Expanded Network Isolation & IAM Updates for IBM Watson Services
IBM Watson Platform Updates
In September 2018, IBM Watson Services announced support for IBM Cloud Identity and Access Management (IAM). The introduction of Resource Groups and finer-grained access control allowed users to ensure that the right individuals had control over their service instances.
Today, we continue that progress by announcing full support for IAM with Watson services and better support for network isolation.
Full Support for Identity Access Management
API keys for Watson services are no longer limited to a single service instance. You can create access policies and keys that apply to many services and can grant access between them.
To support this change, the API service endpoints use a different domain and include the service instance ID. The new URL pattern is
api.{location}.{offering}.watson.cloud.ibm.com/instances/{instance_id}
Example of new Watson Assistant API endpoint hosted in Dallas, Texas:
api.us-south.assistant.watson.cloud.ibm.com/instances/6bbda3b3-d572–45e1–8c54–22d6ed92r32q
Beginning in December 2019, you will start to see these new URLs as you create service instances or when you add service credentials.
But don’t worry.
These URLs do not introduce a breaking change as they will work for both for your existing service instances and for new instances. The original URLs continue to work on your existing service instances for at least one year.
For more information: Authenticating to Watson services
Public-Private Network Endpoints
As enterprises move their workloads to the public cloud, how you secure access comes into focus. Premium Plan users will gain access to both public and private network endpoints. Connections to private network endpoints will not need public internet access.
Private network endpoints support routing services over the IBM Cloud private network instead of the public network. The addition of private service endpoints will provide your applications:
- Instance specific private URLs reducing the amount of network traffic traversing over a public network
- Reduced cost with unlimited inbound and outbound traffic on the private network — There is no egress when the traffic flows over a private network endpoint.
- Reduced latency and increased security for traffic to Watson Services as data stay’s within the IBM Cloud network.
Read more about how IBM Service Endpoints work
Enabling Private Network Endpoints
Users looking to adopt Private Network Endpoints will need to make sure they are on the Premium Plan for their Watson service.
Step 1:
Enable Virtual Routing and Forwarding on your IBM Cloud Account.
Step 2:
Navigate to your service instance that is on a Premium plan and click the Manage tab.
Step 3:
Click Add private network endpoint link to enable access to a private service URL.
Current Premium users can make use of Private Endpoints in their existing service instances. For more information, see Public-Private Network Endpoints
Zia Mohammad is a product manager for the Watson Platform, Language Translator, and Developer Experience teams. His passion centers around AI, emerging tech, and space.
