aws-sagemaker-executes-as-notebook
A SageMaker notebook instance executes kernel code as its RoleArn (execution role).
match (record)
{
"field": "RoleArn",
"resource_type": "AWS::SageMaker::NotebookInstance"
}
where
RoleArn is non-empty
notebook is InService (running)
emit
| source type | Notebook |
|---|---|
| target type | MachineIdentity |
| source | <SageMaker NotebookInstance> |
| target | <RoleArn> |
| conditions | service_state |
Narrative
SageMaker notebook {notebook.name} executes all kernel code as {role.name} (RoleArn); credentials are reachable via IMDS inside the Jupyter environment.
Raw rule rules/explicit/aws/sagemaker.yaml
id: aws-sagemaker-executes-as-notebook
emits: ExecutesAs
description: A SageMaker notebook instance executes kernel code as its RoleArn (execution role).
match_record:
resource_type: AWS::SageMaker::NotebookInstance
field: RoleArn
where:
- RoleArn is non-empty
- notebook is InService (running)
emit:
source_type: Notebook
target_type: MachineIdentity
source: <SageMaker NotebookInstance>
target: <RoleArn>
state: CONDITIONAL
conditions:
- service_state
permissions: []
false_positive_note: Only ACTIVE when the notebook is InService. A stopped notebook cannot be accessed
until restarted; emit CONDITIONAL(service_state). The role credentials are available via IMDS (169.254.169.254)
from the underlying EC2 instance inside the Jupyter kernel environment.
narrative: SageMaker notebook {notebook.name} executes all kernel code as {role.name} (RoleArn); credentials
are reachable via IMDS inside the Jupyter environment.