aws-sagemaker-executes-as-studio-app

id: aws-sagemaker-executes-as-studio-app
emits: ExecutesAs
description: A SageMaker Studio App (JupyterServer/KernelGateway) executes as the UserProfile's ExecutionRole.
match_record:
  resource_type: AWS::SageMaker::UserProfile
  field: UserSettings.ExecutionRole
where:
- ExecutionRole is non-empty
- Studio apps for this UserProfile must be present/running in the graph
emit:
  source_type: Notebook
  target_type: MachineIdentity
  source: <SageMaker App (JupyterServer/KernelGateway) under UserProfile>
  target: <UserSettings.ExecutionRole>
  state: CONDITIONAL
  conditions:
  - service_state
  permissions: []
  false_positive_note: 'Studio apps must be Running. ExecutionRole is set at the UserProfile level; Domain-level
    default ExecutionRole applies when no UserProfile override exists. Domain-level overrides should also
    emit this edge from the Domain''s DefaultUserSettings.ExecutionRole if no UserProfile-specific role
    exists. NOTE: The source of this edge is the App node (type Notebook), which is a separate AWS::SageMaker::App
    resource (type JupyterServer/KernelGateway). The rule reads the role from UserProfile config, but
    the edge represents the App''s execution identity. When an App node exists in the graph, source should
    reference it directly; when App is inferred or not yet instantiated, the rule documents the derivation
    from UserProfile config.'
  narrative: SageMaker Studio apps for user profile {profile.name} run as {role.name}; code in the kernel
    environment has this role's AWS credentials.