vania-janet/multiturn-rag-retrieval-data huggingface dataset:
|-- se-signature.bin
|-- se-commit-id
|-- se-version
-- user-data.decrypted

Checksums are the SHA256 of the message digest and can be calculated by using the following Linux command-line utility:

sha256sum <file>

The following snippet is an example of an attestation document:

1.0.0
Machine Type/Plant/Serial: 3932/02/860A8
71ea00241774e638085af4dc95f9b157ffd6c7bc0e604583cc1e6722ade6f181 baseimage
2d290fcafca295cd2de49e7246a5a5a080f503cb066d451b008a863b84a82ee1 root.tar.gz
2d43b2ffeb1c543d3b3a5b0b96d5417f79d8245f1e085f5e3f150390d093fc6b /dev/disk/by-label/cidata
6dc2640b909f4077b17059f3edc1d0f3c1d286f4afc9f3d28f9ee9e72509ca51 cidata/meta-data
272aa3529571b4fc592bf89e9242d3f57ae8ff29fb514c4ee6d7ce1eeb2ac1ee cidata/user-data
baef972e58d4362d97f822d8ff4c5339c5898a0dc184d88d29e5b010b9835ed6 cidata/vendor-data
d388326d90583b2140831e821311aedaee1ad4b4e721b458f8769d3f9267b0dc attestationPublicKey
--secret-type (string)
: The secret type. Required.

Allowable values are: public_cert, private_cert.

--config-element (string)
: The configuration element to define or manage. Required.

Allowable values are: certificate_authorities, dns_providers, root_certificate_authorities, intermediate_certificate_authorities, certificate_templates.





 Examples 

ibmcloud secrets-manager config-elements --secret-type=public_cert --config-element=certificate_authorities







 ibmcloud secrets-manager config-element 

Get the details of a specific configuration that is associated with a secret type.

ibmcloud secrets-manager config-element --secret-type SECRET-TYPE --config-element CONFIG-ELEMENT --config-name CONFIG-NAME



 Command options 

--secret-type (string)
: The secret type. Required.

Allowable values are: public_cert, private_cert.

--config-element (string)
: The configuration element to define or manage. Required.

Allowable values are: certificate_authorities, dns_providers, root_certificate_authorities, intermediate_certificate_authorities, certificate_templates.

--config-name (string)
: The name of your configuration. Required.





 Examples 

ibmcloud secrets-manager config-element --secret-type=public_cert --config-element=certificate_authorities --config-name=exampleString







 ibmcloud secrets-manager config-element-update 

Update a configuration element that is associated with the specified secret type.

ibmcloud secrets-manager config-element-update --secret-type SECRET-TYPE --config-element CONFIG-ELEMENT --config-name CONFIG-NAME --type TYPE --config CONFIG



 Command options 

--secret-type (string)
: The secret type. Required.
cb(err, data.Wrapped);
});







 UnwrapKey 

The UnwrapKey function unwraps (decrypts) a key.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_UnwrapKey, which is an implementation of PKCS #11 C_UnwrapKey. 
 Parameters message UnwrapKeyRequest { bytes Wrapped = 1; bytes KeK = 2; bytes MacKey = 3; Mechanism Mech = 5; map<uint64,AttributeValue> Template = 9; } message UnwrapKeyResponse { bytes UnwrappedBytes = 7; bytes CheckSum = 8; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

aesUnwrapKeyTemplate := ep11.EP11Attributes{
ep11.CKA_CLASS: ep11.CKO_SECRET_KEY,
ep11.CKA_KEY_TYPE: ep11.CKK_AES,
ep11.CKA_VALUE_LEN: 128 / 8,
ep11.CKA_ENCRYPT: true,
ep11.CKA_DECRYPT: true,
ep11.CKA_EXTRACTABLE: true, // must be true to be wrapped
}
UnwrapKeyRequest := &pb.UnwrapKeyRequest{
Mech: &pb.Mechanism{Mechanism: ep11.CKM_RSA_PKCS},
KeK: GenerateKeyPairResponse.PrivKeyBytes,
Wrapped: WrapKeyResponse.Wrapped,
Template: util.AttributeMap(aesUnwrapKeyTemplate),
}

// Unwrap the AES key
UnwrapKeyResponse, err := cryptoClient.UnwrapKey(context.Background(), UnwrapKeyRequest)
Show more
* JavaScript code snippet
kubectl get secrets binding-<service_instance_name> --namespace=<namespace> -o yaml

Example output

apiVersion: v1
data:
binding: <binding>
kind: Secret
metadata:
annotations:
service-instance-id: 1111aaaa-a1aa-1aa1-1a11-111aa111aa11
service-key-id: 2b22bb2b-222b-2bb2-2b22-b22222bb2222
creationTimestamp: 2018-08-07T20:47:14Z
name: binding-<service_instance_name>
namespace: <namespace>
resourceVersion: "6145900"
selfLink: /api/v1/namespaces/default/secrets/binding-mycloudant
uid: 33333c33-3c33-33c3-cc33-cc33333333c
type: Opaque
2. Decode the binding value.

echo "<binding>" | base64 -D

Example output
The WrapKey function wraps (encrypts) a key.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_WrapKey, which is an implementation of PKCS #11 C_WrapKey. 
 Parameters message WrapKeyRequest { bytes Key = 1; bytes KeK = 2; bytes MacKey = 3; Mechanism Mech = 4; } message WrapKeyResponse { bytes Wrapped = 5; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

WrapKeyRequest := &pb.WrapKeyRequest {
Mech: &pb.Mechanism{Mechanism: ep11.CKM_RSA_PKCS},
KeK: GenerateKeyPairResponse.PubKeyBytes,
Key: GenerateKeyResponse.KeyBytes,
}

WrapKeyResponse, err := cryptoClient.WrapKey(context.Background(), WrapKeyRequest)
* JavaScript code snippet

client.WrapKey({
Mech: {
Mechanism: ep11.CKM_RSA_PKCS
},
KeK: rsa.PubKeyBytes,
Key: aes.KeyBytes
}, (err, data={}) => {
cb(err, data.Wrapped);
});







 UnwrapKey 

The UnwrapKey function unwraps (decrypts) a key.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_UnwrapKey, which is an implementation of PKCS #11 C_UnwrapKey.
In addition to backing up your workloads and having the capability to restore service in the face of a disaster, your BCDR strategy needs to consider all of the IBM Cloud services in your deployment. The following table provides references to additional information regarding BCDR for each service in the reference architecture.

The following table provides references for more information about BCDR for each service in the reference architecture.



Table 1. Backup and disaster recovery information for IBM Cloud services in the reference architectures

 Category VPC reference architecture Satellite reference architecture Optional for both 

 Core <br><br> * [VPC infrastructure services](https://cloud.ibm.com/vpc?topic=vpc-ha-dr-vpc)[1]<br><br><br> <br><br> * [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-ha)<br><br><br> 
 Containers <br><br> * [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-ha)<br> * [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-ha-dr)<br><br><br> <br><br> * [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-ha)[2]<br> * [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-ha-dr)<br><br><br> 
 Networking <br><br> * [VPC infrastructure services](https://cloud.ibm.com/vpc?topic=vpc-ha-dr-vpc)<br> * [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-ha-dr)<br> * [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-ha-drdisaster-recovery)<br><br><br>
Restoring a backup through the API 

The Resource Controller supports provisioning of database deployments, and provisioning and restoring are the responsibility of the Resource Controller API. You need to complete [the necessary steps to use the resource controller API](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-provisioningprovisioning-through-the-resource-controller-api) before you can use it to restore from a backup.

When you have all the information, the create request is a POST to the [/resource_instances](https://cloud.ibm.com/apidocs/resource-controllercreate-provision-a-new-resource-instance) endpoint.

curl -X POST https://resource-controller.cloud.ibm.com/v2/resource_instances -H 'Authorization: Bearer <>' -H 'Content-Type: application/json' -d '{
"name": "<SERVICE_INSTANCE_NAME>",
"target": "<region>",
"resource_group": "<your-resource-group>",
"resource_plan_id": "<service-id>",
"parameters":{
"backup_id": "<backup_id>"
}
}'

The parameters name, target, resource_group, and resource_plan_id are all required, and backup_id is the backup that you want to restore. The target is the region where you want the new deployment to be located, which can be a different region from the source deployment. Cross region restores are supported, except for restoring into or out of the eu-de region.

If you need to adjust resources or use a Key Protect key, add any of the optional parameters key_protect_key, members_disk_allocation_mb, members_memory_allocation_mb, and members_cpu_allocation_count, and their preferred values to the body of the request.







 Backups and Restoration 



* IBM Cloud Databases are not responsible for restoration, timeliness, or validity of said backups.
* Actions that you take as a user can compromise the integrity of backups, such as under-allocating memory and disk.
[Backup and restore with Windows® IBM Cloud Backup Agent](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewbackup-and-restore-backup-agent) Large data migration, full database backup, moving database data to another drive, moving database data between different versions of SQL server. 
 [Detach and attach](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewdetach-and-attach) Full database backup, moving database data to another drive, moving database data between different versions of SQL server. 
 [Import and export data from SQL Server](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewimport-and-export) Large data migration, full database backup 
 [Copy Database Wizard](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewcopy-database-wizard) Small data migration 
 [Generate script](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewgenerate-script) Small data migration or schema-only migration 
 [Backup and restore with SQL Server Management Studio](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewbackup-and-restore-management-studio) Large data migration, full database backup, moving database data to another drive, moving database data between different versions of SQL server. 
 [Transactional replication](https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-mssql-db-overviewtransaction-replication) Copying and distributing data and database objects from one database to another, synchronizing between databases to maintain consistency.
'{"point_in_time_recovery_deployment_id":"DEPLOYMENT_ID", "point_in_time_recovery_time":"TIMESTAMP","key_protect_key":"KEY_PROTECT_KEY_CRN", "members_disk_allocation_mb":"DESIRED_DISK_IN_MB", "members_memory_allocation_mb":"DESIRED_MEMORY_IN_MB", "members_cpu_allocation_count":"NUMBER_OF_CORES", "version":" "}'





 Recovery with the API 

The Resource Controller supports provisioning of database deployments, and provisioning and restoring are the responsibility of the Resource Controller API. You need to complete [the necessary steps to use the resource controller API](https://cloud.ibm.com/docs/databases-for-postgresql?topic=cloud-databases-provisioningprovisioning-through-the-resource-controller-api) before you can use it to restore from a backup.

After you have all the information, the create request is a POST to the [/resource_instances](https://cloud.ibm.com/apidocs/resource-controllercreate-provision-a-new-resource-instance) endpoint.

curl -X POST https://resource-controller.cloud.ibm.com/v2/resource_instances -H 'Authorization: Bearer <>' -H 'Content-Type: application/json' -d '{
"name": "<SERVICE_INSTANCE_NAME>",
"target": "<region>",
"resource_group": "<your-resource-group>",
"resource_plan_id": "<service-id>"
"point_in_time_recovery_time":"<TIMESTAMP>",
"point_in_time_recovery_deployment_id":"<DEPLOYMENT_ID>"
}'

The point-in-time-recovery timestamp must be formatted as follows: %Y-%m-%dT%H:%M:%SZ.
r138-25828175-2b51-4247-ba01-79c538f68282 true 15 2023-02-23T20:12:37+00:00 2023-02-23T20:12:14+00:00 creation succeeded
r138-57028109-4702-443a-891b-31cac565546c true 15 2023-02-22T20:12:44+00:00 2023-02-22T20:12:25+00:00 creation succeeded
r138-d25c915c-3166-436d-b289-68d222297510 true 15 2023-02-22T15:27:43+00:00 2023-02-22T15:27:20+00:00 creation succeeded

In the second example, the policy is identified by its ID, and the JSON output option is used.

cloudshell:$ ibmcloud is backup-policy-jobs r138-0521986d-963c-4c18-992d-d6a7a99d115f --output JSON
[
{
"auto_delete": true,
"auto_delete_after": 15,
"backup_policy_plan": {
"href": "https://eu-de.iaas.cloud.ibm.com/v1/backup_policies/r138-0521986d-963c-4c18-992d-d6a7a99d115f/plans/r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9",
"id": "r138-6f4f08ba-e0bb-470f-bbfb-f3a22aebbfa9",
"name": "my-policy-plan-b",
"resource_type": "backup_policy_plan"
},
<-- <section "id="section-backup-view-jobs-list-terraform" "> --> View a list of backup jobs with Terraform Import the list of a collection of backup jobs as a read-only data source. data "ibm_is_backup_policy_jobs" "example" {
backup_policy_id = ibm_is_backup_policy.example.id
}
For more information about the arguments and attributes, see ibm_is_backup_policy_jobs]ibm_is_backup_policy_jobs] ! ! .<-- </section "id="section-backup-view-jobs-list-terraform" "> --><-- <section "id="section-backup-view-jobs-details-terraform" "> --> View details of a backup job with Terraform Import the details of a backup job as a read-only data source. data "ibm_is_backup_policy_job" "example" {
backup_policy_id = ibm_is_backup_policy.example.id
identifier = "r138-25828175-2b51-4247-ba01-79c538f68282"
}
For more information about the arguments and attributes, see ibm_is_backup_policy_job]ibm_is_backup_policy_job] ! ! ! ! .<-- </section "id="section-backup-view-jobs-details-terraform" "> --><-- </section "class="ph" id="section-backup-view-jobs-terraform" "> --><-- <section "id="section-backup-jobs-next-steps" "> --> Next steps <-- <ul> --> * Apply tags to your resources for backups]] . * Create more backup policies]] . * Restore a volume from a backup snapshot]] ! ! ! ! !
CP-10 - Information System Recovery and Reconstitution 



 Control requirements 

CP-10 - 0
: The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.





 Additional IBM Cloud for Financial Services specifications 



* Contingency plans must include procedures for validating successful recovery and reconstitution. Recovery and reconstitution activities include resuming operational capabilities at the original location.







 Implementation guidance 

See the resources that follow to learn more about how to implement this control.



* [Business continuity and disaster recovery overview](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr)
* [Operational logging](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-operational)
* [Operational monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-operational)







 IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



* Check whether Hyper Protect Crypto Services instance has at least # crypto units
* Check whether each Application Load Balancer for VPC is configured to use at least # zones
* Check whether Application Load Balancer for VPC is attached with an Auto Scale for VPC instance group provided with health check
* Check whether Application Load Balancer for VPC is configured with multiple members in the pool
* Check whether an OpenShift cluster has worker nodes across multiple zones
* Check whether Cloud Object Storage bucket resiliency is set to cross region
* Check that any Cloud Object Storage buckets used by Activity Tracker Event Routing are configured as cross-region
* Check that Hyper Protect Crypto Services has failover units in at least 2 different regions that are Financial Services Validated
The following example defines a plan within the my-backup-policy-v1 policy. The new plan is called not-just-another-plan and it initiates backup jobs every morning at 01:05.

resource "ibm_is_backup_policy_plan" "example" {
backup_policy_id = ibm_is_backup_policy.example.id
cron_spec = "05 01 * * "
name = "my-backup-plan"
}

For more information about the arguments and attributes, see [ibm_is_backup_policy_plan](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_backup_policy_plan).





 Creating a backup plan with fast restore option with Terraform 

To create a backup plan with fast restore option, use the ibm_is_backup_policy_plan resource.

The following example defines a backup plan for an existing policy that includes fast restore in two zones within the eu-de region. The plan includes keeping a maximum of two cached backups in each zone. The backup job starts creating backup snapshots at 7:15 PM every day.

resource "ibm_is_backup_policy_plan" "example" {
backup_policy_id = "ibm_is_backup_policy.example.id"
cron_spec = "15 19 * * "
name = "my-policy-plan"
clone_policy {
zones = ["eu-de-1", "eu-de-3"]
max_snapshots = 2
}
}

For more information about the arguments and attributes, see [ibm_is_backup_policy_plan](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/is_backup_policy_plan).





 Creating a backup plan with cross-regional copy option with Terraform 

New

To create a backup plan with cross-regional copy option, use the ibm_is_backup_policy_plan resource. If the source snapshot is not encrypted with a customer key, the encryption of the copy remains provider-managed.
}
data "ibm_is_backup_policy_plan" "example" {
backup_policy_id = ibm_is_backup_policy.example.id
name = ibm_is_backup_policy_plan.example.name
}
For more information about the arguments and attributes, see ibm_is_backup_policy_plan]ibm_is_backup_policy_plan] ! ! ! ! .<-- </section "id="section-backup-view-plan-details-terraform" "> --><-- </section "class="ph" id="section-backup-view-terraform" "> --><-- <section "id="section-backup-view-next-steps" "> --> Next steps You can do the following actions.<-- <ul> --> * Apply tags to your resources for backups]Applying backup policies to resources by using tags] . * Manage your backup policies and plans]] . * Restore a volume from a backup snapshot]] ! ! ! ! !
Backing up and restoring data 

If you need to backup and restore a workspace for Knowledge Studio, perform these tasks. Also, if you need to perform a manual data migration from one Knowledge Studio instance to another, perform these tasks.

This topic describes backing up and restoring workspace data, such as type systems and ground truth. For information on backing up and restoring databases, see [Backing up and restoring databases](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restore-databases).

Manual data migration is the process of backing up your data from one instance and restoring it on another instance.

To back up and restore your data complete the following steps:



1. [Understand which data can be backed up](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restoredata)
2. [Prepare for backup](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restoreprepare)
3. [Download artifacts from the current instance](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restoreexport)
4. [Recreate workspaces on the new instance](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restorerecreateproj)
5. [Restore the workspace data](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restorerestoredata)
6. [Restore the models](https://cloud.ibm.com/docs/watson-knowledge-studio-data?topic=watson-knowledge-studio-data-backup-restorerestoremodels)
7.
Satellite Location <br><br> * Back up location information to recover Satellite location control plane components to an IBM-managed bucket in your IBM Cloud Object Storage instance.<br> * Monitor the health of the location, automatically resolve issues when possible, and alert IBM site reliability engineers when manual intervention is required.<br><br><br> <br><br> * Define the disaster recovery requirements for the environment.<br> * Provide access to the backup in your [IBM Cloud Object Storage instance](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) if you need to recover a location.<br><br><br> 
 Satellite Host <br><br> * Back up information for hosts that are assigned to the location control plane to an IBM-managed IBM Cloud Object Storage instance.<br> * Back up information for hosts that are assigned to Satellite clusters to an IBM Cloud Object Storage instance in your account.<br><br><br> <br><br> * Maintain, repair, or replace hardware as needed.<br><br><br> 
 Satellite Config <br><br> * Back up information about saved Satellite configurations in etcd.<br> * When service is restored, automatically deploy configuration files to available clusters.<br><br><br> <br><br> * Design, implement and test a disaster recovery plan for your [highly available apps](https://cloud.ibm.com/docs/openshift?topic=openshift-plan_deployhighly_available_apps).<br><br><br> 
 Satellite Link N/A <br><br> * Reinstate any necessary [endpoints](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) to your resources after recovering from a disaster.<br><br><br>
You need to complete [the necessary steps to use the resource controller API](https://cloud.ibm.com/docs/databases-for-mysql?topic=cloud-databases-provisioningprovisioning-through-the-resource-controller-api) before you can use it to restore from a backup.

Once you have all the information, the create request is a POST to the [/resource_instances](https://cloud.ibm.com/apidocs/resource-controllercreate-provision-a-new-resource-instance) endpoint.

curl -X POST https://resource-controller.cloud.ibm.com/v2/resource_instances -H 'Authorization: Bearer <>' -H 'Content-Type: application/json' -d '{
"name": "<SERVICE_INSTANCE_NAME>",
"target": "<region>",
"resource_group": "<your-resource-group>",
"resource_plan_id": "<service-id>"
"point_in_time_recovery_time":"<TIMESTAMP>",
"point_in_time_recovery_deployment_id":"<DEPLOYMENT_ID>"
}'

The parameters name, target, resource_group, and resource_plan_id are all required. The target is the region where you want the new deployment to be located, which can be a different region from the source deployment. Cross-region restores are supported, except for restoring a eu-de backup to another region.

For PITR, use the point_in_time_recovery_time and point_in_time_recovery_deployment_id parameters. The point_in_time_recovery_deployment_id is the source deployment's ID and point_in_time_recovery_time is the timestamp in UTC you want to restore to. If you want to restore to the latest available point-in-time use "point_in_time_recovery_time":" ".