aws-sagemaker-executes-as-processing-job
A SageMaker processing job container executes as its RoleArn.
match (record)
{
"field": "RoleArn",
"resource_type": "AWS::SageMaker::ProcessingJob"
}
where
RoleArn is non-empty
emit
| source type | BatchJob |
|---|---|
| target type | MachineIdentity |
| source | <SageMaker ProcessingJob> |
| target | <RoleArn> |
Narrative
SageMaker processing job {job.name} runs its container as {role.name}.
Raw rule rules/explicit/aws/sagemaker.yaml
id: aws-sagemaker-executes-as-processing-job
emits: ExecutesAs
description: A SageMaker processing job container executes as its RoleArn.
match_record:
resource_type: AWS::SageMaker::ProcessingJob
field: RoleArn
where:
- RoleArn is non-empty
emit:
source_type: BatchJob
target_type: MachineIdentity
source: <SageMaker ProcessingJob>
target: <RoleArn>
state: ACTIVE
permissions: []
false_positive_note: Ephemeral like training jobs. Credentials available inside the container. A Data
Wrangler flow launches as a processing job and inherits the same role.
narrative: SageMaker processing job {job.name} runs its container as {role.name}.