API](https://cloud.ibm.com/apidocs/direct_linkversioning).

api_version="2020-03-31"

To verify that this variable was saved, run echo $api_version and make sure that the response is not empty.
POST https://iam.cloud.ibm.com/identity/token

Header
: <-- <ul> -->

* Content-Type: application/x-www-form-urlencoded
* Authorization: Basic Yng6Yng= where Yng6Yng= equals the URL-encoded authorization for the username bx and the password bx.
* cache-control: no-cache

<-- </ul> -->

Body
: <-- <ul> -->

* delegated_refresh_token_expiry: 600
* receiver_client_ids: kube
* response_type: delegated_refresh_token
* refresh_token: Your IBM Cloud IAM refresh token.
* grant_type: refresh_token

<-- </ul> -->

The following example shows output from the previous API request.

{
"delegated_refresh_token": <delegated_refresh_token>
}
3. Retrieve an IBM Cloud IAM ID, IAM access, and IAM refresh token by using the delegated refresh token from the previous step. In your API output, you can find the IAM ID token in the id_token field, the IAM access token in the access_token field, and the IAM refresh token in the refresh_token field.
POST https://iam.cloud.ibm.com/identity/token

Header
: <-- <ul> -->

* Content-Type: application/x-www-form-urlencoded
* Authorization: Basic a3ViZTprdWJla3ViZTprdWJl equals the URL-encoded authorization for the username kube and the password kube.
* cache-control: no-cache

<-- </ul> -->

Body
: <-- <ul> -->

* refresh_token: Your IBM Cloud IAM delegated refresh token.
target_resource_instance_id = ibm_resource_instance.kms.guid
roles = ["Viewer", "ReaderPlus"]
}

resource "ibm_cd_toolchain_tool_keyprotect" "integration" {
toolchain_id = ibm_cd_toolchain.toolchain.id
parameters {
name = "my-kms-tool-integration"
region = var.region
resource_group = data.ibm_resource_group.rg.name
instance_name = ibm_resource_instance.kms.name
}
depends_on = [
ibm_iam_authorization_policy.s2s
]
}

resource "ibm_cd_toolchain_tool_slack" "integration" {
toolchain_id = ibm_cd_toolchain.toolchain.id
parameters {
webhook = "{vault::my-kms-tool-integration.my-slack-webhook}"
channel_name = var.slack_channel
team_name = var.slack_team
}
depends_on = [
ibm_cd_toolchain_tool_keyprotect.integration
ibm_kms_key.key
]
}

The following table lists and describes each of the secrets reference values that are used in the previous example.



Table 2. Secret reference values

 Value Description 

 my-kms-tool-integration The name of the Key Protect tool integration in the toolchain. It is not the name of the Key Protect service instance. 
 my-slack-webhook The name of the standard key that is managed in the Key Protect service instance. 







 Using secrets references by CRN 

The following example assumes that an instance of Secrets Manager exists. It shows resources for an arbitrary secret (Slack webhook), a toolchain, an IAM service-to-service authorization policy, a Secrets Manager tool integration, and a Slack tool integration that references the webhook secret by CRN.