aws-sagemaker-executes-as-training-job

A SageMaker training job container executes as its RoleArn.

explicit aws emits ExecutesAs

match (record)

{ "field": "RoleArn", "resource_type": "AWS::SageMaker::TrainingJob" }

where

RoleArn is non-empty

emit

source typeBatchJob
target typeMachineIdentity
source<SageMaker TrainingJob>
target<RoleArn>

Narrative

SageMaker training job {job.name} runs its training container as {role.name}; code in the container can call AWS APIs as this role.

Raw rule rules/explicit/aws/sagemaker.yaml

id: aws-sagemaker-executes-as-training-job
emits: ExecutesAs
description: A SageMaker training job container executes as its RoleArn.
match_record:
  resource_type: AWS::SageMaker::TrainingJob
  field: RoleArn
where:
- RoleArn is non-empty
emit:
  source_type: BatchJob
  target_type: MachineIdentity
  source: <SageMaker TrainingJob>
  target: <RoleArn>
  state: ACTIVE
  permissions: []
  false_positive_note: "Training jobs are ephemeral; once Complete/Failed the credentials are gone. Model\
    \ this as a transient fact tied to the job definition configuration. Credentials injected by SageMaker\
    \ training toolkit into the container environment \u2014 accessible by any process running in the\
    \ container."
  narrative: SageMaker training job {job.name} runs its training container as {role.name}; code in the
    container can call AWS APIs as this role.
move · open · esc close