aws-sagemaker-executes-as-pipeline
A SageMaker Pipeline execution runs steps as its RoleArn.
match (record)
{
"field": "RoleArn",
"resource_type": "AWS::SageMaker::Pipeline"
}
where
RoleArn is non-empty
emit
| source type | Workflow |
|---|---|
| target type | MachineIdentity |
| source | <SageMaker Pipeline> |
| target | <RoleArn> |
Narrative
SageMaker pipeline {pipeline.name} executes each step as {role.name}.
Raw rule rules/explicit/aws/sagemaker.yaml
id: aws-sagemaker-executes-as-pipeline
emits: ExecutesAs
description: A SageMaker Pipeline execution runs steps as its RoleArn.
match_record:
resource_type: AWS::SageMaker::Pipeline
field: RoleArn
where:
- RoleArn is non-empty
emit:
source_type: Workflow
target_type: MachineIdentity
source: <SageMaker Pipeline>
target: <RoleArn>
state: ACTIVE
permissions: []
false_positive_note: The pipeline role orchestrates all steps; individual steps may also launch training/processing
jobs which inherit the pipeline role by default unless a per-step role is specified. Only the pipeline-level
role is modeled here; step-level overrides add additional ExecutesAs facts.
narrative: SageMaker pipeline {pipeline.name} executes each step as {role.name}.