Ibm Cloud

IBM Cloud

Systematic IBM Cloud platform guidance for enterprise cloud infrastructure, covering compute, storage, databases, networking, security, and operational best practices.

Workflow Decision Tree

Choose your path based on the task:

1. Service Category Selection

Compute & Containers → Load compute-services.md

• Virtual Private Cloud (VPC) and Virtual Server Instances
• IBM Kubernetes Service (IKS) and Red Hat OpenShift
• Code Engine (serverless containers) and Cloud Functions

Storage → Load storage-services.md

• Cloud Object Storage, Block Storage, File Storage

Databases → Load database-services.md

• Db2, Cloudant, PostgreSQL, MySQL, MongoDB, Redis

Security & Access → Load iam-security.md

• IAM, Resource Groups, Service IDs, Key Protect, Secrets Manager

Networking → Load networking.md

• VPC Networks, Load Balancers, DNS/CDN, Direct Link

2. Architecture & Deployment Patterns

High Availability → Multi-zone deployment across 3 availability zones Microservices → IKS/OpenShift with service mesh and ingress Serverless → Code Engine applications with auto-scaling Hybrid Cloud → Direct Link or VPN for on-premises connectivity

3. Common Operations

Initial Setup → Install CLI, authenticate, configure regions and resource groups Resource Provisioning → Use CLI, Terraform, or IBM Cloud Console Security Configuration → IAM policies, encryption, network security Monitoring → Set up logging, monitoring, and cost tracking

Core Concepts

Resource Hierarchy

Account → Resource Groups → Services/Resources → Access Groups (IAM)

Regions and Multi-Zone Architecture

• Primary Regions: us-south, us-east, eu-gb, eu-de, jp-tok, au-syd
• Availability Zones: 3 zones per region (e.g., us-south-1, us-south-2, us-south-3)
• Best Practice: Deploy across multiple zones for high availability

Service Categories

• IaaS: VPC, Virtual Servers, Block/File Storage
• PaaS: IKS, OpenShift, Code Engine
• SaaS: Managed Databases, Watson AI, DevOps Tools
• Serverless: Code Engine, Cloud Functions

Quick Start

1. Install and Configure CLI

# Install CLI (macOS/Linux)
curl -fsSL https://clis.cloud.ibm.com/install/osx | sh

# Login
ibmcloud login

# Target region and resource group
ibmcloud target -r us-south -g my-resource-group

# Install common plugins
ibmcloud plugin install container-service vpc-infrastructure

2. Basic Resource Creation Pattern

# 1. Create VPC
ibmcloud is vpc-create my-vpc

# 2. Create resources (compute, storage, network)
ibmcloud is instance-create my-vsi ...

# 3. Configure IAM
ibmcloud iam ...

# 4. Deploy application
# 5. Set up monitoring

Essential Guidance

Security Best Practices

1. IAM: Use Access Groups, apply least privilege, rotate API keys every 90 days 2. Network: Use private endpoints, configure Security Groups and ACLs 3. Data: Enable encryption at rest/transit, use Key Protect for key management 4. Compliance: Choose regions for data residency requirements

Cost Optimization

• Right-size instances for workload requirements
• Use reserved capacity for predictable workloads
• Leverage serverless (Code Engine/Functions) for variable loads
• Select appropriate storage tiers (Standard, Vault, Cold Vault)
• Enable auto-scaling to match demand
• Set budget alerts and monitor usage

Reference Files

Load detailed guidance based on specific needs:

• [compute-services.md](references/compute-services.md): VPC, Virtual Servers, IKS, OpenShift, Code Engine, Cloud Functions
• [storage-services.md](references/storage-services.md): Object Storage, Block Storage, File Storage
• [database-services.md](references/database-services.md): Db2, Cloudant, PostgreSQL, MySQL, MongoDB, Redis
• [iam-security.md](references/iam-security.md): IAM, Access Groups, Service IDs, Key Protect, Secrets Manager
• [networking.md](references/networking.md): VPC networking, Load Balancers, DNS/CDN, Direct Link

Support Resources

• Documentation: <https://cloud.ibm.com/docs>
• API Reference: <https://cloud.ibm.com/apidocs>
• Terraform Provider: <https://registry.terraform.io/providers/IBM-Cloud/ibm>
• CLI Reference: <https://cloud.ibm.com/docs/cli>

AI/ML Services

Table of Contents

• Watson Assistant
• Watson Studio
• Watson Machine Learning
• Watson Natural Language Processing
• Watson Speech Services
• Watson Vision

---

Watson Assistant

Overview

Build conversational interfaces with AI-powered chatbots.

Create Watson Assistant

# Create Watson Assistant instance
ibmcloud resource service-instance-create my-watson-assistant \
  conversation plus us-south

# Create credentials
ibmcloud resource service-key-create my-wa-creds \
  Manager --instance-name my-watson-assistant

Build Chatbot

Node.js SDK:

const AssistantV2 = require('ibm-watson/assistant/v2');
const { IamAuthenticator } = require('ibm-watson/auth');

const assistant = new AssistantV2({
  version: '2023-06-15',
  authenticator: new IamAuthenticator({
    apikey: '<API-KEY>',
  }),
  serviceUrl: '<SERVICE-URL>',
});

// Create session
const session = await assistant.createSession({
  assistantId: '<ASSISTANT-ID>',
});

// Send message
const response = await assistant.message({
  assistantId: '<ASSISTANT-ID>',
  sessionId: session.result.session_id,
  input: {
    message_type: 'text',
    text: 'Hello, I need help with my order',
  },
});

console.log(JSON.stringify(response.result, null, 2));

---

Watson Studio

Overview

Collaborative platform for data science and ML model development.

Create Project

# Create Watson Studio instance
ibmcloud resource service-instance-create my-watson-studio \
  data-science-experience free-v1 us-south

Jupyter Notebooks

Access via Watson Studio web UI:

• Python, R, Scala notebooks
• GPU acceleration
• Collaborative editing
• Version control integration

---

Watson Machine Learning

Overview

Deploy and manage machine learning models at scale.

Train and Deploy Model

Python SDK:

from ibm_watson_machine_learning import APIClient

# Initialize client
wml_credentials = {
    "url": "<SERVICE-URL>",
    "apikey": "<API-KEY>"
}
client = APIClient(wml_credentials)

# Set space
client.set.default_space('<SPACE-ID>')

# Train model
import sklearn
from sklearn.linear_model import LogisticRegression

model = LogisticRegression()
model.fit(X_train, y_train)

# Store model
model_props = {
    client.repository.ModelMetaNames.NAME: "My Model",
    client.repository.ModelMetaNames.TYPE: "scikit-learn_1.1",
    client.repository.ModelMetaNames.SOFTWARE_SPEC_UID: client.software_specifications.get_uid_by_name("default_py3.10")
}

model_details = client.repository.store_model(
    model=model,
    meta_props=model_props,
    training_data=training_data
)

# Deploy model
deployment = client.deployments.create(
    model_details['metadata']['id'],
    meta_props={
        client.deployments.ConfigurationMetaNames.NAME: "My Deployment",
        client.deployments.ConfigurationMetaNames.ONLINE: {}
    }
)

# Score
scoring_payload = {
    "input_data": [{
        "values": [[1.0, 2.0, 3.0, 4.0]]
    }]
}

predictions = client.deployments.score(
    deployment['metadata']['id'],
    scoring_payload
)
print(predictions)

---

Watson Natural Language Processing

Natural Language Understanding

Python:

from ibm_watson import NaturalLanguageUnderstandingV1
from ibm_watson.natural_language_understanding_v1 import Features, EntitiesOptions, KeywordsOptions, SentimentOptions

nlu = NaturalLanguageUnderstandingV1(
    version='2022-04-07',
    authenticator=IAMAuthenticator('<API-KEY>')
)
nlu.set_service_url('<SERVICE-URL>')

# Analyze text
response = nlu.analyze(
    text='IBM is an American multinational technology company with headquarters in Armonk, New York.',
    features=Features(
        entities=EntitiesOptions(sentiment=True, limit=2),
        keywords=KeywordsOptions(sentiment=True, limit=2),
        sentiment=SentimentOptions()
    )
).get_result()

print(json.dumps(response, indent=2))

Language Translator

Python:

from ibm_watson import LanguageTranslatorV3

translator = LanguageTranslatorV3(
    version='2018-05-01',
    authenticator=IAMAuthenticator('<API-KEY>')
)
translator.set_service_url('<SERVICE-URL>')

# Translate text
translation = translator.translate(
    text='Hello, how are you?',
    source='en',
    target='es'
).get_result()

print(translation['translations'][0]['translation'])

---

Watson Speech Services

Speech to Text

Python:

from ibm_watson import SpeechToTextV1

stt = SpeechToTextV1(
    authenticator=IAMAuthenticator('<API-KEY>')
)
stt.set_service_url('<SERVICE-URL>')

# Transcribe audio
with open('audio.mp3', 'rb') as audio_file:
    response = stt.recognize(
        audio=audio_file,
        content_type='audio/mp3',
        model='en-US_BroadbandModel'
    ).get_result()

print(response['results'][0]['alternatives'][0]['transcript'])

Text to Speech

Python:

from ibm_watson import TextToSpeechV1

tts = TextToSpeechV1(
    authenticator=IAMAuthenticator('<API-KEY>')
)
tts.set_service_url('<SERVICE-URL>')

# Synthesize speech
with open('output.mp3', 'wb') as audio_file:
    response = tts.synthesize(
        text='Hello, welcome to IBM Cloud Watson services',
        voice='en-US_AllisonV3Voice',
        accept='audio/mp3'
    ).get_result()
    audio_file.write(response.content)

---

Watson Vision

Visual Recognition

Python:

from ibm_watson import VisualRecognitionV4

vr = VisualRecognitionV4(
    version='2019-02-11',
    authenticator=IAMAuthenticator('<API-KEY>')
)
vr.set_service_url('<SERVICE-URL>')

# Analyze image
with open('image.jpg', 'rb') as image_file:
    response = vr.analyze(
        collection_ids=['<COLLECTION-ID>'],
        features=['objects'],
        images_file=[image_file]
    ).get_result()

print(json.dumps(response, indent=2))

---

Best Practices

Model Development

1. Data Quality: Clean, labeled training data 2. Feature Engineering: Extract meaningful features 3. Model Selection: Choose appropriate algorithms 4. Hyperparameter Tuning: Optimize model parameters 5. Cross-Validation: Evaluate generalization

Deployment

1. Monitoring: Track model performance 2. Versioning: Maintain model versions 3. A/B Testing: Compare model variants 4. Scaling: Auto-scale inference endpoints 5. Security: Secure API endpoints with IAM

Cost Optimization

1. Batch Inference: Use batch for bulk predictions 2. Model Caching: Cache frequent predictions 3. Right-Size: Match compute to workload 4. Free Tiers: Leverage lite plans for development 5. Monitoring: Track API usage and costs

CLI & Automation

Table of Contents

• IBM Cloud CLI
• Terraform Provider
• Schematics
• Resource Manager APIs
• CI/CD Integration

---

IBM Cloud CLI

Installation

# macOS
curl -fsSL https://clis.cloud.ibm.com/install/osx | sh

# Linux
curl -fsSL https://clis.cloud.ibm.com/install/linux | sh

# Windows (PowerShell as Admin)
iex (New-Object Net.WebClient).DownloadString('https://clis.cloud.ibm.com/install/powershell')

# Verify
ibmcloud version

Essential Plugins

# Container Service (IKS)
ibmcloud plugin install container-service

# Container Registry
ibmcloud plugin install container-registry

# VPC Infrastructure
ibmcloud plugin install vpc-infrastructure

# Cloud Object Storage
ibmcloud plugin install cloud-object-storage

# Databases
ibmcloud plugin install cloud-databases

# Schematics
ibmcloud plugin install schematics

# List installed plugins
ibmcloud plugin list

# Update all plugins
ibmcloud plugin update --all

Common Commands

# Login
ibmcloud login
ibmcloud login --sso
ibmcloud login --apikey @apikey.txt

# Target region and resource group
ibmcloud target -r us-south -g production-rg

# List resources
ibmcloud resource service-instances
ibmcloud is vpcs
ibmcloud ks clusters

# Create resource
ibmcloud resource service-instance-create my-cos \
  cloud-object-storage standard global

# Update resource
ibmcloud resource service-instance-update my-cos \
  --service-plan-id <NEW-PLAN-ID>

# Delete resource
ibmcloud resource service-instance-delete my-cos

CLI Configuration

# Set CLI preferences
ibmcloud config --usage-stats-collect false
ibmcloud config --check-version false

# View configuration
ibmcloud config --list

# Set output format (JSON)
ibmcloud config --output json

Scripting with CLI

Bash Script:

#!/bin/bash
set -e

# Variables
RESOURCE_GROUP="production-rg"
REGION="us-south"
COS_NAME="my-app-storage"

# Login
ibmcloud login --apikey "${IBMCLOUD_API_KEY}" --no-region

# Target region and resource group
ibmcloud target -r "${REGION}" -g "${RESOURCE_GROUP}"

# Create COS instance
ibmcloud resource service-instance-create "${COS_NAME}" \
  cloud-object-storage standard global \
  -g "${RESOURCE_GROUP}"

# Create service credentials
ibmcloud resource service-key-create "${COS_NAME}-creds" \
  Writer --instance-name "${COS_NAME}" \
  --parameters '{"HMAC": true}'

# Get credentials
CREDENTIALS=$(ibmcloud resource service-key "${COS_NAME}-creds" --output json)
echo "${CREDENTIALS}" | jq -r '.credentials'

---

Terraform Provider

Setup

# versions.tf
terraform {
  required_version = ">= 1.0"
  required_providers {
    ibm = {
      source  = "IBM-Cloud/ibm"
      version = "~> 1.59"
    }
  }
}

# provider.tf
provider "ibm" {
  ibmcloud_api_key = var.ibmcloud_api_key
  region           = var.region
}

# variables.tf
variable "ibmcloud_api_key" {
  description = "IBM Cloud API Key"
  type        = string
  sensitive   = true
}

variable "region" {
  description = "IBM Cloud region"
  type        = string
  default     = "us-south"
}

Complete Infrastructure Example

# main.tf

# Resource Group
resource "ibm_resource_group" "rg" {
  name = "my-app-rg"
}

# VPC
resource "ibm_is_vpc" "vpc" {
  name                      = "my-vpc"
  resource_group            = ibm_resource_group.rg.id
  address_prefix_management = "auto"
}

# Subnets (Multi-Zone)
resource "ibm_is_subnet" "subnet_1" {
  name            = "subnet-zone-1"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "us-south-1"
  ipv4_cidr_block = "10.240.1.0/24"
  resource_group  = ibm_resource_group.rg.id
}

resource "ibm_is_subnet" "subnet_2" {
  name            = "subnet-zone-2"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "us-south-2"
  ipv4_cidr_block = "10.240.2.0/24"
  resource_group  = ibm_resource_group.rg.id
}

resource "ibm_is_subnet" "subnet_3" {
  name            = "subnet-zone-3"
  vpc             = ibm_is_vpc.vpc.id
  zone            = "us-south-3"
  ipv4_cidr_block = "10.240.3.0/24"
  resource_group  = ibm_resource_group.rg.id
}

# IKS Cluster
resource "ibm_container_vpc_cluster" "cluster" {
  name              = "my-cluster"
  vpc_id            = ibm_is_vpc.vpc.id
  flavor            = "bx2.4x16"
  worker_count      = 3
  kube_version      = "1.28"
  resource_group_id = ibm_resource_group.rg.id

  zones {
    name      = "us-south-1"
    subnet_id = ibm_is_subnet.subnet_1.id
  }

  zones {
    name      = "us-south-2"
    subnet_id = ibm_is_subnet.subnet_2.id
  }

  zones {
    name      = "us-south-3"
    subnet_id = ibm_is_subnet.subnet_3.id
  }
}

# PostgreSQL Database
resource "ibm_database" "postgresql" {
  name              = "my-postgres"
  plan              = "standard"
  location          = "us-south"
  service           = "databases-for-postgresql"
  resource_group_id = ibm_resource_group.rg.id
  version           = "15"

  adminpassword = var.postgres_password

  group {
    group_id = "member"
    memory {
      allocation_mb = 4096
    }
    disk {
      allocation_mb = 20480
    }
    cpu {
      allocation_count = 3
    }
  }

  service_endpoints = "private"
}

# Cloud Object Storage
resource "ibm_resource_instance" "cos" {
  name              = "my-cos"
  service           = "cloud-object-storage"
  plan              = "standard"
  location          = "global"
  resource_group_id = ibm_resource_group.rg.id
}

resource "ibm_cos_bucket" "bucket" {
  bucket_name          = "my-app-bucket"
  resource_instance_id = ibm_resource_instance.cos.id
  region_location      = "us-south"
  storage_class        = "smart"
}

# Outputs
output "cluster_id" {
  value = ibm_container_vpc_cluster.cluster.id
}

output "postgres_connection" {
  value     = ibm_database.postgresql.connectionstrings
  sensitive = true
}

output "cos_endpoint" {
  value = ibm_cos_bucket.bucket.s3_endpoint_public
}

State Management

# backend.tf - Remote state in COS
terraform {
  backend "s3" {
    bucket                      = "terraform-state"
    key                         = "prod/terraform.tfstate"
    region                      = "us-south"
    endpoint                    = "s3.us-south.cloud-object-storage.appdomain.cloud"
    skip_credentials_validation = true
    skip_region_validation      = true
  }
}

Terraform Commands

# Initialize
terraform init

# Plan
terraform plan -out=tfplan

# Apply
terraform apply tfplan

# Destroy
terraform destroy

# Import existing resource
terraform import ibm_is_vpc.vpc <VPC-ID>

# Show state
terraform show

# List resources
terraform state list

---

Schematics

Overview

Managed Terraform service for infrastructure as code.

Create Workspace

# Create workspace
ibmcloud schematics workspace new \
  --name my-workspace \
  --type terraform_v1.5 \
  --location us-south \
  --resource-group production-rg \
  --template-repo https://github.com/username/terraform-config \
  --template-repo-branch main

# Plan
ibmcloud schematics plan --id <WORKSPACE-ID>

# Apply
ibmcloud schematics apply --id <WORKSPACE-ID>

# Destroy
ibmcloud schematics destroy --id <WORKSPACE-ID>

Terraform Configuration:

# schematics.tf
terraform {
  backend "http" {
    address        = "https://schematics.cloud.ibm.com/v1/workspaces/<WORKSPACE-ID>/state"
    lock_address   = "https://schematics.cloud.ibm.com/v1/workspaces/<WORKSPACE-ID>/state"
    unlock_address = "https://schematics.cloud.ibm.com/v1/workspaces/<WORKSPACE-ID>/state"
  }
}

---

Resource Manager APIs

REST API Examples

Python:

import requests
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

# Authenticate
authenticator = IAMAuthenticator('<API-KEY>')
token = authenticator.token_manager.get_token()

# List resource instances
url = 'https://resource-controller.cloud.ibm.com/v2/resource_instances'
headers = {
    'Authorization': f'Bearer {token}',
    'Content-Type': 'application/json'
}

response = requests.get(url, headers=headers)
instances = response.json()['resources']

for instance in instances:
    print(f"{instance['name']}: {instance['state']}")

# Create resource instance
create_url = 'https://resource-controller.cloud.ibm.com/v2/resource_instances'
payload = {
    'name': 'my-cos-instance',
    'target': 'global',
    'resource_group': '<RESOURCE-GROUP-ID>',
    'resource_plan_id': '<PLAN-ID>'
}

response = requests.post(create_url, headers=headers, json=payload)
print(response.json())

---

CI/CD Integration

GitHub Actions

# .github/workflows/deploy.yml
name: Deploy to IBM Cloud

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v3
      
      - name: Install IBM Cloud CLI
        run: |
          curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
          ibmcloud plugin install container-service
          ibmcloud plugin install container-registry
      
      - name: Login to IBM Cloud
        run: |
          ibmcloud login --apikey ${{ secrets.IBMCLOUD_API_KEY }} -r us-south
          ibmcloud cr login
      
      - name: Build and Push Image
        run: |
          docker build -t us.icr.io/namespace/myapp:${{ github.sha }} .
          docker push us.icr.io/namespace/myapp:${{ github.sha }}
      
      - name: Deploy to Kubernetes
        run: |
          ibmcloud ks cluster config --cluster my-cluster
          kubectl set image deployment/myapp myapp=us.icr.io/namespace/myapp:${{ github.sha }}

GitLab CI

# .gitlab-ci.yml
stages:
  - build
  - deploy

variables:
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

build:
  stage: build
  script:
    - docker build -t $IMAGE_TAG .
    - docker push $IMAGE_TAG

deploy:
  stage: deploy
  script:
    - curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
    - ibmcloud plugin install code-engine
    - ibmcloud login --apikey $IBMCLOUD_API_KEY -r us-south
    - ibmcloud ce project select -n my-project
    - ibmcloud ce app update -n myapp --image $IMAGE_TAG
  only:
    - main

Terraform in CI/CD

# .github/workflows/terraform.yml
name: Terraform

on:
  push:
    branches: [main]
  pull_request:

jobs:
  terraform:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v3
      
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.5.0
      
      - name: Terraform Init
        run: terraform init
        env:
          TF_VAR_ibmcloud_api_key: ${{ secrets.IBMCLOUD_API_KEY }}
      
      - name: Terraform Plan
        run: terraform plan -out=tfplan
        env:
          TF_VAR_ibmcloud_api_key: ${{ secrets.IBMCLOUD_API_KEY }}
      
      - name: Terraform Apply
        if: github.ref == 'refs/heads/main'
        run: terraform apply -auto-approve tfplan
        env:
          TF_VAR_ibmcloud_api_key: ${{ secrets.IBMCLOUD_API_KEY }}

---

Best Practices

CLI Usage

1. API Keys: Use API keys, not passwords 2. Scripting: Set set -e for error handling 3. JSON Output: Parse with jq for automation 4. Version Pinning: Pin CLI and plugin versions 5. Region Awareness: Always specify region

Terraform

1. State Management: Use remote state (COS) 2. Modules: Create reusable modules 3. Variables: Externalize all configuration 4. Outputs: Export important resource IDs 5. Version Control: Track .tf files in Git 6. Plan Review: Always review plans before apply 7. State Locking: Enable for team collaboration

CI/CD

1. Secrets Management: Use CI/CD secrets, not hardcoded 2. Approval Gates: Require manual approval for production 3. Rollback: Implement automated rollback 4. Testing: Test infrastructure changes in dev first 5. Monitoring: Track deployment success rates

Compute Services

Table of Contents

• Virtual Private Cloud (VPC)
• Virtual Server Instances
• IBM Kubernetes Service (IKS)
• Red Hat OpenShift
• Code Engine
• Cloud Functions
• Bare Metal Servers

---

Virtual Private Cloud (VPC)

Overview

VPC provides isolated, software-defined network infrastructure in IBM Cloud with complete control over IP addressing, routing, security, and connectivity.

VPC Architecture

VPC (10.240.0.0/16)
├── Zone 1 (us-south-1)
│   ├── Subnet 1 (10.240.1.0/24) - Web Tier
│   └── Subnet 2 (10.240.2.0/24) - App Tier
├── Zone 2 (us-south-2)
│   ├── Subnet 3 (10.240.3.0/24) - Web Tier
│   └── Subnet 4 (10.240.4.0/24) - App Tier
└── Zone 3 (us-south-3)
    ├── Subnet 5 (10.240.5.0/24) - Web Tier
    └── Subnet 6 (10.240.6.0/24) - Database Tier

Create VPC

CLI:

# Create VPC
ibmcloud is vpc-create my-vpc \
  --resource-group-name my-rg \
  --address-prefix-management manual

# Add address prefix
ibmcloud is vpc-address-prefix-create my-vpc \
  us-south-1 vpc-prefix-1 10.240.1.0/24

# Create subnet
ibmcloud is subnet-create my-subnet-1 my-vpc \
  --ipv4-address-count 256 \
  --zone us-south-1 \
  --ipv4-cidr-block 10.240.1.0/24

# Create public gateway (for internet access)
ibmcloud is public-gateway-create my-pgw \
  my-vpc us-south-1

# Attach public gateway to subnet
ibmcloud is subnet-update my-subnet-1 \
  --public-gateway my-pgw

Terraform:

resource "ibm_is_vpc" "vpc" {
  name                      = "my-vpc"
  resource_group            = ibm_resource_group.rg.id
  address_prefix_management = "manual"
}

resource "ibm_is_vpc_address_prefix" "prefix" {
  name = "vpc-prefix-1"
  zone = "us-south-1"
  vpc  = ibm_is_vpc.vpc.id
  cidr = "10.240.1.0/24"
}

resource "ibm_is_subnet" "subnet" {
  name                     = "my-subnet-1"
  vpc                      = ibm_is_vpc.vpc.id
  zone                     = "us-south-1"
  ipv4_cidr_block          = "10.240.1.0/24"
  public_gateway           = ibm_is_public_gateway.pgw.id
  resource_group           = ibm_resource_group.rg.id
}

resource "ibm_is_public_gateway" "pgw" {
  name           = "my-pgw"
  vpc            = ibm_is_vpc.vpc.id
  zone           = "us-south-1"
  resource_group = ibm_resource_group.rg.id
}

Security Groups

# Create security group
ibmcloud is security-group-create my-sg my-vpc \
  --resource-group-name my-rg

# Allow SSH (port 22)
ibmcloud is security-group-rule-add my-sg inbound tcp \
  --port-min 22 --port-max 22 \
  --remote 0.0.0.0/0

# Allow HTTP (port 80)
ibmcloud is security-group-rule-add my-sg inbound tcp \
  --port-min 80 --port-max 80 \
  --remote 0.0.0.0/0

# Allow HTTPS (port 443)
ibmcloud is security-group-rule-add my-sg inbound tcp \
  --port-min 443 --port-max 443 \
  --remote 0.0.0.0/0

# Allow all outbound
ibmcloud is security-group-rule-add my-sg outbound all \
  --remote 0.0.0.0/0

Network ACLs

# Create network ACL
ibmcloud is network-acl-create my-acl my-vpc

# Add inbound rule (allow HTTP)
ibmcloud is network-acl-rule-add my-acl allow inbound all \
  0.0.0.0/0 80 80

# Add outbound rule (allow all)
ibmcloud is network-acl-rule-add my-acl allow outbound all \
  0.0.0.0/0

# Attach to subnet
ibmcloud is subnet-update my-subnet-1 --network-acl my-acl

---

Virtual Server Instances

Instance Profiles

Balanced Profiles (bx):

• bx2-2x8: 2 vCPU, 8GB RAM
• bx2-4x16: 4 vCPU, 16GB RAM
• bx2-8x32: 8 vCPU, 32GB RAM
• bx2-16x64: 16 vCPU, 64GB RAM

Compute Profiles (cx):

• cx2-2x4: 2 vCPU, 4GB RAM (CPU-optimized)
• cx2-4x8: 4 vCPU, 8GB RAM

Memory Profiles (mx):

• mx2-2x16: 2 vCPU, 16GB RAM (memory-optimized)
• mx2-4x32: 4 vCPU, 32GB RAM

Create Virtual Server

CLI:

# List available images
ibmcloud is images

# Create SSH key
ibmcloud is key-create my-ssh-key @~/.ssh/id_rsa.pub

# Create instance
ibmcloud is instance-create my-vsi my-vpc us-south-1 \
  bx2-2x8 my-subnet-1 \
  --image ibm-ubuntu-20-04-minimal-amd64-1 \
  --keys my-ssh-key \
  --security-groups my-sg \
  --resource-group-name my-rg

# Reserve floating IP
ibmcloud is floating-ip-reserve my-fip \
  --zone us-south-1

# Attach floating IP to instance
ibmcloud is instance-network-interface-floating-ip-add \
  my-vsi <NIC-ID> my-fip

# SSH to instance
ssh root@<FLOATING-IP>

Terraform:

resource "ibm_is_ssh_key" "ssh_key" {
  name       = "my-ssh-key"
  public_key = file("~/.ssh/id_rsa.pub")
}

resource "ibm_is_instance" "vsi" {
  name    = "my-vsi"
  image   = data.ibm_is_image.ubuntu.id
  profile = "bx2-2x8"
  vpc     = ibm_is_vpc.vpc.id
  zone    = "us-south-1"
  keys    = [ibm_is_ssh_key.ssh_key.id]

  primary_network_interface {
    name            = "eth0"
    subnet          = ibm_is_subnet.subnet.id
    security_groups = [ibm_is_security_group.sg.id]
  }

  boot_volume {
    name = "my-boot-volume"
  }

  resource_group = ibm_resource_group.rg.id
}

resource "ibm_is_floating_ip" "fip" {
  name   = "my-fip"
  target = ibm_is_instance.vsi.primary_network_interface[0].id
}

Instance Operations

# Start instance
ibmcloud is instance-start my-vsi

# Stop instance
ibmcloud is instance-stop my-vsi

# Reboot instance
ibmcloud is instance-reboot my-vsi

# Delete instance
ibmcloud is instance-delete my-vsi

# Get instance details
ibmcloud is instance my-vsi

# List instances
ibmcloud is instances

User Data / Cloud-init

# Create instance with user data
ibmcloud is instance-create my-vsi my-vpc us-south-1 \
  bx2-2x8 my-subnet-1 \
  --image ibm-ubuntu-20-04-minimal-amd64-1 \
  --keys my-ssh-key \
  --user-data @cloud-init.yaml

cloud-init.yaml:

#cloud-config
package_update: true
package_upgrade: true

packages:
  - nginx
  - docker.io
  - git

runcmd:
  - systemctl enable nginx
  - systemctl start nginx
  - usermod -aG docker ubuntu
  - echo "Hello from IBM Cloud" > /var/www/html/index.html

---

IBM Kubernetes Service (IKS)

Cluster Types

Free Cluster:

• 1 worker node (2 vCPU, 4GB RAM)
• Single zone
• 30-day expiration
• Good for testing

Standard Cluster:

• Multiple worker nodes
• Multi-zone for high availability
• Scalable
• Production-ready

Create IKS Cluster

CLI:

# List available zones
ibmcloud ks zones --provider vpc-gen2

# List available flavors
ibmcloud ks flavors --zone us-south-1 --provider vpc-gen2

# Create cluster
ibmcloud ks cluster create vpc-gen2 \
  --name my-cluster \
  --version 1.28 \
  --flavor bx2.4x16 \
  --workers 3 \
  --vpc-id <VPC-ID> \
  --subnet-id <SUBNET-ID> \
  --zone us-south-1 \
  --disable-public-service-endpoint

# Check cluster status
ibmcloud ks cluster get --cluster my-cluster

# Get cluster config
ibmcloud ks cluster config --cluster my-cluster

# Verify connection
kubectl get nodes

Multi-Zone Cluster:

# Create cluster in zone 1
ibmcloud ks cluster create vpc-gen2 \
  --name my-cluster \
  --flavor bx2.4x16 \
  --workers 2 \
  --vpc-id <VPC-ID> \
  --subnet-id <SUBNET-ID-ZONE-1> \
  --zone us-south-1

# Add zone 2
ibmcloud ks zone add vpc-gen2 \
  --cluster my-cluster \
  --subnet-id <SUBNET-ID-ZONE-2> \
  --zone us-south-2 \
  --worker-pool default

# Add zone 3
ibmcloud ks zone add vpc-gen2 \
  --cluster my-cluster \
  --subnet-id <SUBNET-ID-ZONE-3> \
  --zone us-south-3 \
  --worker-pool default

Terraform:

resource "ibm_container_vpc_cluster" "cluster" {
  name              = "my-cluster"
  vpc_id            = ibm_is_vpc.vpc.id
  flavor            = "bx2.4x16"
  worker_count      = 3
  kube_version      = "1.28"
  resource_group_id = ibm_resource_group.rg.id

  zones {
    name      = "us-south-1"
    subnet_id = ibm_is_subnet.subnet_1.id
  }

  zones {
    name      = "us-south-2"
    subnet_id = ibm_is_subnet.subnet_2.id
  }

  zones {
    name      = "us-south-3"
    subnet_id = ibm_is_subnet.subnet_3.id
  }

  disable_public_service_endpoint = false
}

Worker Pool Management

# List worker pools
ibmcloud ks worker-pool ls --cluster my-cluster

# Create new worker pool
ibmcloud ks worker-pool create vpc-gen2 \
  --name my-pool \
  --cluster my-cluster \
  --flavor bx2.8x32 \
  --size-per-zone 2

# Add zone to worker pool
ibmcloud ks zone add vpc-gen2 \
  --cluster my-cluster \
  --worker-pool my-pool \
  --subnet-id <SUBNET-ID> \
  --zone us-south-2

# Resize worker pool
ibmcloud ks worker-pool resize \
  --cluster my-cluster \
  --worker-pool my-pool \
  --size-per-zone 3

# Enable autoscaling
ibmcloud ks cluster autoscale set \
  --cluster my-cluster \
  --worker-pool my-pool \
  --min 2 --max 10 \
  --enable

Deploy Application

# Deploy nginx
kubectl create deployment nginx --image=nginx:latest

# Expose deployment
kubectl expose deployment nginx \
  --type=LoadBalancer \
  --port=80 \
  --target-port=80

# Get service details
kubectl get svc nginx

# Scale deployment
kubectl scale deployment nginx --replicas=3

# Update image
kubectl set image deployment/nginx nginx=nginx:1.21

Ingress Configuration

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "public-iks-k8s-nginx"
spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: my-tls-secret
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80

# Apply ingress
kubectl apply -f ingress.yaml

# Get ingress details
kubectl get ingress

---

Red Hat OpenShift

Create OpenShift Cluster

CLI:

# Create OpenShift cluster
ibmcloud oc cluster create vpc-gen2 \
  --name my-openshift-cluster \
  --version 4.12_openshift \
  --flavor bx2.4x16 \
  --workers 3 \
  --vpc-id <VPC-ID> \
  --subnet-id <SUBNET-ID> \
  --zone us-south-1

# Get cluster config
ibmcloud oc cluster config --cluster my-openshift-cluster

# Login to OpenShift
oc login

# Get cluster info
oc cluster-info

Deploy Application

# Create new project
oc new-project my-app

# Deploy from source code
oc new-app https://github.com/username/repo

# Expose service
oc expose svc/my-app

# Get route
oc get route

---

Code Engine

Overview

Serverless container platform that auto-scales applications and runs batch jobs.

Key Features:

• Auto-scaling from 0 to N instances
• Pay only for actual usage (CPU, memory, requests)
• Source-to-image builds
• Event-driven architecture
• Integrated with IBM Cloud services

Create Project

# Create Code Engine project
ibmcloud ce project create --name my-project

# Select project
ibmcloud ce project select --name my-project

# List projects
ibmcloud ce project list

Deploy Application

From Container Image:

# Deploy application
ibmcloud ce application create \
  --name my-app \
  --image us.icr.io/namespace/my-image:latest \
  --registry-secret my-registry-secret \
  --cpu 0.5 \
  --memory 1G \
  --min-scale 0 \
  --max-scale 10 \
  --port 8080 \
  --env KEY=value

# Get application URL
ibmcloud ce application get --name my-app

From Source Code:

# Build and deploy from Git
ibmcloud ce application create \
  --name my-app \
  --build-source https://github.com/username/repo \
  --build-context-dir /src \
  --strategy dockerfile \
  --dockerfile Dockerfile \
  --min-scale 0 \
  --max-scale 10

# Check build status
ibmcloud ce buildrun list

Environment Variables and Secrets

# Create secret
ibmcloud ce secret create --name my-secret \
  --from-literal DB_PASSWORD=mysecretpassword

# Create configmap
ibmcloud ce configmap create --name my-config \
  --from-literal API_URL=https://api.example.com

# Update application with secrets
ibmcloud ce application update --name my-app \
  --env-from-secret my-secret \
  --env-from-configmap my-config

Batch Jobs

# Create job
ibmcloud ce job create \
  --name my-batch-job \
  --image us.icr.io/namespace/batch-processor:latest \
  --cpu 2 \
  --memory 4G \
  --env-from-secret my-secret

# Run job
ibmcloud ce jobrun submit --job my-batch-job

# Check job status
ibmcloud ce jobrun list

# Get job logs
ibmcloud ce jobrun logs --name my-batch-job-run-1

Event Subscriptions

# Subscribe to Object Storage events
ibmcloud ce subscription cos create \
  --name cos-sub \
  --destination my-app \
  --bucket my-bucket \
  --event-type write

# Subscribe to periodic timer (cron)
ibmcloud ce subscription cron create \
  --name timer-sub \
  --destination my-app \
  --schedule "0 */6 * * *" \
  --data '{"message": "Scheduled execution"}'

---

Cloud Functions

Overview

Serverless FaaS platform based on Apache OpenWhisk.

Supported Runtimes:

• Node.js (12, 14, 16, 18)
• Python (3.9, 3.10, 3.11)
• Go (1.17, 1.19)
• PHP (7.4, 8.0)
• Java (8, 11)
• Ruby (2.5)
• .NET Core (3.1)

Create Function

Node.js Example:

// hello.js
function main(params) {
  const name = params.name || 'World';
  return { message: `Hello, ${name}!` };
}

module.exports.main = main;

Deploy:

# Create function
ibmcloud fn action create hello hello.js \
  --kind nodejs:18 \
  --web true

# Invoke function
ibmcloud fn action invoke hello --result \
  --param name "IBM Cloud"

# Get function URL
ibmcloud fn action get hello --url

Python Example:

# handler.py
def main(params):
    name = params.get('name', 'World')
    return {'message': f'Hello, {name}!'}

# Deploy Python function
ibmcloud fn action create hello handler.py \
  --kind python:3.11 \
  --web true

Sequences

# Create sequence of actions
ibmcloud fn action create mySequence \
  --sequence action1,action2,action3

# Invoke sequence
ibmcloud fn action invoke mySequence --result

Triggers and Rules

# Create trigger
ibmcloud fn trigger create myTrigger

# Create rule (connect trigger to action)
ibmcloud fn rule create myRule myTrigger hello

# Fire trigger
ibmcloud fn trigger fire myTrigger --param name "Triggered"

Web Actions

# Create web action
ibmcloud fn action create webHello hello.js \
  --web true \
  --web-secure <SECRET>

# Get web action URL
ibmcloud fn action get webHello --url

# Access via HTTP
curl https://<REGION>.functions.cloud.ibm.com/api/v1/web/<NAMESPACE>/default/webHello?name=User

---

Bare Metal Servers

Overview

Dedicated physical servers for high-performance workloads.

Use Cases:

• High-performance computing (HPC)
• Database servers requiring sustained I/O
• Compliance requirements (no virtualization)
• GPU-accelerated workloads

Server Profiles

Compute:

• md2-32x192x2-100gb: 32 cores, 192GB RAM, 2x100GB network

Balanced:

• md3-8x100x100gb: 8 cores, 100GB RAM

Memory:

• mr3-16x256x100gb: 16 cores, 256GB RAM

GPU:

• mgp2-48x384x4-100gb: 48 cores, 384GB RAM, 4x NVIDIA V100

Provision Bare Metal

# List profiles
ibmcloud is bare-metal-server-profiles

# Create bare metal server
ibmcloud is bare-metal-server-create \
  --name my-bm-server \
  --zone us-south-1 \
  --profile md2-32x192x2-100gb \
  --image ibm-ubuntu-20-04-minimal-amd64-1 \
  --keys my-ssh-key \
  --pnic-subnet <SUBNET-ID> \
  --vpc <VPC-ID>

---

Best Practices

High Availability

1. Multi-Zone Deployment: Deploy across 3 availability zones 2. Load Balancing: Use Application Load Balancer (ALB) 3. Auto-Scaling: Configure horizontal pod autoscaler (HPA) 4. Health Checks: Implement liveness and readiness probes 5. Circuit Breakers: Use service mesh (Istio) for resilience

Security

1. Private Endpoints: Disable public service endpoints 2. Network Policies: Restrict pod-to-pod communication 3. RBAC: Implement role-based access control 4. Image Scanning: Scan container images for vulnerabilities 5. Secrets Management: Use Secrets Manager, not env vars

Performance

1. Right-Sizing: Choose appropriate instance/pod sizes 2. Resource Limits: Set CPU/memory requests and limits 3. Caching: Use Redis/Memcached for session/data caching 4. CDN: Serve static assets via Cloud Internet Services 5. Monitoring: Track metrics with Cloud Monitoring

Cost Optimization

1. Reserved Capacity: Commit to reserved instances 2. Spot Instances: Use for fault-tolerant workloads 3. Auto-Scaling: Scale down during low usage 4. Serverless: Use Code Engine/Functions for variable load 5. Storage Tiers: Use appropriate Object Storage classes

Database Services

Table of Contents

• Db2 on Cloud
• Cloudant (NoSQL)
• Databases for PostgreSQL
• Databases for MySQL
• Databases for MongoDB
• Databases for Redis
• Databases for Elasticsearch
• Database Migration

---

Db2 on Cloud

Overview

Enterprise-grade relational database with high availability, automatic scaling, and AI-powered optimization.

Use Cases:

• Enterprise applications
• Data warehousing
• OLTP workloads
• Analytics and reporting

Plans

• Lite: Free tier for testing
• Standard: Production workloads
• Enterprise: High availability, disaster recovery

Provision Db2

CLI:

# Create Db2 instance
ibmcloud resource service-instance-create my-db2 \
  dashdb-for-transactions standard us-south \
  -p '{"members_memory_allocation_mb": "8192",
       "members_disk_allocation_mb": "20480",
       "members_cpu_allocation_count": "3"}'

# Create credentials
ibmcloud resource service-key-create my-db2-creds \
  Manager --instance-name my-db2

# Get connection details
ibmcloud resource service-key my-db2-creds

Terraform:

resource "ibm_database" "db2" {
  name              = "my-db2"
  plan              = "standard"
  location          = "us-south"
  service           = "dashdb-for-transactions"
  resource_group_id = ibm_resource_group.rg.id

  adminpassword = var.db2_admin_password

  group {
    group_id = "member"
    memory {
      allocation_mb = 8192
    }
    disk {
      allocation_mb = 20480
    }
    cpu {
      allocation_count = 3
    }
  }

  backup_id = var.backup_id
}

Connect to Db2

JDBC Connection:

import java.sql.*;

public class Db2Connection {
    public static void main(String[] args) {
        String jdbcUrl = "jdbc:db2://<HOST>:<PORT>/<DATABASE>:sslConnection=true;";
        String username = "<USERNAME>";
        String password = "<PASSWORD>";

        try (Connection conn = DriverManager.getConnection(jdbcUrl, username, password)) {
            System.out.println("Connected to Db2");
            
            Statement stmt = conn.createStatement();
            ResultSet rs = stmt.executeQuery("SELECT * FROM USERS");
            
            while (rs.next()) {
                System.out.println(rs.getString("name"));
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}

Python Connection:

import ibm_db

# Connection string
conn_str = (
    f"DATABASE=<DATABASE>;"
    f"HOSTNAME=<HOST>;"
    f"PORT=<PORT>;"
    f"PROTOCOL=TCPIP;"
    f"UID=<USERNAME>;"
    f"PWD=<PASSWORD>;"
    f"Security=SSL;"
)

# Connect
conn = ibm_db.connect(conn_str, "", "")

# Execute query
stmt = ibm_db.exec_immediate(conn, "SELECT * FROM USERS")
result = ibm_db.fetch_assoc(stmt)

while result:
    print(result['NAME'])
    result = ibm_db.fetch_assoc(stmt)

# Close connection
ibm_db.close(conn)

---

Cloudant (NoSQL)

Overview

Fully managed NoSQL JSON database based on Apache CouchDB with HTTP API.

Use Cases:

• Mobile and web apps
• IoT data storage
• Session management
• Document storage

Provision Cloudant

CLI:

# Create Cloudant instance
ibmcloud resource service-instance-create my-cloudant \
  cloudantnosqldb standard us-south \
  -p '{"legacyCredentials": false}'

# Create credentials
ibmcloud resource service-key-create my-cloudant-creds \
  Manager --instance-name my-cloudant

# Get connection URL
ibmcloud resource service-key my-cloudant-creds

Terraform:

resource "ibm_cloudant" "cloudant" {
  name              = "my-cloudant"
  plan              = "standard"
  location          = "us-south"
  resource_group_id = ibm_resource_group.rg.id
  
  capacity = 1
  enable_cors = true
  
  cors_config {
    allow_credentials = true
    origins           = ["https://example.com"]
  }
}

CRUD Operations

Node.js:

const { CloudantV1 } = require('@ibm-cloud/cloudant');
const { IamAuthenticator } = require('ibm-cloud-sdk-core');

const authenticator = new IamAuthenticator({
  apikey: '<API-KEY>',
});

const cloudant = CloudantV1.newInstance({
  authenticator: authenticator,
});
cloudant.setServiceUrl('<SERVICE-URL>');

// Create database
await cloudant.putDatabase({ db: 'mydb' });

// Create document
const document = {
  _id: 'user1',
  name: 'John Doe',
  email: 'john@example.com',
  age: 30
};
await cloudant.postDocument({
  db: 'mydb',
  document: document
});

// Read document
const { result } = await cloudant.getDocument({
  db: 'mydb',
  docId: 'user1'
});
console.log(result);

// Update document
result.age = 31;
await cloudant.postDocument({
  db: 'mydb',
  document: result
});

// Delete document
await cloudant.deleteDocument({
  db: 'mydb',
  docId: 'user1',
  rev: result._rev
});

// Query with selector
const { result: queryResult } = await cloudant.postFind({
  db: 'mydb',
  selector: { age: { '$gt': 25 } },
  fields: ['name', 'email', 'age'],
  sort: [{ age: 'asc' }]
});
console.log(queryResult.docs);

Python:

from ibmcloudant.cloudant_v1 import CloudantV1
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

authenticator = IAMAuthenticator('<API-KEY>')
service = CloudantV1(authenticator=authenticator)
service.set_service_url('<SERVICE-URL>')

# Create database
service.put_database(db='mydb').get_result()

# Create document
document = {
    '_id': 'user1',
    'name': 'John Doe',
    'email': 'john@example.com',
    'age': 30
}
service.post_document(db='mydb', document=document).get_result()

# Read document
result = service.get_document(db='mydb', doc_id='user1').get_result()
print(result)

# Query
query_result = service.post_find(
    db='mydb',
    selector={'age': {'$gt': 25}},
    fields=['name', 'email', 'age'],
    sort=[{'age': 'asc'}]
).get_result()
print(query_result['docs'])

Indexes and Views

Create Index:

// Create index for fast queries
await cloudant.postIndex({
  db: 'mydb',
  index: {
    fields: ['age', 'name']
  },
  name: 'age-name-index',
  type: 'json'
});

MapReduce View:

// Create design document with view
const designDoc = {
  _id: '_design/users',
  views: {
    by_age: {
      map: function(doc) {
        if (doc.age) {
          emit(doc.age, doc.name);
        }
      }.toString(),
      reduce: '_count'
    }
  }
};

await cloudant.postDocument({
  db: 'mydb',
  document: designDoc
});

// Query view
const { result } = await cloudant.postView({
  db: 'mydb',
  ddoc: 'users',
  view: 'by_age',
  group: true
});
console.log(result.rows);

---

Databases for PostgreSQL

Provision PostgreSQL

CLI:

# Create PostgreSQL instance
ibmcloud resource service-instance-create my-postgres \
  databases-for-postgresql standard us-south \
  -p '{"members_memory_allocation_mb": "4096",
       "members_disk_allocation_mb": "20480",
       "members_cpu_allocation_count": "3",
       "version": "15"}'

# Create credentials
ibmcloud resource service-key-create my-postgres-creds \
  Manager --instance-name my-postgres

# Get connection string
ibmcloud resource service-key my-postgres-creds

Terraform:

resource "ibm_database" "postgresql" {
  name              = "my-postgres"
  plan              = "standard"
  location          = "us-south"
  service           = "databases-for-postgresql"
  resource_group_id = ibm_resource_group.rg.id
  
  adminpassword = var.postgres_password
  version       = "15"

  group {
    group_id = "member"
    memory {
      allocation_mb = 4096
    }
    disk {
      allocation_mb = 20480
    }
    cpu {
      allocation_count = 3
    }
  }

  backup_id                     = var.backup_id
  backup_encryption_key_crn     = ibm_kms_key.key.crn
  point_in_time_recovery_deployment_id = var.pitr_id
  point_in_time_recovery_time          = var.pitr_time
}

Connect to PostgreSQL

Python:

import psycopg2

# Connection parameters
conn_params = {
    'host': '<HOST>',
    'port': 32541,
    'database': 'ibmclouddb',
    'user': 'admin',
    'password': '<PASSWORD>',
    'sslmode': 'require'
}

# Connect
conn = psycopg2.connect(**conn_params)
cur = conn.cursor()

# Create table
cur.execute('''
    CREATE TABLE IF NOT EXISTS users (
        id SERIAL PRIMARY KEY,
        name VARCHAR(100),
        email VARCHAR(100) UNIQUE,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )
''')

# Insert data
cur.execute(
    "INSERT INTO users (name, email) VALUES (%s, %s)",
    ('John Doe', 'john@example.com')
)

# Query data
cur.execute("SELECT * FROM users")
for row in cur.fetchall():
    print(row)

# Commit and close
conn.commit()
cur.close()
conn.close()

Scaling and Backups

# Scale resources
ibmcloud resource service-instance-update my-postgres \
  -p '{"members_memory_allocation_mb": "8192",
       "members_disk_allocation_mb": "40960"}'

# Create on-demand backup
ibmcloud cdb deployment-backups-create <DEPLOYMENT-ID>

# List backups
ibmcloud cdb deployment-backups-list <DEPLOYMENT-ID>

# Restore from backup
ibmcloud resource service-instance-create restored-postgres \
  databases-for-postgresql standard us-south \
  -p '{"backup_id": "<BACKUP-ID>"}'

# Point-in-time recovery
ibmcloud resource service-instance-create pitr-postgres \
  databases-for-postgresql standard us-south \
  -p '{"point_in_time_recovery_deployment_id": "<DEPLOYMENT-ID>",
       "point_in_time_recovery_time": "2024-01-15T12:00:00Z"}'

---

Databases for MySQL

Provision MySQL

# Create MySQL instance
ibmcloud resource service-instance-create my-mysql \
  databases-for-mysql standard us-south \
  -p '{"members_memory_allocation_mb": "4096",
       "members_disk_allocation_mb": "20480",
       "members_cpu_allocation_count": "3",
       "version": "8.0"}'

Connect to MySQL

Python:

import mysql.connector

# Connect
conn = mysql.connector.connect(
    host='<HOST>',
    port=32542,
    user='admin',
    password='<PASSWORD>',
    database='ibmclouddb',
    ssl_ca='<CA-CERT-PATH>',
    ssl_verify_cert=True
)

cursor = conn.cursor()

# Create table
cursor.execute('''
    CREATE TABLE IF NOT EXISTS products (
        id INT AUTO_INCREMENT PRIMARY KEY,
        name VARCHAR(100),
        price DECIMAL(10, 2),
        stock INT
    )
''')

# Insert data
cursor.execute(
    "INSERT INTO products (name, price, stock) VALUES (%s, %s, %s)",
    ('Widget', 19.99, 100)
)

# Query
cursor.execute("SELECT * FROM products")
for row in cursor.fetchall():
    print(row)

conn.commit()
cursor.close()
conn.close()

---

Databases for MongoDB

Provision MongoDB

# Create MongoDB instance
ibmcloud resource service-instance-create my-mongodb \
  databases-for-mongodb standard us-south \
  -p '{"members_memory_allocation_mb": "4096",
       "members_disk_allocation_mb": "20480",
       "members_cpu_allocation_count": "3",
       "version": "6.0"}'

Connect to MongoDB

Python:

from pymongo import MongoClient

# Connection string
uri = "mongodb://admin:<PASSWORD>@<HOST>:<PORT>/ibmclouddb?authSource=admin&replicaSet=replset&tls=true&tlsCAFile=<CA-CERT-PATH>"

# Connect
client = MongoClient(uri)
db = client['ibmclouddb']
collection = db['users']

# Insert document
user = {
    'name': 'John Doe',
    'email': 'john@example.com',
    'age': 30,
    'tags': ['developer', 'python']
}
result = collection.insert_one(user)
print(f'Inserted ID: {result.inserted_id}')

# Find documents
for doc in collection.find({'age': {'$gt': 25}}):
    print(doc)

# Update document
collection.update_one(
    {'email': 'john@example.com'},
    {'$set': {'age': 31}}
)

# Delete document
collection.delete_one({'email': 'john@example.com'})

client.close()

---

Databases for Redis

Provision Redis

# Create Redis instance
ibmcloud resource service-instance-create my-redis \
  databases-for-redis standard us-south \
  -p '{"members_memory_allocation_mb": "2048",
       "members_disk_allocation_mb": "10240",
       "members_cpu_allocation_count": "3",
       "version": "7.0"}'

Connect to Redis

Python:

import redis

# Connect
r = redis.Redis(
    host='<HOST>',
    port=32543,
    password='<PASSWORD>',
    ssl=True,
    ssl_ca_certs='<CA-CERT-PATH>',
    decode_responses=True
)

# String operations
r.set('user:1:name', 'John Doe')
print(r.get('user:1:name'))

# Hash operations
r.hset('user:1', mapping={
    'name': 'John Doe',
    'email': 'john@example.com',
    'age': 30
})
print(r.hgetall('user:1'))

# List operations
r.lpush('tasks', 'task1', 'task2', 'task3')
print(r.lrange('tasks', 0, -1))

# Set operations
r.sadd('tags', 'python', 'redis', 'database')
print(r.smembers('tags'))

# Sorted set operations
r.zadd('leaderboard', {'player1': 100, 'player2': 200, 'player3': 150})
print(r.zrange('leaderboard', 0, -1, withscores=True))

# Expiration
r.setex('session:abc123', 3600, 'user_data')

# Pub/Sub
pubsub = r.pubsub()
pubsub.subscribe('channel1')

# Publish
r.publish('channel1', 'Hello, Redis!')

---

Databases for Elasticsearch

Provision Elasticsearch

# Create Elasticsearch instance
ibmcloud resource service-instance-create my-elasticsearch \
  databases-for-elasticsearch standard us-south \
  -p '{"members_memory_allocation_mb": "4096",
       "members_disk_allocation_mb": "20480",
       "members_cpu_allocation_count": "3",
       "version": "8.7"}'

Connect to Elasticsearch

Python:

from elasticsearch import Elasticsearch

# Connect
es = Elasticsearch(
    ['https://<HOST>:<PORT>'],
    basic_auth=('admin', '<PASSWORD>'),
    ca_certs='<CA-CERT-PATH>',
    verify_certs=True
)

# Index document
doc = {
    'title': 'Introduction to Elasticsearch',
    'author': 'John Doe',
    'content': 'Elasticsearch is a powerful search engine...',
    'tags': ['search', 'elasticsearch', 'database'],
    'published_at': '2024-01-15'
}
es.index(index='articles', id=1, document=doc)

# Search documents
query = {
    'query': {
        'match': {
            'content': 'search engine'
        }
    }
}
results = es.search(index='articles', body=query)
for hit in results['hits']['hits']:
    print(hit['_source'])

# Aggregation
agg_query = {
    'aggs': {
        'tags_count': {
            'terms': {
                'field': 'tags.keyword'
            }
        }
    }
}
agg_results = es.search(index='articles', body=agg_query, size=0)
print(agg_results['aggregations'])

---

Database Migration

From On-Premises to IBM Cloud

PostgreSQL Migration:

# Dump on-premises database
pg_dump -h localhost -U postgres -d mydb > mydb_dump.sql

# Upload to COS
ibmcloud cos object-put --bucket backups \
  --key postgres/mydb_dump.sql --body mydb_dump.sql

# Download on IBM Cloud instance
ibmcloud cos object-get --bucket backups \
  --key postgres/mydb_dump.sql mydb_dump.sql

# Restore to IBM Cloud PostgreSQL
psql -h <IBM-CLOUD-HOST> -U admin -d ibmclouddb < mydb_dump.sql

MongoDB Migration:

# Dump on-premises MongoDB
mongodump --host localhost --db mydb --out /tmp/mongodump

# Upload to COS
ibmcloud cos object-put --bucket backups \
  --key mongodb/mydb.tar.gz \
  --body /tmp/mongodump.tar.gz

# Restore to IBM Cloud MongoDB
mongorestore --host <IBM-CLOUD-HOST> \
  --username admin --password <PASSWORD> \
  --db ibmclouddb /tmp/mongodump/mydb

Database Replication

PostgreSQL Logical Replication:

-- On source database
CREATE PUBLICATION my_pub FOR ALL TABLES;

-- On IBM Cloud PostgreSQL
CREATE SUBSCRIPTION my_sub 
  CONNECTION 'host=<SOURCE-HOST> dbname=mydb user=repl_user password=<PASSWORD>'
  PUBLICATION my_pub;

---

Best Practices

High Availability

1. Multi-Zone Deployment: Deploy across 3 availability zones 2. Read Replicas: Create read replicas for scalability 3. Connection Pooling: Use PgBouncer for PostgreSQL 4. Health Monitoring: Track database metrics 5. Failover Testing: Regular DR drills

Security

1. Private Endpoints: Use private service endpoints 2. Encryption: Enable encryption at rest and in transit 3. IAM Authentication: Use IAM for database access 4. Network Isolation: Deploy in VPC with security groups 5. Audit Logging: Enable activity tracking

Performance

1. Indexing: Create appropriate indexes 2. Query Optimization: Analyze slow queries 3. Resource Sizing: Right-size CPU, memory, disk 4. Caching: Use Redis for session/data caching 5. Connection Management: Limit max connections

Backup & Recovery

1. Automated Backups: Daily automatic backups (30-day retention) 2. Point-in-Time Recovery: Enable PITR for critical databases 3. Test Restores: Regular backup restoration tests 4. Cross-Region Backup: Replicate backups to DR region 5. Backup Monitoring: Alert on backup failures

IAM & Security

Table of Contents

• Identity and Access Management (IAM)
• Resource Groups and Access Groups
• Service IDs and API Keys
• Key Protect
• Secrets Manager
• Security and Compliance Center
• Activity Tracker

---

Identity and Access Management (IAM)

Overview

IAM provides centralized access control for IBM Cloud resources through policies, roles, and access groups.

Core Concepts:

• Users: Human identities (IBMid, AppID)
• Service IDs: Application identities
• Access Groups: Group users/service IDs for policy assignment
• Policies: Grant specific roles on specific resources
• Roles: Predefined permission sets

IAM Roles

Platform Roles:

• Viewer: Read-only access, view resources
• Operator: Perform actions (start/stop), no modify
• Editor: Modify resources, create/delete
• Administrator: Full control, assign access to others

Service Roles:

• Reader: Read service data
• Writer: Write service data
• Manager: Full service management

Custom Roles (Enterprise plans):

• Define custom permissions

Assign Access

Via CLI:

# Assign platform role
ibmcloud iam user-policy-create user@example.com \
  --roles Viewer,Operator \
  --resource-group-name my-rg

# Assign service role
ibmcloud iam user-policy-create user@example.com \
  --roles Reader,Writer \
  --service-name cloud-object-storage \
  --service-instance <COS-INSTANCE-ID>

# Assign specific resource access
ibmcloud iam user-policy-create user@example.com \
  --roles Editor \
  --service-name is \
  --resource-type vpc \
  --resource <VPC-ID>

# List user policies
ibmcloud iam user-policies user@example.com

Terraform:

# IAM policy for user
resource "ibm_iam_user_policy" "policy" {
  ibm_id = "user@example.com"
  roles  = ["Viewer", "Operator"]

  resources {
    resource_group_id = ibm_resource_group.rg.id
  }
}

# IAM policy for specific service
resource "ibm_iam_user_policy" "cos_policy" {
  ibm_id = "user@example.com"
  roles  = ["Reader", "Writer"]

  resources {
    service              = "cloud-object-storage"
    resource_instance_id = ibm_resource_instance.cos.guid
  }
}

Policy Examples

Grant Full Access to Resource Group:

ibmcloud iam user-policy-create user@example.com \
  --roles Administrator,Manager \
  --resource-group-name production-rg

Grant Kubernetes Cluster Access:

ibmcloud iam user-policy-create user@example.com \
  --service-name containers-kubernetes \
  --service-instance <CLUSTER-ID> \
  --roles Administrator,Manager

Grant COS Bucket Access:

ibmcloud iam user-policy-create user@example.com \
  --service-name cloud-object-storage \
  --service-instance <COS-INSTANCE-ID> \
  --resource-type bucket \
  --resource my-bucket \
  --roles Reader,ContentReader

---

Resource Groups and Access Groups

Resource Groups

Organizational units for resources. Cannot be nested.

# Create resource group
ibmcloud resource group-create production-rg

# List resource groups
ibmcloud resource groups

# Target resource group
ibmcloud target -g production-rg

Best Practices:

• Organize by environment (dev, staging, prod)
• Or by application/project
• Or by department/team
• Plan before creating (cannot easily move resources)

Access Groups

Group users and service IDs for policy assignment.

CLI:

# Create access group
ibmcloud iam access-group-create Developers \
  -d "Developer team members"

# Add user to access group
ibmcloud iam access-group-user-add Developers user@example.com

# Add service ID to access group
ibmcloud iam access-group-service-id-add Developers ServiceId-123

# Assign policy to access group
ibmcloud iam access-group-policy-create Developers \
  --roles Editor,Writer \
  --resource-group-name production-rg

# List access groups
ibmcloud iam access-groups

Terraform:

# Create access group
resource "ibm_iam_access_group" "developers" {
  name        = "Developers"
  description = "Developer team members"
}

# Add users
resource "ibm_iam_access_group_members" "dev_members" {
  access_group_id = ibm_iam_access_group.developers.id
  ibm_ids         = ["user1@example.com", "user2@example.com"]
}

# Assign policy
resource "ibm_iam_access_group_policy" "dev_policy" {
  access_group_id = ibm_iam_access_group.developers.id
  roles           = ["Editor", "Writer"]

  resources {
    resource_group_id = ibm_resource_group.prod_rg.id
  }
}

Example Access Groups:

• Administrators: Full platform and service access
• Developers: Editor + Writer on dev/staging
• Operators: Operator on production resources
• Viewers: Viewer on all resources
• Billing Admins: Billing management only

---

Service IDs and API Keys

Service IDs

Non-human identities for applications and services.

CLI:

# Create service ID
ibmcloud iam service-id-create my-app-id \
  -d "Service ID for my application"

# Create API key for service ID
ibmcloud iam service-api-key-create my-app-key ServiceId-123 \
  -d "API key for production deployment"

# Assign policy to service ID
ibmcloud iam service-policy-create ServiceId-123 \
  --roles Writer \
  --service-name cloud-object-storage \
  --service-instance <COS-INSTANCE-ID>

# List service IDs
ibmcloud iam service-ids

Terraform:

# Create service ID
resource "ibm_iam_service_id" "app_id" {
  name        = "my-app-id"
  description = "Service ID for my application"
}

# Create API key
resource "ibm_iam_service_api_key" "app_key" {
  name           = "my-app-key"
  iam_service_id = ibm_iam_service_id.app_id.iam_id
  description    = "API key for production"
}

# Assign policy
resource "ibm_iam_service_policy" "app_policy" {
  iam_service_id = ibm_iam_service_id.app_id.iam_id
  roles          = ["Writer", "Manager"]

  resources {
    service              = "cloud-object-storage"
    resource_instance_id = ibm_resource_instance.cos.guid
  }
}

API Keys

User API Keys:

# Create user API key
ibmcloud iam api-key-create my-api-key \
  -d "Personal API key for CLI access"

# List API keys
ibmcloud iam api-keys

# Delete API key
ibmcloud iam api-key-delete my-api-key

Authenticate with API Key:

# CLI login with API key
ibmcloud login --apikey @api-key.txt

# Or with environment variable
export IBMCLOUD_API_KEY="<API-KEY>"
ibmcloud login --no-region

Best Practices:

• Rotate API keys every 90 days
• Use service IDs for applications
• Store keys in Secrets Manager
• Never commit keys to version control
• Use least privilege principle
• Monitor API key usage with Activity Tracker

---

Key Protect

Overview

FIPS 140-2 Level 3 certified key management service for encryption keys.

Use Cases:

• Encrypt data at rest (COS, databases, volumes)
• Bring Your Own Key (BYOK)
• Keep Your Own Key (KYOK) with Hyper Protect Crypto Services
• Envelope encryption

Create Key Protect Instance

CLI:

# Create Key Protect instance
ibmcloud resource service-instance-create my-key-protect \
  kms tiered-pricing us-south

# Create root key
ibmcloud kp key create my-root-key \
  --instance-id <KP-INSTANCE-ID> \
  --key-material <BASE64-KEY-MATERIAL>

# Create standard key
ibmcloud kp key create my-standard-key \
  --instance-id <KP-INSTANCE-ID> \
  --standard-key

# List keys
ibmcloud kp keys --instance-id <KP-INSTANCE-ID>

Terraform:

resource "ibm_resource_instance" "key_protect" {
  name              = "my-key-protect"
  service           = "kms"
  plan              = "tiered-pricing"
  location          = "us-south"
  resource_group_id = ibm_resource_group.rg.id
}

resource "ibm_kms_key" "root_key" {
  instance_id  = ibm_resource_instance.key_protect.guid
  key_name     = "my-root-key"
  standard_key = false
  force_delete = true
}

resource "ibm_kms_key" "standard_key" {
  instance_id  = ibm_resource_instance.key_protect.guid
  key_name     = "my-standard-key"
  standard_key = true
}

Encrypt Resources

Cloud Object Storage:

resource "ibm_cos_bucket" "encrypted_bucket" {
  bucket_name          = "my-encrypted-bucket"
  resource_instance_id = ibm_resource_instance.cos.id
  region_location      = "us-south"
  storage_class        = "standard"
  
  kms_key_crn = ibm_kms_key.root_key.crn
}

Block Storage:

resource "ibm_is_volume" "encrypted_volume" {
  name           = "my-encrypted-volume"
  profile        = "10iops-tier"
  zone           = "us-south-1"
  capacity       = 100
  encryption_key = ibm_kms_key.root_key.crn
}

Database:

resource "ibm_database" "postgresql" {
  name              = "my-postgres"
  plan              = "standard"
  location          = "us-south"
  service           = "databases-for-postgresql"
  
  backup_encryption_key_crn = ibm_kms_key.root_key.crn
}

Key Rotation

# Rotate root key (creates new version)
ibmcloud kp key rotate <KEY-ID> \
  --instance-id <KP-INSTANCE-ID>

# Set rotation policy (automatic rotation)
ibmcloud kp key-policy-rotation-set <KEY-ID> \
  --instance-id <KP-INSTANCE-ID> \
  --interval-month 3

---

Secrets Manager

Overview

Centralized secrets management for API keys, passwords, certificates, and credentials.

Secret Types:

• Arbitrary (generic secrets)
• User credentials
• IAM credentials (automatic rotation)
• Certificates (Let's Encrypt, uploaded, imported)
• Key-value secrets

Create Secrets Manager Instance

CLI:

# Create Secrets Manager instance
ibmcloud resource service-instance-create my-secrets-manager \
  secrets-manager trial us-south

# Create secret group
ibmcloud secrets-manager secret-group-create \
  --name production-secrets \
  --description "Production environment secrets"

# Create arbitrary secret
ibmcloud secrets-manager secret-create \
  --secret-type arbitrary \
  --name db-password \
  --secret-group-id <GROUP-ID> \
  --payload "supersecretpassword"

# Get secret value
ibmcloud secrets-manager secret-get \
  --secret-type arbitrary \
  --id <SECRET-ID>

Terraform:

resource "ibm_resource_instance" "secrets_manager" {
  name              = "my-secrets-manager"
  service           = "secrets-manager"
  plan              = "standard"
  location          = "us-south"
  resource_group_id = ibm_resource_group.rg.id
}

resource "ibm_sm_secret_group" "group" {
  instance_id = ibm_resource_instance.secrets_manager.guid
  region      = "us-south"
  name        = "production-secrets"
  description = "Production secrets"
}

resource "ibm_sm_arbitrary_secret" "db_password" {
  instance_id  = ibm_resource_instance.secrets_manager.guid
  region       = "us-south"
  name         = "db-password"
  description  = "Database password"
  secret_group_id = ibm_sm_secret_group.group.secret_group_id
  payload      = "supersecretpassword"
  
  labels = ["production", "database"]
}

resource "ibm_sm_iam_credentials_secret" "iam_creds" {
  instance_id = ibm_resource_instance.secrets_manager.guid
  region      = "us-south"
  name        = "app-service-id"
  description = "Application service ID credentials"
  secret_group_id = ibm_sm_secret_group.group.secret_group_id
  service_id  = ibm_iam_service_id.app.iam_id
  ttl         = "7776000"  # 90 days
  reuse_api_key = false
}

Access Secrets in Applications

Python:

from ibm_secrets_manager_sdk.secrets_manager_v2 import *
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator

authenticator = IAMAuthenticator('<API-KEY>')
service = SecretsManagerV2(authenticator=authenticator)
service.set_service_url('<SECRETS-MANAGER-URL>')

# Get secret
secret = service.get_secret(
    id='<SECRET-ID>',
    secret_type='arbitrary'
).get_result()

db_password = secret['payload']
print(f"Password: {db_password}")

Node.js:

const SecretsManagerV2 = require('@ibm-cloud/secrets-manager/secrets-manager/v2');
const { IamAuthenticator } = require('@ibm-cloud/secrets-manager/auth');

const authenticator = new IamAuthenticator({
  apikey: '<API-KEY>',
});

const secretsManager = new SecretsManagerV2({
  authenticator: authenticator,
  serviceUrl: '<SECRETS-MANAGER-URL>',
});

const params = {
  id: '<SECRET-ID>',
  secretType: 'arbitrary',
};

secretsManager.getSecret(params)
  .then(res => {
    const password = res.result.payload;
    console.log(`Password: ${password}`);
  });

---

Security and Compliance Center

Overview

Unified security and compliance management across IBM Cloud.

Features:

• Security posture monitoring
• Compliance validation
• Configuration scanning
• Vulnerability assessment
• Compliance reporting

Create Security and Compliance Center

# Create SCC instance
ibmcloud resource service-instance-create my-scc \
  compliance standard us-south

# Attach scope (resource group)
ibmcloud scc scope-create \
  --name production-scope \
  --description "Production resources" \
  --environment ibm-cloud \
  --properties '{"scope_id": "<RESOURCE-GROUP-ID>"}'

# Create profile attachment
ibmcloud scc attachment-create \
  --profile-id <PROFILE-ID> \
  --scope-id <SCOPE-ID> \
  --name "CIS Benchmark"

Compliance Profiles

Available Profiles:

• CIS IBM Cloud Foundations Benchmark: 139 controls
• IBM Cloud Framework for Financial Services: 300+ controls
• NIST 800-53: Security controls
• PCI-DSS: Payment card industry
• HIPAA: Healthcare compliance
• ISO 27001: Information security

Scan and Monitor

# Run compliance scan
ibmcloud scc scan-create \
  --attachment-id <ATTACHMENT-ID>

# View scan results
ibmcloud scc scan-get <SCAN-ID>

# Generate compliance report
ibmcloud scc report-create \
  --attachment-id <ATTACHMENT-ID> \
  --type compliance

---

Activity Tracker

Overview

Audit trail for IBM Cloud account and resource activities.

Event Types:

• Account management
• IAM activities
• Resource lifecycle
• Data access
• Network events

Create Activity Tracker

# Create Activity Tracker instance
ibmcloud resource service-instance-create my-activity-tracker \
  logdnaat 7-day us-south

# Configure platform logs
ibmcloud at route create \
  --target-type logdna \
  --target-id <AT-INSTANCE-ID> \
  --target-region us-south

Terraform:

resource "ibm_resource_instance" "activity_tracker" {
  name              = "my-activity-tracker"
  service           = "logdnaat"
  plan              = "7-day"
  location          = "us-south"
  resource_group_id = ibm_resource_group.rg.id
}

View Events

# View activity logs (web console)
ibmcloud at view

# Export events
ibmcloud at export \
  --start "2024-01-01T00:00:00Z" \
  --end "2024-01-31T23:59:59Z" \
  --type json \
  --output events.json

Common Audit Queries

IAM Policy Changes:

action:iam-access-management.policy.*

Resource Creation:

action:*.create

Failed Login Attempts:

action:iam-identity.user-apikey.login outcome:failure

Data Access (COS):

target.typeURI:cloud-object-storage/bucket action:cloud-object-storage.object.read

---

Security Best Practices

Authentication

1. Enable MFA: Require MFA for all users 2. API Key Rotation: Rotate keys every 90 days 3. Service IDs: Use service IDs for applications 4. Strong Passwords: Enforce password complexity 5. Session Timeouts: Configure appropriate timeouts

Authorization

1. Least Privilege: Grant minimum required permissions 2. Access Groups: Use access groups for policy management 3. Resource Groups: Organize resources logically 4. Regular Audits: Review access policies quarterly 5. Just-in-Time Access: Temporary elevated access

Encryption

1. Encryption at Rest: Enable for all storage 2. Encryption in Transit: TLS 1.2+ only 3. Key Management: Use Key Protect/HPCS 4. Key Rotation: Rotate encryption keys annually 5. BYOK: Bring Your Own Key for sensitive data

Network Security

1. Private Endpoints: Use private connectivity 2. Security Groups: Restrict inbound/outbound traffic 3. Network ACLs: Subnet-level access control 4. VPN/Direct Link: Secure hybrid connectivity 5. WAF: Web Application Firewall for public apps

Monitoring and Compliance

1. Activity Tracker: Enable for all accounts 2. Security Center: Continuous compliance monitoring 3. Vulnerability Scanning: Regular security assessments 4. Incident Response: Document and test procedures 5. Compliance Reporting: Generate regular reports

Data Protection

1. Backup Strategy: Regular automated backups 2. Data Classification: Classify and label data 3. Data Retention: Define retention policies 4. Data Residency: Choose appropriate regions 5. DLP: Data loss prevention controls

Monitoring & Operations

Table of Contents

• Cloud Monitoring
• Log Analysis
• Activity Tracker
• Cost Management
• Incident Management
• Performance Optimization

---

Cloud Monitoring

Overview

Monitor metrics, set alerts, and visualize performance across IBM Cloud resources.

Create Monitoring Instance

# Create monitoring instance
ibmcloud resource service-instance-create my-monitoring \
  sysdig-monitor graduated-tier us-south

# Get monitoring key
ibmcloud resource service-key-create my-monitoring-key \
  Manager --instance-name my-monitoring

Configure Agents

Kubernetes:

# Get access key
MONITORING_KEY=$(ibmcloud resource service-key my-monitoring-key --output json | jq -r '.credentials.Sysdig Access Key')

# Install agent
kubectl create ns ibm-observe
kubectl create secret generic sysdig-agent \
  --from-literal=access-key=$MONITORING_KEY \
  -n ibm-observe

kubectl apply -f https://raw.githubusercontent.com/draios/sysdig-cloud-scripts/master/agent_deploy/kubernetes/sysdig-agent-daemonset-v2.yaml \
  -n ibm-observe

Virtual Server:

# Download and install agent
curl -sL https://ibm.biz/install-sysdig-agent | \
  sudo bash -s -- --access_key $MONITORING_KEY \
  --collector ingest.us-south.monitoring.cloud.ibm.com \
  --tags "env:prod,app:myapp"

Metrics and Dashboards

Key Metrics:

• CPU utilization
• Memory usage
• Disk I/O
• Network traffic
• Application response time
• Error rates

Create Alert:

# Via API
curl -X POST https://us-south.monitoring.cloud.ibm.com/api/alerts \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "alert": {
      "name": "High CPU Usage",
      "description": "CPU > 80% for 5 minutes",
      "severity": 4,
      "timespan": 300000000,
      "condition": "avg(cpu.used.percent) > 80",
      "enabled": true,
      "notificationChannelIds": ["<CHANNEL-ID>"]
    }
  }'

---

Log Analysis

Overview

Centralized logging with search, filtering, and analysis capabilities.

Create Log Analysis Instance

# Create log analysis instance
ibmcloud resource service-instance-create my-logs \
  logdna 7-day us-south

# Create service key
ibmcloud resource service-key-create my-logs-key \
  Manager --instance-name my-logs

Configure Log Sources

Kubernetes:

# Get ingestion key
LOGGING_KEY=$(ibmcloud resource service-key my-logs-key --output json | jq -r '.credentials."ingestion_key"')

# Install agent
kubectl create secret generic logdna-agent-key \
  --from-literal=logdna-agent-key=$LOGGING_KEY \
  -n ibm-observe

kubectl apply -f https://assets.us-south.logging.cloud.ibm.com/clients/logdna-agent-ds.yaml

Application Logging (Node.js):

const logger = require('@logdna/logger');

const log = logger.createLogger('<INGESTION-KEY>', {
  hostname: 'my-app',
  app: 'myapp',
  env: 'production',
  index_meta: true
});

log.log('Application started');
log.info('User logged in', { userId: 123 });
log.warn('High memory usage', { memory: '85%' });
log.error('Database connection failed', { error: err.message });

Log Queries

Search Examples:

# Find errors
level:error

# Filter by source
source:kubernetes

# Time range + filter
timestamp:[now-1h TO now] AND app:myapp AND level:error

# Multiple conditions
(status:500 OR status:502) AND host:prod-server

# Regex search
message:/user.*failed.*login/

Create Views and Alerts

# Via UI or API
# Create view for error logs
# Set alert for error rate > 10/min

---

Activity Tracker

Overview

Audit trail for account and resource management activities.

Configure Activity Tracker

# Create Activity Tracker instance
ibmcloud resource service-instance-create my-activity-tracker \
  logdnaat 7-day us-south

# Configure routing
ibmcloud at route create \
  --target-type logdna \
  --target-id <AT-INSTANCE-ID> \
  --target-region us-south

Common Audit Queries

IAM Changes:

action:iam-access-management.policy.*

Resource Creation:

action:*.create outcome:success

Failed Login Attempts:

action:iam-identity.user-apikey.login outcome:failure

Data Access (COS):

target.typeURI:cloud-object-storage/bucket action:cloud-object-storage.object.read

Database Changes:

target.typeURI:databases-for-postgresql action:databases-for-postgresql.*

---

Cost Management

View Costs

# View account usage
ibmcloud billing account-usage --output json

# View resource usage
ibmcloud billing resource-instances-usage \
  --start 2024-01 --end 2024-01

# View service usage
ibmcloud billing org-usage <ORG-ID> --month 2024-01

Cost Estimation

Terraform Cost Estimation:

# Using Infracost
infracost breakdown --path .

# Output
Project: myapp
 Name                                     Monthly Qty  Unit   Monthly Cost
 ibm_container_vpc_cluster.cluster
 ├─ Worker nodes (bx2.4x16)                         3  nodes       $360.00
 ├─ Public bandwidth                            1,000  GB           $87.00
 └─ Persistent volumes                            300  GB           $36.00
 
 ibm_database.postgresql
 ├─ Memory                                      4,096  MB          $150.00
 ├─ Disk                                       20,480  MB           $80.00
 └─ CPU                                             3  cores        $90.00

 OVERALL TOTAL                                                     $803.00

Budget Alerts

# Set spending threshold via UI
# Notifications sent when:
# - 80% of budget reached
# - 90% of budget reached
# - 100% of budget reached

Cost Optimization Tips

Compute:

• Use Code Engine/Functions for variable workloads
• Right-size virtual servers and worker nodes
• Use reserved instances for predictable workloads
• Enable auto-scaling
• Stop dev/test resources after hours

Storage:

• Use Smart Tier for Object Storage
• Delete unused snapshots
• Implement lifecycle policies
• Use appropriate storage classes

Database:

• Right-size CPU, memory, disk
• Use read replicas efficiently
• Delete old backups
• Monitor query performance

Network:

• Use private endpoints (free data transfer)
• Enable CDN caching
• Optimize Direct Link bandwidth

---

Incident Management

Incident Response Process

1. Detection:

• Monitoring alerts
• Log analysis
• User reports
• Health checks

2. Triage:

• Assess severity (P1-P4)
• Identify affected services
• Determine impact

3. Investigation:

• Check logs and metrics
• Review recent changes
• Analyze error patterns

4. Resolution:

• Apply fix
• Verify recovery
• Document root cause

5. Post-Mortem:

• Root cause analysis
• Action items
• Prevention measures

Severity Levels

P1 - Critical:

• Complete service outage
• Data loss
• Security breach
• Response: Immediate (24/7)

P2 - High:

• Significant degradation
• Partial outage
• Workaround available
• Response: < 1 hour

P3 - Medium:

• Minor impact
• Minimal users affected
• Response: < 4 hours

P4 - Low:

• Cosmetic issues
• Enhancement requests
• Response: Best effort

IBM Cloud Support

# Open support case
ibmcloud sl ticket create \
  --title "Database connection timeout" \
  --body "PostgreSQL database timing out after 30 seconds" \
  --priority 2

# List tickets
ibmcloud sl ticket list

# Update ticket
ibmcloud sl ticket update <TICKET-ID> \
  --body "Tried increasing connection pool, still failing"

---

Performance Optimization

Application Performance

Best Practices:

1. Caching: Use Redis for session/data caching 2. CDN: Serve static assets via Cloud Internet Services 3. Database: Optimize queries, add indexes 4. Connection Pooling: Reuse database connections 5. Async Processing: Use message queues for long tasks 6. Code Optimization: Profile and optimize hot paths 7. Compression: Enable gzip/brotli compression

Database Performance

PostgreSQL Optimization:

-- Analyze table statistics
ANALYZE users;

-- Create index
CREATE INDEX idx_users_email ON users(email);

-- Identify slow queries
SELECT query, mean_exec_time, calls
FROM pg_stat_statements
ORDER BY mean_exec_time DESC
LIMIT 10;

-- Optimize query
EXPLAIN ANALYZE SELECT * FROM users WHERE email = 'user@example.com';

Monitoring Performance

Key Metrics:

• Response time (p50, p95, p99)
• Throughput (requests/sec)
• Error rate
• CPU utilization
• Memory usage
• Database connections
• Cache hit rate

Set Performance Budgets:

• Page load: < 2 seconds
• API response: < 500ms
• Database query: < 100ms
• Cache hit rate: > 90%

---

Best Practices

Monitoring

1. Comprehensive Coverage: Monitor all critical components 2. Appropriate Alerts: Set thresholds to avoid alert fatigue 3. Dashboards: Create role-specific dashboards 4. SLOs/SLIs: Define and track service level objectives 5. On-Call: Maintain on-call rotation

Logging

1. Structured Logging: Use JSON format 2. Log Levels: Use appropriate levels (DEBUG, INFO, WARN, ERROR) 3. Context: Include request IDs, user IDs, timestamps 4. Retention: Define retention policies 5. Security: Sanitize sensitive data

Cost Management

1. Budget: Set and monitor budgets 2. Tagging: Tag resources for cost allocation 3. Right-Sizing: Regular resource optimization reviews 4. Reserved Capacity: Commit for predictable workloads 5. Monitoring: Track usage trends

Operations

1. Automation: Automate repetitive tasks 2. Documentation: Maintain runbooks 3. Disaster Recovery: Test DR procedures 4. Change Management: Track and review changes 5. Continuous Improvement: Regular retrospectives

Networking

Table of Contents

• VPC Networking
• Load Balancers
• Cloud Internet Services
• Direct Link
• Transit Gateway
• VPN

---

VPC Networking

Subnets and Routing

# Create subnet
ibmcloud is subnet-create my-subnet my-vpc \
  --ipv4-cidr-block 10.240.1.0/24 \
  --zone us-south-1

# Create routing table
ibmcloud is vpc-routing-table-create my-vpc \
  --name custom-routes

# Add route
ibmcloud is vpc-routing-table-route-create my-vpc <RT-ID> \
  --zone us-south-1 \
  --destination 192.168.1.0/24 \
  --next-hop <GATEWAY-IP>

Security Groups

# Create security group
ibmcloud is security-group-create web-sg my-vpc

# Add rules
ibmcloud is security-group-rule-add web-sg inbound tcp \
  --port-min 443 --port-max 443 --remote 0.0.0.0/0

Network ACLs

# Create ACL
ibmcloud is network-acl-create my-acl my-vpc

# Add inbound rule
ibmcloud is network-acl-rule-add my-acl allow inbound all \
  0.0.0.0/0 443 443 --before <RULE-ID>

---

Load Balancers

Application Load Balancer

Create ALB:

# Create load balancer
ibmcloud is load-balancer-create my-alb public \
  --subnet <SUBNET-ID-1> \
  --subnet <SUBNET-ID-2> \
  --subnet <SUBNET-ID-3>

# Create backend pool
ibmcloud is load-balancer-pool-create my-pool my-alb \
  --algorithm round_robin \
  --protocol http \
  --health-delay 5 \
  --health-max-retries 2 \
  --health-timeout 2 \
  --health-type http \
  --health-monitor-url /health

# Add pool members
ibmcloud is load-balancer-pool-member-create my-alb my-pool \
  8080 <VSI-IP> --weight 50

# Create listener
ibmcloud is load-balancer-listener-create my-alb \
  443 https \
  --certificate-instance <CERT-CRN> \
  --default-pool my-pool

Terraform:

resource "ibm_is_lb" "alb" {
  name    = "my-alb"
  subnets = [
    ibm_is_subnet.subnet_1.id,
    ibm_is_subnet.subnet_2.id,
    ibm_is_subnet.subnet_3.id
  ]
  type = "public"
}

resource "ibm_is_lb_pool" "pool" {
  lb                      = ibm_is_lb.alb.id
  name                    = "my-pool"
  protocol                = "http"
  algorithm               = "round_robin"
  health_delay            = 5
  health_retries          = 2
  health_timeout          = 2
  health_type             = "http"
  health_monitor_url      = "/health"
  health_monitor_port     = 8080
}

resource "ibm_is_lb_pool_member" "member" {
  lb             = ibm_is_lb.alb.id
  pool           = ibm_is_lb_pool.pool.id
  port           = 8080
  target_address = ibm_is_instance.vsi.primary_network_interface[0].primary_ipv4_address
  weight         = 50
}

resource "ibm_is_lb_listener" "listener" {
  lb                   = ibm_is_lb.alb.id
  port                 = 443
  protocol             = "https"
  certificate_instance = ibm_sm_certificate.cert.crn
  default_pool         = ibm_is_lb_pool.pool.id
}

Network Load Balancer

# Create NLB
ibmcloud is load-balancer-create my-nlb public \
  --subnet <SUBNET-ID> \
  --profile network-fixed

---

Cloud Internet Services

DNS Management

# Create CIS instance
ibmcloud resource service-instance-create my-cis \
  internet-svcs standard global

# Add domain
ibmcloud cis domain-add <CIS-INSTANCE-ID> example.com

# Create DNS record
ibmcloud cis dns-record-create <CIS-INSTANCE-ID> <DOMAIN-ID> \
  --type A --name www --content 203.0.113.10 --proxied true

CDN Configuration

# Enable CDN
ibmcloud cis cache-settings-update <CIS-INSTANCE-ID> <DOMAIN-ID> \
  --value aggressive

DDoS Protection

Automatically enabled with Cloud Internet Services.

Web Application Firewall

# Enable WAF
ibmcloud cis waf-package-set <CIS-INSTANCE-ID> <DOMAIN-ID> <PACKAGE-ID> \
  --mode on

---

Direct Link

Overview

Dedicated private connection between on-premises and IBM Cloud.

Types:

• Direct Link Dedicated: Single-tenant 1-10 Gbps
• Direct Link Connect: Multi-tenant via partners

Create Direct Link

# Create Direct Link
ibmcloud dl gateway-create \
  --name my-direct-link \
  --type dedicated \
  --speed-mbps 1000 \
  --bgp-asn 65000 \
  --bgp-base-cidr 169.254.0.0/16 \
  --location <LOCATION>

# Create virtual connection to VPC
ibmcloud dl gateway-vc-create <GATEWAY-ID> \
  --name to-prod-vpc \
  --type vpc \
  --network-id <VPC-CRN>

---

Transit Gateway

Overview

Connect multiple VPCs and on-premises networks.

# Create transit gateway
ibmcloud tg gateway-create \
  --name my-tg \
  --location us-south \
  --routing global

# Connect VPC
ibmcloud tg connection-create <TG-ID> \
  --name vpc1-connection \
  --network-type vpc \
  --network-id <VPC-CRN>

# Connect Direct Link
ibmcloud tg connection-create <TG-ID> \
  --name dl-connection \
  --network-type directlink \
  --network-id <DL-CRN>

Terraform:

resource "ibm_tg_gateway" "tg" {
  name     = "my-tg"
  location = "us-south"
  global   = true
}

resource "ibm_tg_connection" "vpc1" {
  gateway      = ibm_tg_gateway.tg.id
  network_type = "vpc"
  name         = "vpc1-connection"
  network_id   = ibm_is_vpc.vpc1.crn
}

resource "ibm_tg_connection" "vpc2" {
  gateway      = ibm_tg_gateway.tg.id
  network_type = "vpc"
  name         = "vpc2-connection"
  network_id   = ibm_is_vpc.vpc2.crn
}

---

VPN

Site-to-Site VPN

# Create VPN gateway
ibmcloud is vpn-gateway-create my-vpn-gateway \
  --subnet <SUBNET-ID>

# Create VPN connection
ibmcloud is vpn-gateway-connection-create my-connection my-vpn-gateway \
  --peer-address 203.0.113.5 \
  --psk mysecretkey \
  --local-cidr 10.240.0.0/16 \
  --peer-cidr 192.168.0.0/16

Terraform:

resource "ibm_is_vpn_gateway" "vpn" {
  name   = "my-vpn-gateway"
  subnet = ibm_is_subnet.subnet.id
}

resource "ibm_is_vpn_gateway_connection" "connection" {
  name          = "my-connection"
  vpn_gateway   = ibm_is_vpn_gateway.vpn.id
  peer_address  = "203.0.113.5"
  preshared_key = "mysecretkey"
  local_cidrs   = ["10.240.0.0/16"]
  peer_cidrs    = ["192.168.0.0/16"]
}

Client VPN

Use IBM Cloud VPN for Clients or third-party solutions.

---

Best Practices

High Availability

1. Multi-Zone: Deploy across 3 zones 2. Load Balancing: Use ALB/NLB 3. Redundant Connections: Multiple Direct Link/VPN 4. Health Checks: Configure proper monitoring 5. Auto-Scaling: Scale based on traffic

Security

1. Private Endpoints: Minimize public exposure 2. Security Groups: Least privilege firewall rules 3. Network ACLs: Subnet-level protection 4. DDoS Protection: Enable CIS 5. WAF: Protect web applications

Performance

1. CDN: Use CIS for static content 2. Direct Link: Low-latency private connectivity 3. Transit Gateway: Optimize inter-VPC routing 4. DNS: Use CIS for global load balancing 5. Compression: Enable at load balancer

Cost Optimization

1. Private Networking: Free data transfer 2. Regional Traffic: Stay within region 3. CDN Caching: Reduce origin requests 4. Right-Size Bandwidth: Match Direct Link to needs 5. Compression: Reduce data transfer costs

Storage Services

Table of Contents

• Cloud Object Storage (COS)
• Block Storage for VPC
• File Storage for VPC
• Backup and Disaster Recovery

---

Cloud Object Storage (COS)

Overview

S3-compatible object storage for unstructured data with 99.999999999% (11 nines) durability.

Use Cases:

• Static website hosting
• Backup and archival
• Data lake for analytics
• Media files and assets
• Container image registry

Storage Classes

Create Bucket

CLI:

# Install COS plugin
ibmcloud plugin install cloud-object-storage

# Create COS instance
ibmcloud resource service-instance-create my-cos \
  cloud-object-storage standard global \
  -g my-resource-group

# Create service credentials
ibmcloud resource service-key-create my-cos-creds \
  Writer --instance-name my-cos \
  --parameters '{"HMAC": true}'

# Set COS configuration
ibmcloud cos config crn --crn <COS-CRN>
ibmcloud cos config auth --method IAM
ibmcloud cos config region --region us-south

# Create bucket (Standard)
ibmcloud cos bucket-create --bucket my-bucket \
  --ibm-service-instance-id <COS-INSTANCE-ID> \
  --region us-south

# Create bucket (Smart Tier)
ibmcloud cos bucket-create --bucket my-smart-bucket \
  --ibm-service-instance-id <COS-INSTANCE-ID> \
  --region us-south \
  --class Smart

Terraform:

resource "ibm_resource_instance" "cos_instance" {
  name              = "my-cos"
  service           = "cloud-object-storage"
  plan              = "standard"
  location          = "global"
  resource_group_id = ibm_resource_group.rg.id
}

resource "ibm_cos_bucket" "bucket" {
  bucket_name          = "my-bucket"
  resource_instance_id = ibm_resource_instance.cos_instance.id
  region_location      = "us-south"
  storage_class        = "smart"

  activity_tracking {
    read_data_events     = true
    write_data_events    = true
    activity_tracker_crn = ibm_resource_instance.at.id
  }

  metrics_monitoring {
    usage_metrics_enabled  = true
    request_metrics_enabled = true
    metrics_monitoring_crn = ibm_resource_instance.monitor.id
  }
}

Upload and Download Objects

CLI:

# Upload file
ibmcloud cos object-put --bucket my-bucket \
  --key path/to/file.txt \
  --body ./local-file.txt

# Upload with metadata
ibmcloud cos object-put --bucket my-bucket \
  --key data.json \
  --body ./data.json \
  --metadata '{"key1":"value1","key2":"value2"}' \
  --content-type application/json

# Download file
ibmcloud cos object-get --bucket my-bucket \
  --key path/to/file.txt \
  ./downloaded-file.txt

# List objects
ibmcloud cos objects --bucket my-bucket

# Delete object
ibmcloud cos object-delete --bucket my-bucket \
  --key path/to/file.txt

Python SDK:

import ibm_boto3
from ibm_botocore.client import Config

# Initialize client
cos = ibm_boto3.client(
    's3',
    ibm_api_key_id='<API-KEY>',
    ibm_service_instance_id='<COS-INSTANCE-ID>',
    config=Config(signature_version='oauth'),
    endpoint_url='https://s3.us-south.cloud-object-storage.appdomain.cloud'
)

# Upload object
cos.upload_file(
    Filename='./local-file.txt',
    Bucket='my-bucket',
    Key='path/to/file.txt'
)

# Download object
cos.download_file(
    Bucket='my-bucket',
    Key='path/to/file.txt',
    Filename='./downloaded-file.txt'
)

# List objects
response = cos.list_objects_v2(Bucket='my-bucket')
for obj in response.get('Contents', []):
    print(obj['Key'])

# Delete object
cos.delete_object(Bucket='my-bucket', Key='path/to/file.txt')

Multipart Upload (Large Files)

# Multipart upload for files > 100MB
import ibm_boto3
from ibm_boto3.s3.transfer import TransferConfig

# Configure multipart threshold and chunk size
transfer_config = TransferConfig(
    multipart_threshold=100 * 1024 * 1024,  # 100MB
    max_concurrency=10,
    multipart_chunksize=50 * 1024 * 1024    # 50MB chunks
)

# Upload large file
cos.upload_file(
    Filename='./large-file.zip',
    Bucket='my-bucket',
    Key='archives/large-file.zip',
    Config=transfer_config
)

Bucket Lifecycle Policy

CLI:

# Create lifecycle config file
cat > lifecycle.json <<EOF
{
  "Rules": [
    {
      "ID": "Archive old data",
      "Status": "Enabled",
      "Filter": {
        "Prefix": "logs/"
      },
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "GLACIER"
        }
      ]
    },
    {
      "ID": "Delete temporary files",
      "Status": "Enabled",
      "Filter": {
        "Prefix": "temp/"
      },
      "Expiration": {
        "Days": 7
      }
    }
  ]
}
EOF

# Apply lifecycle policy
ibmcloud cos bucket-lifecycle-put --bucket my-bucket \
  --lifecycle-configuration file://lifecycle.json

Terraform:

resource "ibm_cos_bucket" "bucket" {
  bucket_name          = "my-bucket"
  resource_instance_id = ibm_resource_instance.cos_instance.id
  region_location      = "us-south"
  storage_class        = "standard"

  lifecycle_rule {
    id      = "archive-old-data"
    enabled = true
    prefix  = "logs/"

    transition {
      days          = 30
      storage_class = "GLACIER"
    }
  }

  lifecycle_rule {
    id      = "delete-temp"
    enabled = true
    prefix  = "temp/"

    expiration {
      days = 7
    }
  }
}

Static Website Hosting

# Enable website configuration
ibmcloud cos bucket-website-put --bucket my-bucket \
  --website-configuration '{
    "IndexDocument": {"Suffix": "index.html"},
    "ErrorDocument": {"Key": "error.html"}
  }'

# Set bucket public read access
ibmcloud cos bucket-cors-put --bucket my-bucket \
  --cors-configuration '{
    "CORSRules": [{
      "AllowedOrigins": ["*"],
      "AllowedMethods": ["GET", "HEAD"],
      "AllowedHeaders": ["*"]
    }]
  }'

# Website URL
# https://my-bucket.s3-web.us-south.cloud-object-storage.appdomain.cloud

Bucket Replication

# Enable versioning (required for replication)
ibmcloud cos bucket-versioning-put --bucket my-bucket \
  --versioning-configuration Status=Enabled

# Create replication rule
ibmcloud cos bucket-replication-put --bucket my-bucket \
  --replication-configuration '{
    "Role": "<IAM-ROLE-ARN>",
    "Rules": [{
      "ID": "Replicate to DR region",
      "Status": "Enabled",
      "Priority": 1,
      "Destination": {
        "Bucket": "arn:aws:s3:::my-dr-bucket",
        "StorageClass": "STANDARD"
      }
    }]
  }'

Encryption

Server-Side Encryption (SSE):

# Upload with SSE-S3 (IBM managed keys)
ibmcloud cos object-put --bucket my-bucket \
  --key encrypted-file.txt \
  --body ./file.txt \
  --server-side-encryption AES256

# Upload with SSE-KP (Key Protect)
ibmcloud cos object-put --bucket my-bucket \
  --key encrypted-file.txt \
  --body ./file.txt \
  --server-side-encryption kp \
  --sse-kms-key-id <KEY-PROTECT-KEY-CRN>

Bucket-Level Encryption:

resource "ibm_cos_bucket" "bucket" {
  bucket_name          = "my-encrypted-bucket"
  resource_instance_id = ibm_resource_instance.cos_instance.id
  region_location      = "us-south"
  storage_class        = "standard"
  
  kms_key_crn = ibm_kms_key.key.id
}

Access Control

Bucket Policy:

# Create bucket policy
cat > policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "AllowPublicRead",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}
EOF

# Apply policy
ibmcloud cos bucket-policy-put --bucket my-bucket \
  --policy file://policy.json

IAM Access:

# Grant user access to bucket
ibmcloud iam user-policy-create user@example.com \
  --roles Reader,Writer \
  --service-name cloud-object-storage \
  --service-instance <COS-INSTANCE-ID> \
  --resource-type bucket \
  --resource my-bucket

---

Block Storage for VPC

Overview

High-performance block storage volumes for virtual server instances.

Performance Tiers:

• 3 IOPS/GB: General purpose (max 48,000 IOPS)
• 5 IOPS/GB: High-performance apps
• 10 IOPS/GB: Database workloads (max 96,000 IOPS)
• Custom: Define specific IOPS (100-96,000)

Create and Attach Volume

CLI:

# Create volume
ibmcloud is volume-create my-data-volume \
  10iops-tier \
  us-south-1 \
  --capacity 100 \
  --resource-group-name my-rg

# Attach volume to instance
ibmcloud is instance-volume-attachment-add my-attachment \
  my-vsi my-data-volume

# List volumes
ibmcloud is volumes

# Get volume details
ibmcloud is volume my-data-volume

Terraform:

resource "ibm_is_volume" "data_volume" {
  name           = "my-data-volume"
  profile        = "10iops-tier"
  zone           = "us-south-1"
  capacity       = 100
  resource_group = ibm_resource_group.rg.id

  encryption_key = ibm_kms_key.key.crn
}

resource "ibm_is_instance_volume_attachment" "attachment" {
  instance = ibm_is_instance.vsi.id
  volume   = ibm_is_volume.data_volume.id
  name     = "my-attachment"
}

Format and Mount Volume

# SSH to instance
ssh root@<VSI-IP>

# List block devices
lsblk

# Create filesystem
mkfs.ext4 /dev/vdd

# Create mount point
mkdir /data

# Mount volume
mount /dev/vdd /data

# Persist mount (add to /etc/fstab)
echo '/dev/vdd /data ext4 defaults,nofail 0 2' >> /etc/fstab

# Verify
df -h /data

Snapshots

# Create snapshot
ibmcloud is snapshot-create my-snapshot \
  --source-volume my-data-volume \
  --name "backup-2024-01-15"

# List snapshots
ibmcloud is snapshots

# Restore from snapshot
ibmcloud is volume-create restored-volume \
  10iops-tier \
  us-south-1 \
  --snapshot my-snapshot

Terraform:

resource "ibm_is_snapshot" "snapshot" {
  name          = "my-snapshot"
  source_volume = ibm_is_volume.data_volume.id
  resource_group = ibm_resource_group.rg.id
}

resource "ibm_is_volume" "restored_volume" {
  name           = "restored-volume"
  profile        = "10iops-tier"
  zone           = "us-south-1"
  source_snapshot = ibm_is_snapshot.snapshot.id
  resource_group = ibm_resource_group.rg.id
}

Expand Volume

# Expand volume capacity
ibmcloud is volume-update my-data-volume \
  --capacity 200

# After expansion, resize filesystem
ssh root@<VSI-IP>

# For ext4
resize2fs /dev/vdd

# For xfs
xfs_growfs /data

---

File Storage for VPC

Overview

NFS-based shared file storage for multiple VPC instances.

Use Cases:

• Shared application data
• Content management systems
• Container persistent volumes
• Development environments

Create File Share

CLI:

# Create file share
ibmcloud is share-create my-share \
  --zone us-south-1 \
  --profile dp2 \
  --size 100 \
  --resource-group-name my-rg

# Create mount target
ibmcloud is share-mount-target-create my-share \
  --vpc my-vpc \
  --name my-mount-target \
  --subnet my-subnet

# Get mount path
ibmcloud is share-mount-target my-share my-mount-target

Terraform:

resource "ibm_is_share" "share" {
  name           = "my-share"
  size           = 100
  profile        = "dp2"
  zone           = "us-south-1"
  resource_group = ibm_resource_group.rg.id
}

resource "ibm_is_share_mount_target" "mount_target" {
  share = ibm_is_share.share.id
  name  = "my-mount-target"
  vpc   = ibm_is_vpc.vpc.id

  virtual_network_interface {
    name   = "my-vni"
    subnet = ibm_is_subnet.subnet.id
  }
}

Mount File Share

# SSH to instance
ssh root@<VSI-IP>

# Install NFS client
apt-get update && apt-get install -y nfs-common

# Create mount point
mkdir /mnt/share

# Mount file share
mount -t nfs4 -o sec=sys,vers=4.1 \
  <MOUNT-TARGET-IP>:/<SHARE-ID> /mnt/share

# Persist mount (add to /etc/fstab)
echo '<MOUNT-TARGET-IP>:/<SHARE-ID> /mnt/share nfs4 sec=sys,vers=4.1,defaults 0 0' >> /etc/fstab

# Verify
df -h /mnt/share

Kubernetes Persistent Volume

# storage-class.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ibm-vpc-file
provisioner: vpc.file.csi.ibm.io
parameters:
  profile: "dp2"
  zone: "us-south-1"
  tags: "env:prod"
reclaimPolicy: Delete
volumeBindingMode: Immediate

# pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 100Gi
  storageClassName: ibm-vpc-file

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: nginx
        volumeMounts:
        - name: data
          mountPath: /data
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: my-pvc

---

Backup and Disaster Recovery

Backup Strategies

1. COS Bucket Replication:

# Cross-region replication for disaster recovery
ibmcloud cos bucket-replication-put --bucket prod-bucket \
  --replication-configuration '{
    "Role": "<IAM-ROLE>",
    "Rules": [{
      "Status": "Enabled",
      "Priority": 1,
      "Destination": {
        "Bucket": "arn:aws:s3:::dr-bucket",
        "Region": "eu-gb"
      }
    }]
  }'

2. Block Storage Snapshots:

# Automated snapshot schedule
# Create snapshots daily at 2 AM
ibmcloud is snapshot-consistency-group-create my-cg \
  --name daily-backup \
  --volume-ids <VOLUME-1>,<VOLUME-2>

# Retention: Keep 7 daily, 4 weekly, 12 monthly

3. Database Backups to COS:

# PostgreSQL backup to COS
pg_dump -h <DB-HOST> -U admin mydatabase | \
  ibmcloud cos object-put --bucket backups \
  --key postgres/mydatabase-$(date +%Y%m%d).sql.gz

# Automated with cron
0 2 * * * /usr/local/bin/backup-db.sh

Disaster Recovery Architecture

Primary Region (us-south)
├── Production Resources
│   ├── IKS Cluster
│   ├── Databases
│   └── Object Storage
└── Continuous Replication

DR Region (eu-gb)
├── Standby Resources
│   ├── IKS Cluster (scaled down)
│   ├── Database Read Replicas
│   └── Object Storage (replicated)
└── Automated Failover

Recovery Time Objective (RTO):

• Active-Active: 0 (no downtime)
• Active-Passive: < 1 hour
• Backup-Restore: < 4 hours

Recovery Point Objective (RPO):

• Synchronous replication: 0 (no data loss)
• Asynchronous replication: < 5 minutes
• Snapshot-based: < 24 hours

---

Best Practices

Cloud Object Storage

1. Use Smart Tier: Let COS automatically optimize storage costs 2. Enable Versioning: Protect against accidental deletion 3. Lifecycle Policies: Automatically archive/delete old data 4. Multipart Upload: For files > 100MB 5. CDN Integration: Use Cloud Internet Services for global delivery 6. Encryption: Enable Key Protect for sensitive data 7. Access Logging: Track bucket access with Activity Tracker

Block Storage

1. Choose Right IOPS: Match performance to workload 2. Regular Snapshots: Daily/weekly backup schedule 3. Encryption: Enable encryption with Key Protect 4. Monitor Performance: Track IOPS, throughput, latency 5. Expand Proactively: Monitor capacity usage

File Storage

1. Use dp2 Profile: Better performance for most workloads 2. Multiple Mount Targets: Deploy across zones for HA 3. NFS v4.1: Use latest protocol version 4. Access Control: Restrict by security group 5. Backup Strategy: Sync to COS for disaster recovery

Cost Optimization

1. Storage Tiers: Use appropriate COS storage class 2. Lifecycle Policies: Automatically move/delete old data 3. Right-Size Volumes: Avoid over-provisioning 4. Delete Unused Snapshots: Prune old backups 5. Monitor Usage: Track storage metrics and costs