Setting up IBM Cloud Object Storage for use with Cloud Pak for Data as a Service

An IBM Cloud Object Storage service instance is provisioned automatically with a no-cost plan when you join Cloud Pak for Data as a Service. Workspaces, such as projects, require IBM Cloud Object Storage to store files that are related to assets, including uploaded data files or notebook files.

You can also connect to IBM Cloud Object Storage as a data source. See IBM Cloud Object Storage connection.

Overview of setting up Cloud Object Storage

To set up Cloud Object Storage, complete these tasks:

Generate an administrative key.
Ensure that Global location is set in each user's profile.
Provide access to Cloud Object Storage.
- Assign roles to enable access.
- Enable storage delegation.
Optional: Protect sensitive data.
Optional: Encrypt your IBM Cloud Object Storage instance with your own key.

Watch the following video to see how administrators set up Cloud Object Storage for use with Cloud Pak for Data as a Service.

This video provides a visual method to learn the concepts and tasks in this documentation.

Generate an administrative key

You generate an administrative key for Cloud Object Storage by creating an initial test project. The test project can be deleted after its creation. Its sole purpose is to generate the key.

To automatically generate the administrative key for your Cloud Object Storage instance:

From the Cloud Pak for Data as a Service main menu, select Projects > View all projects and then click New project.
Specify to create an empty project.
Enter a project name, such as "Test Project".
Select your Cloud Object Storage instance.
Click Create. The administrative key is generated.
Delete the test project.

Ensure that Global location is set for Cloud Object Storage in each user's profile

Cloud Object Storage requires the Global location to be configured in each user's profile. The Global location is configured automatically, but it might be changed by mistake. An error occurs when a project is created if the Global location is not enabled in the user's profile. Ask users to check that Global location is enabled.

Check for the Global location in each user's profile.

Provide access to Cloud Object Storage

You can provide different levels of access to Cloud Object Storage for people who need to work in Cloud Pak for Data as a Service. Using the storage delegation setting on the Cloud Object Storage instance, you can provide quick access to most users to create projects and catalogs. However, another option is to provide targeted access by using IAM roles and access groups. Role-based access enacts stricter controls for viewing the Cloud Object Storage instance directly and for creating projects and catalogs. If you decide to provide controlled access with IAM roles and access groups, you must disable storage delegation for the Cloud Object Storage instance.

You enable storage delegation for the Cloud Object Storage instance to provide access to nonadministrative users. Users with minimal IAM permissions can create projects and catalogs, which automatically create buckets in the Cloud Object Storage instance. See Enable storage delegation for nonadministrative users.

You provide more controlled access with IAM roles and access groups. For example, the Cloud Object Storage Manager role provides permissions to create projects and spaces together with the corresponding buckets in the Cloud Object Storage instance. It also provides permissions to view all buckets and encryption root keys in the Cloud Object Storage instance, to view the metadata for a bucket and delete buckets, and to perform other administrative tasks that are related to buckets. See Assign roles to enable access.

No role assignments are needed for collaborators who work with the data in a project or catalog. Users who are given collaborator roles can work in the project or catalog without storage delegation or an IAM role. See Project collaborator roles and permissions.

Assign roles to enable access

The IBM Cloud account owner or administrator assigns appropriate roles to users to provide access to Cloud Object Storage. Storage delegation must be disabled when using role-based access.

Rather than assigning each individual user a set of roles, you can create an access group. Access groups expedite role assignments by grouping permissions. For instructions on creating access groups, see IBM Cloud docs: Setting up access groups. For instructions on creating a set of example access groups for Cloud Pak for Data as a Service, see IAM access groups.

The example access group CPD-COS-Admin provides access to IBM Cloud Object Storage for users who need to create and modify projects and catalogs.

These types of roles are assigned to provide access to Cloud Object Storage:

IAM Platform access role (assigned in IBM Cloud by account administrator or owner)
IAM Service access role (assigned in IBM Cloud by account administrator or owner)

The following table describes the roles for users who create and delete projects and catalogs:

Table 1. Role assignments for Cloud Object Storage for projects and catalogs
Location	Role needed	Type	Description	Example access group
IBM Cloud	Platform Administrator	IAM Platform access role	Perform all platform actions except for managing the account and assigning access policies.	CPD-COS-Admin
IBM Cloud	Manager	IAM Service access role for Cloud Object Storage	Create, modify, or delete buckets. Upload and download the objects in the bucket. Create and delete projects and catalogs.	CPD-COS-Admin

Enable storage delegation

Storage delegation for the Cloud Object Storage instance allows nonadministrative users to create projects and catalogs and the corresponding Cloud Object Storage buckets. Storage delegation provides wide access to Cloud Object Storage and allows users with minimal permissions to create projects and catalogs. Storage delegation for projects also includes deployment spaces.

To control more carefully who can create projects and catalogs, create an access group that assigns the appropriate role and place users into the access group. See Example IAM access groups.

To enable storage delegation for the Cloud Object Storage instance:

From the navigation menu, select Administration > Configurations and settings > Storage delegation.
Set storage delegation for both Projects and Catalogs to on.

Storage delegation

Optional: Encrypt your IBM Cloud Object Storage instance with your own key

Encryption protects the data for your projects and catalogs. Data at rest in Cloud Object Storage is encrypted by default with randomly generated keys that are managed by IBM. For increased protection, you can create and manage your own encryption keys with IBM Key Protect. IBM Key Protect for IBM Cloud is a centralized key management system for generating, managing, and deleting encryption keys used by IBM Cloud services.

For more information, see IBM Cloud docs: IBM Key Protect for IBM Cloud.

Not all watsonx.ai Studio service plans and IBM Knowledge Catalog service plans support the use of your own encryption keys. Check your specific plan for details.

To encrypt your Cloud Object Storage instance with your own key, you need an instance of the IBM Key Project service. Although Key Protect is a paid service, each account is allowed five keys without charge.

In IBM Cloud, provision Key Protect and generate a key:

Create an instance of Key Protect for your account from the IBM Cloud catalog. See IBM Cloud docs: Provisioning the Key Protect service.
Grant a service authorization between your Key Protect instance and your Cloud Object Storage instance. Do not associate a key with a bucket. If you don't grant the authorization, users cannot create projects and catalogs with the Cloud Object Storage instance. For more information, see IBM Cloud docs: Using authorizations to grant access between services. You can also grant a service authorization for a root key from watsonx.ai Studio, by choosing Manage > Access (IAM).
Create a root key to protect your Cloud Object Storage instance. See IBM Cloud docs: Creating root keys.

In Cloud Pak for Data as a Service, add the key to the Cloud Object Storage instance:

Select Administration > Configurations and settings > Storage delegation.
Slide the toggle for Projects, Catalogs, or both to select data for encryption with your key.
Click Add... under Encryption keys to add an encryption key.
Select the Key Protect instance and the Key Protect key.
Click OK to add the encryption key.

Important: If you change or remove the key, you lose access to existing encrypted data in the Cloud Object Storage instance.

Optional: Protect sensitive data stored on Cloud Object Storage

When you join Cloud Pak for Data as a Service, a single Cloud Object Storage instance is automatically provisioned for you. The Cloud Object Storage instance contains separate buckets for each project to store data assets and related files. The ability to create projects and thus to add buckets to Cloud Object Storage is available only to users with the Platform Administrator role and the Manager role for the Cloud Object Storage Service. Although only users with these roles can create projects and their accompanying buckets, any user with the Editor or Viewer role can see the data files. For some businesses, the data files contain sensitive information and require stricter access controls.

Control access to Cloud Object Storage with multiple instances

For paid plans, you can control access to sensitive data files by creating one or more Cloud Object Storage instances and assigning access to specific users. Project creators select the appropriate Cloud Object Storage instance when they create a project. The data assets and files for the project are stored in a bucket in the selected instance. Users with Editor or Viewer roles can work in the projects, but they cannot see the assets directly in the related Cloud Object Storage bucket. You can assign access to a specific Cloud Object Storage instance either to an individual user or to an access group. You must be the account owner or administrator to create service instances and assign access.

Extra fees are not incurred by creating more than one Cloud Object Storage instances because charges are determined by overall storage utilization. The number of instances is not a factor for Cloud Object Storage fees.

Only one instance of Cloud Object Storage is allowed for the Lite plan. You can change your pricing plan from the IBM Cloud catalog.

To create a Cloud Object Storage instance and assign access:

Select Services > Services catalog from the navigation menu.
Select Storage > Cloud Object Storage.
Click Create. A Service name is generated for you on IBM Cloud.
Select Manage > Access(IAM).
Select Users or Access groups.
Click Assign access.
In the Services list, choose Cloud Object Storage.
For Resources, choose:
- Scope = Specific resources
- Attribute type = Service instance
- Operator = string equals
- Value = name of Cloud Object Storage
For Roles and actions, choose:
- Service access = Manager
- Platform access = Administrator
Click Add and Assign.

The specified Cloud Object Storage instance can be accessed only by the user or access group with the Service role of Manager and the Platform role of Administrator. Other users can work in the projects but cannot create projects or view assets directly in the bucket.

Next step

Finish the remaining steps for setting up the platform.

Learn more

Parent topic: Setting up the platform