vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Are you receiving a message that credentials cannot be verified when you run a command? 

When you run an IBM Cloud® Security and Compliance Center Workload Protection command, a message is returned that credentials cannot be verified along with a 401 status.

A message similar to this message is returned when you run a Workload Protection command:

  What’s happening 

{"message":"cannot verify credentials","referenceId":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}

...

Status: 401, Message: {"message":"cannot verify credentials","referenceId":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"}

  Why it’s happening 

You don't have sufficient permissions to run the command.

  How to fix it 

Review the documentation on [controlling access through IAM policies](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-iam), ensure you have the correct policies set, and retry the command.
1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address option is not set. Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port option is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port option is not set to 0. Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling option is set to false. Scored 1 Pass IBM 
 1.2.22 Ensure that the --audit-log-path option is set. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 1.2.23 Ensure that the --audit-log-maxage option is set to 30 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared 
 1.2.24 Ensure that the --audit-log-maxbackup option is set to 10 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410) Shared
"lease_duration": 0,
"data": null,
"wrap_info": null,
"warnings": null,
"auth": null
}









 Locks 



 List secret locks 

List the locks that are associated with a specified secret.



Table 9. Lock secret request parameters

 Query parameters Description 

 limit The number of locks to retrieve. Default is 25. To retrieve a different set of items, use limit with offset to page through your available resources. 
 offset The number of locks to skip. Default is 0. By specifying offset, you retrieve a subset of locks that starts with the offset value. Use offset with limit to page through your available secrets locks. 
 search Filter locks that contain the specified string in their name. 





 Example request 

List locks for an arbitrary secret.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/arbitrary/locks/{secret_id}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

List locks for a user credentials secret in an existing secret group.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/username_password/locks/groups/{group_id}/{secret_id}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Page through available locks by using limit and offset.

curl -X GET "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/username_password/locks/groups/{group_id}/{secret_id}?limit={limit}&offset={offset}" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}'

Filter for locks that contain book in their names.
Member is.load-balancer.load-balancer-pool-member.update Member was updated 
 Member is.load-balancer.load-balancer-pool-member.delete Member was deleted 
 Member is.load-balancer.load-balancer-pool-member.read Member was read 
 Policy is.load-balancer.load-balancer-listener-policy.create Policy was created 
 Policy is.load-balancer.load-balancer-listener-policy.update Policy was updated 
 Policy is.load-balancer.load-balancer-listener-policy.delete Policy was deleted 
 Policy is.load-balancer.load-balancer-listener-policy.read Policy was read 
 Rule is.load-balancer.load-balancer-listener-policy-rule.create Rule was created 
 Rule is.load-balancer.load-balancer-listener-policy-rule.update Rule was updated 
 Rule is.load-balancer.load-balancer-listener-policy-rule.delete Rule was deleted 
 Rule is.load-balancer.load-balancer-listener-policy-rule.read Rule was read 







 Public gateway events 



Table 6. Actions that generate events for Public Gateway

 Resource Action Description 

 public-gateway is.public-gateway.public-gateway.create Public Gateway was created 
 public-gateway is.public-gateway.public-gateway.update Public Gateway was updated 
 public-gateway is.public-gateway.public-gateway.delete Public Gateway was deleted 
 public-gateway is.public-gateway.public-gateway.read One or more public gateways were retrieved 







 Security group events 



Table 7. Actions that generate events for Security Group

 Resource Action Description 

 security-group is.security-group.security-group.create Security Group was created 
 security-group is.security-group.security-group.delete Security Group was deleted 
 security-group is.security-group.security-group.update Security Group was updated 
 security-group is.security-group.security-group.read One or more security groups were retrieved 
 security-group is.security-group.security-group-rule.create Rule was added to Security Group
Audit and Accountability (AU) [AU-2 Audit Events](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-2) <br>[AU-3 Content of Audit Records](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-3) <br>[AU-5 Response to Audit Processing Failures](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-5) <br>[AU-8 Time Stamps](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-8) <br>[AU-9 Protection of Audit Information](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-9) <br>[AU-10 Non-repudiation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-10) <br>[AU-11 Audit Record Retention](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-11) <br>[AU-12 Audit Generation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-12) 







 4. Follow secure development processes and ensure software integrity 

Requirement: Ensure that security engineering principles are applied in the design, development, implementation, and modification of your software. Maintain software integrity by using signed images, applying security patches, doing vulnerability scans, etc.

Purpose & value: It is critical to follow security engineering principles and manage changes to your software using a system development life cycle (SDLC) that incorporates information security considerations. Doing so minimizes the risk of introducing code or configuration changes that undermine your software's security.
[Overview of network security options](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policyvpc-network-policy)



* [Comparison of network security options](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policycomparison)
* [Access control lists (ACLs) or security groups?](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-network-policyacl-sg-compare)



[Controlling traffic with VPC security groups](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-security-group)



* [VPC security groups](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-security-groups-details)



* [Security groups applied to cluster workers](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-cluster-workers)
* [Security groups applied to VPE gateways and VPC ALBs](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-vpe-alb)



* [Viewing VPC security groups in the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-cli)
* [Viewing the default VPC security groups in the UI](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-ui)
* [Minimum inbound and outbound requirements](https://cloud.ibm.com/docs/openshift?topic=openshift-vpc-security-groupvpc-sg-inbound-outbound)
The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 2. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 System and Communications Protection (SC) [SC-8 Transmission Confidentiality and Integrity](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8) <br>[SC-8 (1) Transmission Confidentiality and Integrity | Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-8.1) <br>[SC-12 Cryptographic Key Establishment and Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12) <br>[SC-12 (2) Cryptographic Key Establishment and Management | Symmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.2) <br>[SC-12 (3) Cryptographic Key Establishment and Management | Asymmetric Keys](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-12.3) <br>[SC-13 Cryptographic Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-13) 



In addition, you must follow the guidance found in Appendix A: Cryptographic Requirements within the Control Implementation Overview Template for Application Providers Using IBM Cloud® Virtual Private Cloud.





 Next steps 



* [Business continuity and disaster recovery](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-bcdr)
[SC-20 - Secure Name / Address Resolution Service (authoritative Source)](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-20sc-20)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-20control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-20nist-supplemental-guidance)



[SC-21 - Secure Name / Address Resolution Service (recursive or Caching Resolver)](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-21sc-21)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-21control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-21nist-supplemental-guidance)



[SC-22 - Architecture and Provisioning for Name / Address Resolution Service](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-22sc-22)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-22control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sc-22nist-supplemental-guidance)
* [Other IBM Cloud services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-operationalsolutions-other)



* [Related controls in IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-operationalrelated-controls)
* [Next steps](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-logging-operationalnext-steps)



[Compliance monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-complianceshared-monitoring-compliance)



* [Using Security and Compliance Center](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-complianceusing-security-compliance-center)
* [Compliance best practices for Financial Services Validated services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliancerelated-resources)
* [Related controls in IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliancerelated-controls)
* [Next steps](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-compliancenext-steps)



[Operational monitoring](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-operationalshared-monitoring-operational)



* [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-monitoring-operationalopenshift)
Logging and monitoring <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ha-dr)<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ha-dr)<br> * [Flow Logs for VPC](https://cloud.ibm.com/vpc?topic=vpc-ha-dr-vpc)<br><br><br> <br><br> * [Activity Tracker Event Routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-ha-dr)<br> * [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ha-dr)<br><br><br> 
 Integration <br><br> * [Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-disaster_recovery_scenario)<br><br><br> 
 Databases <br><br> * [Hyper Protect DBaaS for MongoDB](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-high-availability-disaster-recovery)<br> * [Hyper Protect DBaaS for PostgreSQL](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-high-availability-disaster-recovery)<br><br><br> 



In addition to the Financial Services Validated services in the reference architecture, see the following references for other important information:



* [How IBM Cloud ensures high availability and disaster recovery](https://cloud.ibm.com/docs/overview?topic=overview-zero-downtime)
For one example that uses Teleport Enterprise Edition in the VPC reference architecture, see [Setting up a bastion host for secure connectivity](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-bastion-tutorial-teleport).





 Related controls in IBM Cloud Framework for Financial Services 

The following [IBM Cloud Framework for Financial Services controls](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-aboutframework-control-requirements) are most related to this guidance. However, in addition to following the guidance here, do your own due diligence to ensure you meet the requirements.



Table 1. Related controls in IBM Cloud Framework for Financial Services

 Family Control 

 Audit and Accountability (AU) [AU-14 Session Audit](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-au-14) 
 Access Control (AC) [AC-6 (9) Least Privilege | Auditing Use of Privileged Functions](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6.9) <br>[AC-17 Remote Access](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-17) 
 Identification and Authentication (IA) [IA-2 (1) Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2.1) 







 Next steps 



* [Using IBM Cloud services with Satellite Link](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-satellite-architecture-connectivity-to-services)
1.2.16 Ensure that the admission control plug-in PodSecurityPolicy is set. Scored 1 [Pass](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) IBM 
 1.2.17 Ensure that the admission control plug-in NodeRestriction is set. Scored 1 Pass IBM 
 1.2.18 Ensure that the --insecure-bind-address argument is not set. Scored 1 Pass IBM 
 1.2.19 Ensure that the --insecure-port argument is set to 0. Scored 1 Pass IBM 
 1.2.20 Ensure that the --secure-port argument is not set to 0. Scored 1 Pass IBM 
 1.2.21 Ensure that the --profiling argument is set to false. Scored 1 Pass IBM 
 1.2.22 Ensure that the --audit-log-path argument is set. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate. Scored 1 [Fail](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-49ibm-remediations-and-explanations-49) Shared 
 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate.
[AC-2 (9) - Restrictions On Use of Shared / Group Accounts](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2.9ac-2.9)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2.9control-requirements)



[AC-3 - Access Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3ac-3)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3additional-ibm-cloud-for-financial-services-specifications)
* [Implementation guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3implementation-guidance)
* [IBM Cloud for Financial Services profile](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3scc-fs-cloud-profile)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3nist-supplemental-guidance)



[AC-4 - Information Flow Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-4ac-4)
set security address-book global address SL17 10.2.48.0/20
set security address-book global address SL18 10.2.176.0/20
set security address-book global address SL19 10.3.64.0/20
set security address-book global address SL20 10.3.80.0/20
set security address-book global address SL_PRIV_MGMT 10.135.70.22/32
set security address-book global address SL_PUB_MGMT 169.50.51.92/32
set security address-book global address-set SERVICE address SL1
set security address-book global address-set SERVICE address SL2
set security address-book global address-set SERVICE address SL3
set security address-book global address-set SERVICE address SL4
set security address-book global address-set SERVICE address SL5
set security address-book global address-set SERVICE address SL6
set security address-book global address-set SERVICE address SL7
set security address-book global address-set SERVICE address SL8
set security address-book global address-set SERVICE address SL9
set security address-book global address-set SERVICE address SL10
set security address-book global address-set SERVICE address SL11
set security address-book global address-set SERVICE address SL12
set security address-book global address-set SERVICE address SL13
set security address-book global address-set SERVICE address SL14
set security address-book global address-set SERVICE address SL15
set security address-book global address-set SERVICE address SL16
set security address-book global address-set SERVICE address SL17
set security address-book global address-set SERVICE address SL18
set security address-book global address-set SERVICE address SL19
set security address-book global address-set SERVICE address SL20
set security screen ids-option untrust-screen icmp ping-death
set security screen ids-option untrust-screen ip source-route-option
set security screen ids-option untrust-screen ip tear-drop
set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-52-410)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-53-410)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-54-410)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-55-410)
* [5.6 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410cis-benchmark-56-410)
* [IBM remediations and explanations](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-410ibm-remediations-and-explanations-410)





[Red Hat OpenShift on IBM Cloud version 4.10 compliance operator benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_cobenchmarks_410_co)



* [1 Control plane components](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-cp)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-11)
* [1.2 API server](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_410_coco-benchmark-410-12)