vania-janet/multiturn-rag-retrieval-data huggingface dataset:
--output FORMAT
: Specify output format. Only 'JSON' is supported.

-f, --force
: Force failure if multiple profiles are found.

-q, --quiet
: Suppress verbose output.





 Examples 

Create link named my_link for trusted profile my-profile for an IKS_SA compute resource with service account name default, default namespace, and my_compute_resource_crn CRN:

ibmcloud iam trusted-profile-link-create my_profile --name my_link --cr-type IKS_SA --link-name default --link-namespace default --link-crn my_compute_resource_crn

Create link named my_link for trusted profile ID Profile-bdf62c30-35dd-4852-bcb8-2f0dd3929701 for an IKS_SA compute resource with service account name default in the namespace my_namespace and with a CRN of my_resource_crn:

ibmcloud iam trusted-profile-link-create Profile-bdf62c30-35dd-4852-bcb8-2f0dd3929701 --name my_link --cr-type IKS_SA --link-name default --link-namespace my_namespace --link-crn my_resource_crn

Create link named my_link for trusted profile ID Profile-bdf62c30-35dd-4852-bcb8-2f0dd3929701 for a VSI compute resource with a CRN of my_resource_crn:

ibmcloud iam trusted-profile-link-create Profile-bdf62c30-35dd-4852-bcb8-2f0dd3929701 --name my_link --cr-type VSI --link-crn my_resource_crn







 ibmcloud iam trusted-profile-links 

List all links to compute resources for a specified trusted profile

ibmcloud iam trusted-profile-links (NAME|ID) [--id | --output FORMAT] [-f, --force] [-q, --quiet]
* --output: specifies output format, only JSON is supported. One of: JSON.
* -q, --quiet: suppresses verbose output.



For example:



* ibmcloud is vpn-gateway-route-create r134-77e21079-7291-44c2-866a-8f1848bc10f0 --name myroute --action deliver --destination 10.0.0.0/24
* ibmcloud is vpn-gateway-route-create r134-77e21079-7291-44c2-866a-8f1848bc10f0 --name myroute --action drop --destination 10.0.0.0/24







 Updating a route from the CLI 

Before you begin, make sure to [set up your CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).

To update a VPN gateway route by using the CLI, enter the following command:

ibmcloud is vpn-gateway-route-update VPN_GATEWAY_ID ROUTE_ID [--name NAME] [--output JSON] [-q, --quiet]

Where:



* VPN_GATEWAY_ID: is the ID of the VPN gateway.
* ROUTE_ID: is the ID of the VPN route.
* --name: is the new name of the VPN route.
* --output: specifies output format, only JSON is supported. One of: JSON.
* -q, --quiet: suppresses verbose output.



For example:

ibmcloud is vpn-gateway-route-update r134-77e21079-7291-44c2-866a-8f1848bc10f0 1233a60b-fc95-4dbc-96ab-a976b723bfb0 --name myroute





 Viewing VPN route details from the CLI
"href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024/reserved_ips/0767-a7db5d37-42cf-473e-ab27-07b679d64ceb",
"id": "0767-a7db5d37-42cf-473e-ab27-07b679d64ceb",
"name": "dioxide-stylized-headway-despise",
"resource_type": "subnet_reserved_ip"
}
],
"provisioning_status": "update_pending",
"public_ips": [],
"subnets": [
{
"id": "0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024",
"href": "https://us-east.iaas.cloud.ibm.com/v1/subnets/0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024",
"crn": "crn:v1:bluemix:public:is:us-east-2:a/be636a7a6e4d4b6296bedf669ce8f757::subnet:0767-064498f3-4df5-4fa5-b2ed-de5a3bfea024",
"name": "lb-subnet"
}
],
"resource_group": {
"id": "42c4f51adc3147b4b4049ad9826c30a1",
{"status":"active","brokers":["kafka-0.mh-svc1-0000.eu-de.containers.appdomain.cloud:9093","kafka-1.mh-sv2.eu-de.containers.appdomain.cloud:9093","kafka-2.mh-sv3.eu-de.containers.appdomain.cloud:9093"],"topic":"at-london-topic","user":"token"}

If streaming is not configured, the following will be returned when trying to do an update:

{"error":"Streaming configuration does not exist","code":"NotFound","status":"error"}





 Check the status of a streaming configuration 

To check if streaming is enabled or disabled, you can use either the GET or PUT methods.

When streaming is not enabled, the following is returned when running the [GET method](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-streaming-manage-apistreaming-api-get-conf):

{"error":"Not found","code":"NotFound","status":"error"}

When streaming is not enabled, the following is returned when running the [PUT method](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-streaming-manage-apistreaming-api-update-conf):

{"error":"Streaming configuration does not exist","code":"NotFound","status":"error"}





 List streaming exclusion rules 

Use [this method](https://cloud.ibm.com/apidocs/activity-trackerget-v1-config-stream-exclusions) to list existing streaming exclusion rules.

curl --request GET https://api.eu-gb.logging.cloud.ibm.com/v1/config/stream/exclusions
-H "content-type: application/json"
-H "servicekey: <SERVICE_KEY>"
disable the policy for this key

ibmcloud kp key policy-update rotation 4d5540bd-3235-4a46-a8af-974f7ed6558a -d --output json

{
"createdBy": "user id ...<redacted>...",
"creationDate": "2022-12-02T00:50:11Z",
"crn": "crn:v1:bluemix:public:kms:us-south:a/e3e8fd14a61a49cda102faad15b06c09:5ecfe306-d4af-48c0-ab07-b5c5bc751534:policy:0ec7ad62-982d-45bb-895f-986d95015f5b",
"lastUpdateDate": "2022-12-02T00:52:52Z",
"updatedBy": "user id ...<redacted>...",
"rotation": {
"enabled": false,
"interval_month": 3
}
}
---------------------------------------------------------------------------------------------------------------------------------------------------
Show more

 show that the policy has been disabled

ibmcloud kp key policies 4d5540bd-3235-4a46-a8af-974f7ed6558a -r --output json

{
FAILED py/test_transit.py::test_vpe_dns_resolution[redis spoke0-z1 -> transit 3bcc88e4-2a0a-4cc5-898c-4f7674205605.c9v38t1d0icro20vjc5g.private.databases.appdomain.cloud] - AssertionError: 166.9.48.220 not in ['10.1.0.128/26', '10.2.0.128/26', '10.3.0.128/26'] from 3bcc88e4-2a0a-4cc5-898c-4f7674205605.c9v38t1d0icro20vjc5g.private.databases.appdomain.cloud

These are failing due to DNS resolution. In the example above the Redis name, <id>.private.databases.appdomain.cloud, should resolve to a VPE that is in the CIDR block 10.1.0.128/26 or 10.2.0.128/26. The error message asserts the Redis name is resolving to the address 166.9.38.220 which is a Cloud [Service Endpoint](https://cloud.ibm.com/docs/vpc?topic=vpc-service-endpoints-for-vpccloud-service-endpoints). The DNS names can not be resolved by the private DNS resolvers. Adding additional DNS forwarding rules will resolve this issue.

To make the DNS names for the VPE available outside the DNS owning service it is required to update the DNS forwarding rules.



* For enterprise appdomain.com will forward to the transit.
* For transit the fully qualified DNS name of the Databases for Redis instance will be forwarded to the spoke instance that owns the Databases for Redis instance.
* For spoke_from -> spoke_to access to Redis the spoke_from needs the DNS name for the Databases for Redis instance. The fully qualified Redis name in spoke_from DNS instance will be forwarded to the transit.
* Create an instance using a private catalog image from the latest version of a catalog product offering.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
"name": "my-instance",
"zone": {
"name": "us-south-3"
},
"vpc": {
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"catalog_offering": {
"offering": {
"crn": "'$offering_crn'"
}
}'
* Create an instance using a private catalog image from a specific version of a catalog product offering.

curl -X POST "$vpc_api_endpoint/v1/instances?version=$api_version&generation=2" -H "Authorization:$iam_token" -d '{
"name": "my-instance",
"zone": {
"name": "us-south-3"
},
"vpc": {
"id": "'$vpc'"
},
"primary_network_interface": {
"subnet": {
"id": "'$subnet'"
}
},
"keys":[{"id": "'$key'"}],
"profile": {
"name": "'$profile_name'"
},
"catalog_offering": {
"version": {
"crn": "'$version_crn'"
}
}'
_20connect_20through_20a_20curl_20command_20or_20browser_20using_20the_20hostname_20with_20HTTPS_3F_20_7C_20IBM_20Cloud_20Docs_p_https_3A_2F_2Fcloud.ibm.com_2Fdocs_2FCDN_3Ftopic_3DCDN-troubleshoot-cdn-cannot-connect-https_r_lt_635_evt_pageLoad_sv_1_rn_685187](https://bat.bing.com/action/0?ti=146001191&Ver=2&mid=edb404e7-7014-4a07-93e6-96c7494003bf&sid=cca51480229211eeac887b94c5a6c542&vid=cca50460229211ee874f7dc32b9b9a8d&vids=0&msclkid=N&pi=918639831&lg=en-US&sw=3840&sh=2160&sc=30&nwd=1&tl=Why%20can't%20I%20connect%20through%20a%20curl%20command%20or%20browser%20using%20the%20hostname%20with%20HTTPS%3F%20%7C%20IBM%20Cloud%20Docs&p=https%3A%2F%2Fcloud.ibm.com%2Fdocs%2FCDN%3Ftopic%3DCDN-troubleshoot-cdn-cannot-connect-https&r=&lt=635&evt=pageLoad&sv=1&rn=685187)
The following suggested practices might help you decide when to check for, and resolve, conflicts:



Table 1. Suggested practices

 Application characteristic Frequency of document update Check for conflicts at retrieval? Check for conflicts at update? 

 Always connected to the network, for example, a server. Often Y <br><br> * <br><br><br> 
 Always connected to the network. Occasionally <br><br> * <br><br><br> Y 
 Often but not always connected to the network, for example, a laptop. Often <br><br> * <br><br><br> Y 
 Often but not always connected to the network. Occasionally <br><br> * <br><br><br> Y 
 Occasionally connected to the network, for example, a tablet. Often <br><br> * <br><br><br> Y 





 Finding conflicts 

To find any conflicts that might be affecting a document, add the query parameter conflicts=true when you retrieve a document. When returned, the resulting document includes a _conflicts array, which includes a list of all the conflicting revisions.

See the following example map function to find document conflicts:

function (doc) {
if (doc._conflicts) {
emit(null, [doc._rev].concat(doc._conflicts));
}
}

To find conflicts for multiple documents in a database, write a [view](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-creating-views-mapreduce). Using a map function such as the example provided, you can find all the revisions for every document with a conflict.

When you have such a view, you can use it to find and resolve conflicts as needed. Alternatively, you might query the view after each replication to identify and resolve conflicts immediately.





 How to resolve conflicts 

After you find a conflict, you can resolve it by following the four steps that are described next.



* Get
* Merge
* Upload
* Delete



See the following example document of the first version:

{
If you're unable to collect logs with a webhook, it might be because you are using a webhook that connects to a server that is using a self-signed certificate. If so, complete the following steps to import the certificate into the keystore so that you can collect Watson Assistant logs with a webhook:



1. Log in to cluster and oc project cpd-instance, which is the namespace where the Watson Assistant instance is located.
2. Run the following command. In the following command, replace INSTANCE_NAME with the name of your Watson Assistant instance and replace CUSTOM_CERTIFICATE with your Base64 encoded custom certificate key:

INSTANCE="INSTANCE_NAME" Replace INSTANCE_NAME with the name of the Watson Assistant instance
CERT="CUSTOM_CERTIFICATE" Replace CUSTOM_CERTIFICATE with the custom certificate key

cat <<EOF | oc apply -f -
apiVersion: v1
data:
ca_cert: ${CERT}
kind: Secret
metadata:
name: ${INSTANCE}-custom-webhooks-cert
type: Opaque
---
apiVersion: assistant.watson.ibm.com/v1
kind: TemporaryPatch
metadata:
name: ${INSTANCE}-add-custom-webhooks-cert
spec:
apiVersion: assistant.watson.ibm.com/v1
kind: WatsonAssistantStore
name: ${INSTANCE}
patchType: patchStrategicMerge
patch:
webhooks-connector:
deployment:
spec:
template:
spec:
containers:
- name: webhooks-connector
env:
- name: CERTIFICATES_IMPORT_LIST
value: /etc/secrets/kafka/ca.pem:kafka_ca,/etc/secrets/custom/ca.pem:custom_ca
volumeMounts:
- mountPath: /etc/secrets/custom
name: custom-cert
readOnly: true
volumes:
- name: custom-cert
secret:
defaultMode: 420
* [Go to product UI](https://cloud.ibm.com/satellite) [About this product](https://www.ibm.com/cloud/satellite)



Expand all | Collapse all

Collapse



1. [IBM Cloud Docs](https://cloud.ibm.com/docs)
2. [Satellite](https://cloud.ibm.com/docs/satellite)
3.



Search in collection

Search in collection





LangSwitcher dropdown

English

Close menu

DeutschEnglish

EspañolFrançaisItaliano日本語한국어Português/Brasil简体中文繁體中文





 Why can't my HTTP proxy connect to the Red Hat servers? * Last updated 2022-04-18 

 What’s happening 

If the REDHAT_PACKAGE_MIRROR_LOCATION value is misconfigured, then you receive an error similar to the following message.

[root@user-c55ppnc10v3kufi8lth0-good-proxy-oc-4 ] yum install curl
Loaded plugins: product-id, search-disabled-repos, subscription-manager

https://rhncapdal1001.service.networklayer.com/pulp/repos/customer/Library/content/dist/rhel/server/7/7Server/x86_64/devtools/1/os/repodata/repomd.xml: [Errno 14] curl60 - "Peer's Certificate issuer is not recognized."
Trying other mirror.
It was impossible to connect to the Red Hat servers.

 Why it’s happening 

This message indicates that the system is unable to find the package mirrors.

 How to fix it 

Double-check your configuration. For more information, see [Configuring an HTTP proxy for your Satellite hosts](https://cloud.ibm.com/docs/satellite?topic=satellite-config-http-proxy).

Contribute in GitHub

Open doc issue

Edit topic







Feedback

Focus sentinel

 Give us your feedback
But all transit -> spoke, all transit -> enterprise and enterprise <--> spoke cross zone fail due to asymmetric routing issues.

pytest -m "curl and lz1 and (rz1 or rz2)"

[Part two](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-transit2) of this tutorial will route all VPC <-> different VPC traffic through the router and resolve these issues. But first it is important to learn what is happening.







 Ingress Routing 

Traffic reaches the firewall-router appliance through routing tables.



1. Visit the [VPCs](https://cloud.ibm.com/vpc-ext/network/vpcs) in the IBM Cloud console.
2. Select the transit VPC.
3. Click on Manage routing tables.
4. Click on the tgw-ingress routing table.



The zone is determined by the Transit Gateway which will examine the destination IP address of each packet and route it to the matching zone based on VPC Address Prefixes discussed in the next section.

Notice how wide the routes are in the transit's ingress routing table (shown for Dallas/us-south):



 Zone Destination Next hop 

 Dallas 1 0.0.0.0/0 10.1.0.196 
 Dallas 2 0.0.0.0/0 10.2.0.196 
 Dallas 3 0.0.0.0/0 10.3.0.196 



The next_hop identifies the firewall-router. In the table above 10.1.0.196 zone Dallas 1 and 10.2.0.196 zone Dallas 2, etc. You can observe this using the IBM Cloud console.



1. Open [Virtual server instances for VPC](https://cloud.ibm.com/vpc-ext/compute/vs) to find the fw instances and associated Reserved IP (click the Name column header to sort).
2. Match them up with the table above to verify the next hop relationship.







 VPC Address Prefixes
kubectl get validatingwebhookconfiguration NAME -o yaml > webhook-config.yaml

kubectl get mutatingwebhookconfiguration NAME -o yaml > webhook-config.yaml
5. Delete the webhook configuration.

kubectl delete validatingwebhookconfiguration NAME

kubectl delete mutatingwebhookconfiguration NAME
6. Wait a few minutes, then retry the kubectl commands that were failing to see if the problem is resolved.
7. Recreate the webhook.

kubectl apply -f webhook-config.yaml
8. If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/get-support?topic=get-support-using-avatar). In the case details, be sure to include any relevant log files, error messages, or command outputs.
pytest -m "curl and lz1 and (rz1 or rz2)"







 Step 8: Add Spoke Egress routes to fix Asymmetric Routing 

This step will identify and fix a cross zone asymmetric routing issue. The diagram below shows the successful routes in green. Notice the arrow in both directions. One of the unsuccessful routes has an initial route in blue and an unsuccessful return route in red:

Zoom

![Asymmetric traffic needs to be fixed](https://cloud.ibm.com/docs-content/v1/content/f84e2238288b7f0355715a4c355609ce7ac48fb0/solution-tutorials/images/vpc-transit/vpc-transit-asymmetric.svg)

Asymmetric traffic needs to be fixed



 Asymmetric Routing Limitation 

The remaining failures are cross zone failures enterprise <-> spoke(s).

Example failure:

FAILED py/test_transit.py::test_curl[l-enterprise-z1 -> r-spoke0-z2] - assert False

The blue line represents a TCP connection request from enterprise through the Transit Gateway: 192.168.0.4 <--TCP--> 10.2.1.4. The Transit Gateway will choose a transit VPC zone based on the matching address prefix. The matching address prefix for 10.2.1.4 is 10.2.1.0/24 in the lower zone.

The red line represents the TCP connection response to 192.168.0.4. The Transit Gateway delivers to the transit VPC using the matching address prefix 192.168.0.0/24 in the upper zone. The IBM Cloud VPC uses the industry standard state based routing for secure TCP connection tracking. This requires that the TCP connection pass through the same firewall-router in both directions. The VPC does not support tcp "Asymmetric Routing".

It is interesting to note that an attempt to ping using the ICMP protocol would not suffer from this limitation. ICMP does not require a stateful connection.
emitErrorNT (node:internal/streams/destroy:151:8)n at emitErrorCloseNT (node:internal/streams/destroy:116:3)n at process.processTicksAndRejections (node:internal/process/task_queues:82:21)n at Timeout.timeoutHandler [as _onTimeout] (/connector_agent/node_modules/got/dist/source/core/utils/timed-out.js:36:25)n at listOnTimeout (node:internal/timers:571:11)n at process.processTimers (node:internal/timers:512:7)","name":"TimeoutError","code":"ETIMEDOUT","timings":{"start":1685976939285,"socket":1685976939291,"lookup":1685976939595,"error":1685977059291,"phases":{"wait":6,"dns":304,"total":120006}},"event":"request"},"msg":"Timeout awaiting 'request' for 120000ms"}
{"level":50,"time":1685977059302,"pid":13,"hostname":"2f07087dc304","name":"utilities","msg":"makeLinkAPICall GET /v1/connectors/U2F0ZWxsaXRlQ29ubmVjdG9yOiJjaHV1NTJpMjFuNzlxZm5sNmFwZyI failed to get token to run"}
{"level":60,"time":1685977059303,"pid":13,"hostname":"2f07087dc304","name":"agent_tunnel","msgid":"LAT06","msg":"Failed to get configuration from API, will exit in 200s"}

 Why it’s happening
"href": "https://iam.cloud.ibm.com/v1/policies/12345678-abcd-1a2b-a1b2-1234567890ab",
"created_at": "2018-08-30T14:09:09.907Z",
"created_by_id": "USER_ID",
"last_modified_at": "2018-08-30T14:09:09.907Z",
"last_modified_by_id": "USER_ID",
"state": "active"
}

{
"id": "12345678-abcd-1a2b-a1b2-1234567890ab",
"type": "access",
"description": "Viewer role access for all instances of SERVICE_NAME in the account.",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}
],
"roles": [
{
"roles_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT_ID",
"operator": "stringEquals"
},
{
"name": "serviceName",
"value": "SERVICE_NAME",
"operator": "stringEquals"
}
]
},
{
"tags":
{
"name": "project",
"value": "moonshot",
"operator": "stringEquals"
},
{
"name": "pipeline",
"value": "test",
"roles_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT_ID",
"operator": "stringEquals"
},
{
"name": "serviceName",
"value": "SERVICE_NAME",
"operator": "stringEquals"
}
]
},
{
"tags":
{
"name": "project",
"value": "moonshot",
"operator": "stringEquals"
},
{
"name": "pipeline",
"value": "test",
"operator": "stringEquals"
}
]
}
],
"href": "https://iam.cloud.ibm.com/v1/policies/12345678-abcd-1a2b-a1b2-1234567890ab",
"created_at": "2018-08-30T14:09:09.907Z",
"created_by_id": "USER_ID",
"last_modified_at": "2018-08-30T14:09:09.907Z",
"last_modified_by_id": "USER_ID",
"state": "active"
}

{
"id": "12345678-abcd-1a2b-a1b2-1234567890ab",
"type": "access",
"description": "Viewer role access for all instances of SERVICE_NAME in the account.",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
Retrieve instance information 

Make a GET "http://169.254.169.254/metadata/v1/instance" call to retrieve detailed information about the instance. To tailor information for specific instance details, such as network interfaces, see [Extra instance metadata endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-get-metadataimd-additional-inst-metadata).

curl -X GET "http://169.254.169.254/metadata/v1/instance?version=2021-10-12" -H "Accept:application/json" -H "Authorization: Bearer $access_token"

The response lists all details for an instance, including network interfaces, compute profile, and volume attachments.

{
"boot_volume_attachment": {
"id": "a8a15363-a6f7-4f01-af60-715e85b28141",
"name": "my-boot-volume-attachment",
"volume": {
"crn": "crn:[...]",
"id": "49c5d61b-41e7-4c01-9b7a-1a97366c6916",
"name": "my-boot-volume"
}
},
"created_at": "2021-10-19T16:11:57Z",
"crn": "crn:[...]",
"disks": [],
"id": "eb1b7391-2ca2-4ab5-84a8-b92157a633b0",
"image": {
"crn": "crn:[...]",
"id": "9aaf3bcb-dcd7-4de7-bb60-24e39ff9d366",
"name": "my-image"
},
"memory": 8,
"id": "12345678-abcd-1a2b-a1b2-1234567890ab",
"type": "access",
"description": "Viewer role access for all instances of SERVICE_NAME in the account.",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}
],
"roles": [
{
"roles_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}
],
"resources": [
{
"attributes":
{
"name": "accountId",
"value": "ACCOUNT_ID",
"operator": "stringEquals"
},
{
"name": "serviceName",
"value": "SERVICE_NAME",
"operator": "stringEquals"
}
]
},
{
"tags":
{
"name": "project",
"value": "moonshot",
"operator": "stringEquals"
},
{
"name": "pipeline",
"value": "test",
"operator": "stringEquals"
}
]
}
],
"href": "https://iam.cloud.ibm.com/v1/policies/12345678-abcd-1a2b-a1b2-1234567890ab",
"created_at": "2018-08-30T14:09:09.907Z",
"created_by_id": "USER_ID",
"last_modified_at": "2018-08-30T14:09:09.907Z",
: You can establish a direct link with specific, existing resources.

curl -X POST 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID/links' -H 'Authorization: Bearer TOKEN' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{
"name": "my link",
"cr_type": "VSI",
"link": {
"crn": "crn:v1:bluemix:public:iam-identity::a/18e3020749ce4744b0b472466d61fdb4::computeresource:Fake-Compute-Resource",
"namespace": "default",
"name": "my compute resource name"
}
}'
3. Create an access policy. For more information, see [IAM Policy Management API?](https://cloud.ibm.com/apidocs/iam-policy-management).

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME's RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",