vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"auth": null
}

A request to add a private certificate authority configuration returns the following response:

{
"request_id": "0b221b39-1cd8-fa92-62e5-361c5e1b5d92",
"lease_id": "",
"renewable": false,
"lease_duration": 0,
"data": {
"config": {
"common_name": "example.com",
"country": [],
"crl_disable": false,
"crl_distribution_points_encoded": true,
"crl_expiry": 259200,
"data": {
"certificate": "-----BEGIN CERTIFICATE-----nMIIGZjCCBU6gAwIBAgIUFsqE2...(redacted",
"expiration": 1808862713,
"issuing_ca": "-----BEGIN CERTIFICATE-----nMIIGZjCCBU6gAwIBAgIUFsqE2...(redacted)",
"serial_number": "16:ca:84:d8:4f:e5:b0:6c:5c:06:db:51:52:58:c1:3e:0b:96:ce:4f"
},
"exclude_cn_from_sans": false,
"expiration_date": "2027-04-27T21:51:53Z",
"format": "pem",
"issuing_certificates_urls_encoded": true,
"key_bits": 2048,
"key_type": "rsa",
"locality": [],
"max_path_length": -1,
"max_ttl": 157788000,
"organization": [],
"other_sans": [],
"ou": [],
"expiration": 10000,
"conditions": [
{
"claim": "groups",
"operator": "CONTAINS",
"value": ""cloud-docs-ops""
}
]
}'





 Assigning access policies 

To assign new access policies, call the following:

curl -X PUT 'https://iam.cloud.ibm.com/v1/policies'
-H 'Authorization: Bearer $TOKEN'
-H 'Content-Type: application/json'
-H 'If-Match: $ETAG'
-d '{
"type": "access",
"description": "Viewer role for for all instances of SERVICE_NAME in the account.",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
}
]
}
]
}'

For more information, see the [IAM Policy Management](https://cloud.ibm.com/apidocs/iam-policy-managementupdate-policy) API.





 Updating session duration 

To update the session duration for federated users, call the following:

curl -X PUT 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID/rules/CLAIM_RULE_ID'
-H 'Authorization: Bearer TOKEN'
* [Associating the identity of the CA admin](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-ca-identity)
* [Registering identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-register)



* [Creating new CA admins](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-ca-admin)



* [Enrolling an identity](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-enroll)
* [Using your TLS CA](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-tlsca)
* [Certificate renewal and expiration](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-expiration)
* [Storing identities in your console wallet](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-wallet)



* [Adding identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-add)
* [Viewing and updating identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-update-identities)
* [Downloading certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiescert-mgmt-downloading-certs)
ibmcloud iam user-policy-create name@example.com --roles Viewer --service-name is --attributes "instanceId="







 ibmcloud iam user-policy-update 

Update an access policy for the specified user in the current account:

ibmcloud iam user-policy-update USER_NAME POLICY_ID {--file JSON_FILE | [--roles ROLE_NAME1,ROLE_NAME2...] [--service-name SERVICE_NAME] [--service-instance SERVICE_INSTANCE_GUID] [--region REGION] [--resource-type RESOURCE_TYPE] [--resource RESOURCE] [--resource-group-name RESOURCE_GROUP_NAME] [--resource-group-id RESOURCE_GROUP_ID] [--account-management] [--attributes name=value,name=value...]} [--output FORMAT] [-q, --quiet] [--api-version v1 | v2]



 Command options 

USER_NAME (required)
: User name to whom the policy belongs to.

POLICY_ID (required)
: ID of the policy to update. --file FILE (optional)
: JSON file of policy definition.

--roles ROLE_NAME1,ROLE_NAME2... (optional)
: Role names of the policy definition. For supported roles of a specific service, run ibmcloud iam roles --service SERVICE_NAME option. This option is exclusive with the --file option.

--service-name SERVICE_NAME (optional)
: Service name of the policy definition. This option is exclusive with the --file option.

--service-instance SERVICE_INSTANCE_GUID (optional)
: GUID of service instance of the policy definition. This option is exclusive with the --file option.

--region REGION (optional)
: Region of the policy definition. This option is exclusive with the --file option.

--resource-type RESOURCE_TYPE (optional)
: Resource type of the policy definition. This option is exclusive with the --file option.
curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("iam_id")
.value(EXAMPLE_USER_ID)
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();

PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:iam::::role:Viewer")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
Make a GET "http://169.254.169.254/metadata/v1/instance" call to retrieve detailed information about the instance. To tailor information for specific instance details, such as network interfaces, see [Extra instance metadata endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-imd-get-metadata&interface=apiimd-additional-inst-metadata).

curl -X GET "http://169.254.169.254/metadata/v1/instance?version=2021-10-12" -H "Accept:application/json" -H "Authorization: Bearer $access_token"

The response lists all details for an instance, including network interfaces, compute profile, and volume attachments.

{
"boot_volume_attachment": {
"id": "a8a15363-a6f7-4f01-af60-715e85b28141",
"name": "my-boot-volume-attachment",
"volume": {
"crn": "crn:[...]",
"id": "49c5d61b-41e7-4c01-9b7a-1a97366c6916",
"name": "my-boot-volume"
}
},
"created_at": "2021-10-19T16:11:57Z",
"crn": "crn:[...]",
"disks": [],
"id": "eb1b7391-2ca2-4ab5-84a8-b92157a633b0",
"image": {
"crn": "crn:[...]",
"id": "9aaf3bcb-dcd7-4de7-bb60-24e39ff9d366",
"name": "my-image"
},
"memory": 8,
ibmcloud iam user-policy-create name@example.com --roles Editor --service-name sample-service --service-instance d161aeea-fd02-40f8-a487-df1998bd69a9 --region us-south --resource-type key --resource key123

Give name@example.comOperator role for resource group with ID dda27e49d2a1efca58083a01dfde18f6:

ibmcloud iam user-policy-create name@example.com --roles Operator --resource-type resource-group --resource dda27e49d2a1efca58083a01dfde18f6

Give name@example.comViewer role for the members of resource group sample-resource-group:

ibmcloud iam user-policy-create name@example.com --roles Viewer --resource-group-name sample-resource-group

Give name@example.comViewer role for the members of resource group with ID dda27e49d2a1efca58083a01dfde18f6:

ibmcloud iam user-policy-create name@example.com --roles Viewer --resource-group-id dda27e49d2a1efca58083a01dfde18f6

Give name@example.comViewer role for service is resources with attribute instanceId equal to :

ibmcloud iam user-policy-create name@example.com --roles Viewer --service-name is --attributes "instanceId="







 ibmcloud iam user-policy-update 

Update an access policy for the specified user in the current account:

ibmcloud iam user-policy-update USER_NAME POLICY_ID {--file JSON_FILE | [--roles ROLE_NAME1,ROLE_NAME2...]
curl -X PATCH "$vpc_api_endpoint/v1/volumes/50fda9c3-eecd-4152-b473-a98018ccfb10?version=2022-04-25&generation=2" -H "Authorization: Bearer" -H "If-Match: <_Etag-hash-string_>" -d {
"user_tags": [
"env:test",
"env:prod"
]
}'

The response shows the tags that were added to the volume:

{
"id":"50fda9c3-eecd-4152-b473-a98018ccfb10",
"crn": "crn:[...]",
"name":"my-volume-update1",
"href":"https://us-south.iaas.cloud.ibm/v1/volumes/50fda9c3-eecd-4152-b473-a98018ccfb10",
"capacity":50,
"iops":100,
"encryption":"provider_managed",
"status":"pending",
"zone":{
"name":"us-south-1",
"href":"https://us-south.iaas.cloud.ibm/v1/regions/us-south/zones/us-south-1"
},
"profile":{
"name":"custom",
"href":"https://us-south.iaas.cloud.ibm/v1/volume/profiles/custom"
},
"resource_group":{
"id":"4bbce614c13444cd8fc5e7e878ef8e21",
"href":"https://resource-controller.cloud.ibm.com/v2/resource_groups/4bbce614c13444cd8fc5e7e878ef8e21",
Update user policy to give name@example.comViewer role for members of resource group sample-resource-group:

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Viewer --resource-group-name sample-resource-group

Update user policy to give name@example.comViewer role for members of resource group with ID dda27e49d2a1efca58083a01dfde18f6:

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Viewer --resource-group-id dda27e49d2a1efca58083a01dfde18f6

Update user policy to give name@example.comViewer role for service is resources with attribute instance equal to :

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Viewer --service-name is --attributes "instanceId="







 ibmcloud iam user-policy-delete 

Delete an access policy for the specified user:

ibmcloud iam user-policy-delete USER_ID POLICY_ID [-f, --force] [-q, --quiet] [--api-version v1 | v2]



 Command options 

-f, --force
: Delete user policy without confirmation.

-q, --quiet
: Suppress verbose output.

--api-version
: Version of the access policy API.





 Examples 

Delete policies user-policy-id of user name@example.com:

ibmcloud iam user-policy-delete name@example.com user-policy-id

Delete policies user-policy-id of user name@example.com without confirmation:

ibmcloud iam user-policy-delete name@example.com user-policy-id -f







 ibmcloud iam service-policies 

List all access policies for a specified service ID:

ibmcloud iam service-policies SERVICE_ID [-f, --force] [-q, --quiet] [--api-version v1 | v2]



 Command options
ibmcloud iam user-policy-update name@example.com 0bb730daa --file @policy.json

Update user policy to give name@example.comAdministrator role for all instances of sample-service service：

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Administrator --service-name sample-service

Update user policy to give name@example.comEditor role and a custom role Responder for all instances of sample-service service：

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Editor,Responder --service-name sample-service

Update user policy to give name@example.comEditor role for resource key123 of sample service instance with GUID d161aeea-fd02-40f8-a487-df1998bd69a9 in us-south region:

ibmcloud iam user-policy-update name@example.com --roles Editor --service-name sample-service --service-instance d161aeea-fd02-40f8-a487-df1998bd69a9 --region us-south --resource-type key --resource key123

Update user policy to give name@example.comOperator role for resource group with ID dda27e49d2a1efca58083a01dfde18f6:

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Operator --resource-type resource-group --resource dda27e49d2a1efca58083a01dfde18f6

Update user policy to give name@example.comViewer role for members of resource group sample-resource-group:

ibmcloud iam user-policy-update name@example.com user-policy-id --roles Viewer --resource-group-name sample-resource-group

Update user policy to give name@example.comViewer role for members of resource group with ID dda27e49d2a1efca58083a01dfde18f6:
curl -X POST https://user-management.cloud.ibm.com/v2/accounts/987d4cfd77b04e9b9e1a6asdcc861234/users -H 'Authorization: Bearer <IAM_TOKEN>'
-H 'Content-Type: application/json' -d '{
"users": [
{
"email": "cloud_api_example_member@ibm.com",
"account_role": "Member"
}],
"iam_policy": [{
"type": "access",
"roles": {
"role_id": "crn:v1:bluemix:public:iam::::role:Viewer"
}],
"resources": {
"attributes": {
"name": "accountId",
"value": "987d4cfd77b04e9b9e1a6asdcc861234"
},
{
"name": "resourceType",
"value": "resource-group"
},
{
"name": "resource",
"value": "2c7449dd871049c29ec3a53853ce123e"
}
]
}]
}],
"access_groups":[
"AccessGroupId--0f54-4d4f-89c2-e5fdc0b9a28c",
"AccessGroupId--3087-4395-a382-a8e8ff9ccc23"
]
}'

InviteUser inviteUserModel = new InviteUser.Builder()
.email(memberEmail)
.accountRole("Member")
.build();

Role roleModel = new Role.Builder()
.roleId(viewerRoleId)
.build();

Attribute attributeModel = new Attribute.Builder()
curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME's RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "access_group_id",
"value": "exampleAccessGroupId"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
.name("access_group_id")
.value(exampleAccessGroupId)
.build();

PolicySubject policySubjects = new PolicySubject.Builder()
.addAttributes(subjectAttribute)
.build();

PolicyRole policyRoles = new PolicyRole.Builder()
.roleId("crn:v1:bluemix:public:iam::::role:Editor")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
"value": "SERVICE_NAME",
"operator": "stringEquals"
}
]
},
{
"tags":
{
"name": "project",
"value": "moonshot",
"operator": "stringEquals"
},
{
"name": "pipeline",
"value": "test",
"operator": "stringEquals"
}
]
}
],
"href": "https://iam.cloud.ibm.com/v1/policies/12345678-abcd-1a2b-a1b2-1234567890ab",
"created_at": "2018-08-30T14:09:09.907Z",
"created_by_id": "USER_ID",
"last_modified_at": "2018-08-30T14:09:09.907Z",
"last_modified_by_id": "USER_ID",
"state": "active"
}







 Add users to your access groups by using the API 

To add users to an access group by using the API, call the [IAM Access Groups API](https://cloud.ibm.com/apidocs/iam-access-groupsadd-members-to-access-group) as shown in the following example.



* Curl
* Java
* Python
* Go
* Node



curl -X PUT -H "Authorization: {iam_token}" -H "Accept: application/json" -H "Content-Type: application/json" -d '{"members": [ {"iam_id": "IBMid-user1", "type": "user"}, {"iam_id": "iam-ServiceId-123", "type": "service"} ]}' "{base_url}/groups/{access_group_id}/members"
(https://cloud.ibm.com/apidocs/iam-policy-management).

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
"type": "access",
"description": "Editor role for SERVICE_NAME's RESOURCE_NAME",
"subjects": [
{
"attributes":
{
"name": "iam_id",
"value": "IBMid-123453user"
}
]
}'
],
"roles":[
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'
IamAuthenticator authenticator = new IamAuthenticator("{apikey}");
Discovery discovery = new Discovery("2019-04-30", authenticator);
discovery.setServiceUrl("{url}");

String environmentId = "{environment_id}";
String collectionId = "{collection_id}";
InputStream documentStream = new FileInputStream("./test-doc1.html");

AddDocumentOptions.Builder builder = new AddDocumentOptions.Builder(environmentId, collectionId);
builder.file(documentStream);
builder.fileContentType(HttpMediaType.TEXT_HTML);
builder.filename("test-doc1.html");
DocumentAccepted response = discovery.addDocument(builder.build()).execute().getResult();
* Node:

const fs = require('fs');
const DiscoveryV1 = require('ibm-watson/discovery/v1');
const { IamAuthenticator } = require('ibm-watson/auth');

const discovery = new DiscoveryV1({
version: '2019-04-30',
authenticator: new IamAuthenticator({
apikey: '{apikey}',
}),
url: '{url}',
});

const addDocumentParams = {
environmentId: '{environment_id}',
collectionId: '{collection_id}',
file: fs.createReadStream('./test-doc1.html'),
};

discovery.addDocument(addDocumentParams)
.then(response => {
const documentAccepted = response.result;
console.log(JSON.stringify(documentAccepted, null, 2));
})
.catch(err => {
"private_ips": [
{
"address": "192.168.10.5"
},
{
"address": "192.168.10.6"
}
],
"provisioning_status": "active",
"public_ips": [
{
"address": "169.11.111.115"
},
{
"address": "169.11.111.116"
}
],
"resource_group": {
"id": "0738-56969d60-43e9-465c-883c-b9f7363e78e8"
},
"subnets": [
{
"id": "0738-7ec86020-1c6e-4889-b3f0-a15f2e50f87e",
"href": "https://us-south.iaas.cloud.ibm.com/v1/subnets/7ec86020-1c6e-4889-b3f0-a15f2e50f87e",
"name": "example-subnet"
}
]
}
{
"role_id": "crn:v1:bluemix:public:iam::::role:Editor"
}
],
"resources":[
{
"attributes":
{
"name": "accountId",
"value": "$ACCOUNT_ID"
},
{
"name": "serviceName",
"value": "$SERVICE_NAME"
},
{
"name": "resource",
"value": "$RESOURCE_NAME",
"operator": "stringEquals"
}
]
}
]
}'
* [Viewing and updating identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-update-identities)
* [Downloading certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiescert-mgmt-downloading-certs)



* [Storing identities in a Hardware Security Module (HSM)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-hsm)
* [Associating identities](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-associate-admin)
* [Viewing the contents of a signing certificate](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-identitiesibp-console-identities-sign-cert)



[Managing organizations](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsibp-console-organizations)



* [Understanding MSPs](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-about-msp)
* [Managing MSPs in the console](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsibp-console-organizations-manage)
* [Creating an MSP for your organization](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-create-msp)
* [Downloading a connection profile](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsibp-console-organizations-connx-profile)
ibmcloud iam trusted-profile-policy-delete







 Updating trusted profiles by using the API 

For more information, see the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-api).



 Updating the name or description 

To update the name or description of an existing trusted profile, call the following. Enter your updated name and description attributes.

curl -X PUT 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID' -H 'Authorization: Bearer TOKEN' -H 'If-Match: <value of etag header from GET request>' -H 'Content-Type: application/json' -H 'Accept: application/json' -d '{
"name": "My Profile updated",
"description": "My updated desc"
}'





 Updating the conditions of the trust relationship 

After the trusted profile is created, you can build trust with both federated users and compute resources in the same trusted profile.

curl -X PUT 'https://iam.cloud.ibm.com/v1/profiles/PROFILE_ID/rules/CLAIM_RULE_ID'
-H 'Authorization: Bearer TOKEN'
-H 'If-Match: <value of etag header from GET request>'
-H 'Content-Type: application/json'
-H 'Accept: application/json'
-d '{
"type": "Profile-SAML",
"realm_name": "https://w3id.sso.ibm.com/auth/sps/samlidp2/saml20",
"expiration": 10000,
"conditions": [
{
"claim": "groups",
"operator": "CONTAINS",
"value": ""cloud-docs-ops""
}
]
}'





 Assigning access policies 

To assign new access policies, call the following:

curl -X PUT 'https://iam.cloud.ibm.com/v1/policies'
iam_serviceid_crn: crn:v1:bluemix:public:iam-identity::a/e43abfcbd191404cb17ef650e9681dd3::serviceid:ServiceId-3e99caa5-b174-4f04-9845-5c5d783b8bc7
instance_id: c0736069-3f4a-438a-b614-6846877d692d
kafka_admin_url: https://abcdabcdabcdabcd.svc07.us-south.eventstreams.cloud.ibm.com
kafka_brokers_sasl: [broker-1-abcdabcdabcdabcd.kafka.svc07.us-south.eventstreams.cloud.ibm.com:9093 broker-2-abcdabcdabcdabcd.kafka.svc07.us-south.eventstreams.cloud.ibm.com:9093 broker-5-abcdabcdabcdabcd.kafka.svc07.us-south.eventstreams.cloud.ibm.com:9093 broker-3-abcdabcdabcdabcd.kafka.svc07.us-south.eventstreams.cloud.ibm.com:9093 broker-4-abcdabcdabcdabcd.kafka.svc07.us-south.eventstreams.cloud.ibm.com:9093 broker-0-abcdabcdabcdabcd.kafka.svc07.us-south.eventstreams.cloud.ibm.com:9093]
kafka_http_url: https://abcdabcdabcdabcd.svc07.us-south.eventstreams.cloud.ibm.com
password: abcdeH9tu3qE5Sn8VbJfcDEWtjR_l0iPisB3abcdefgh
user: token
.roleId("crn:v1:bluemix:public:iam::::role:Viewer")
.build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
.name("accountId")
.value("ACCOUNT_ID")
.operator("stringEquals")
.build();

ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
.name("serviceName")
.value("is")
.operator("stringEquals")
.build();

PolicyResource policyResources = new PolicyResource.Builder()
.addAttributes(accountIdResourceAttribute)
.addAttributes(serviceNameResourceAttribute)
.build();

CreatePolicyOptions options = new CreatePolicyOptions.Builder()
.type("access")
.subjects(Arrays.asList(policySubjects))
.roles(Arrays.asList(policyRoles))
.resources(Arrays.asList(policyResources))
.build();

Response<Policy> response = service.createPolicy(options).execute();
Policy policy = response.getResult();

System.out.println(policy);

policy_subjects = PolicySubject(
attributes=[SubjectAttribute(name='iam_id', value='IBMid-123453user')])
policy_roles = PolicyRole(
role_id='crn:v1:bluemix:public:iam::::role:Viewer')
account_id_resource_attribute = ResourceAttribute(
name='accountId', value='ACCOUNT_ID')
service_name_resource_attribute = ResourceAttribute(