aws-sagemaker-executes-as-training-job
A SageMaker training job container executes as its RoleArn.
match (record)
{
"field": "RoleArn",
"resource_type": "AWS::SageMaker::TrainingJob"
}
where
RoleArn is non-empty
emit
| source type | BatchJob |
|---|---|
| target type | MachineIdentity |
| source | <SageMaker TrainingJob> |
| target | <RoleArn> |
Narrative
SageMaker training job {job.name} runs its training container as {role.name}; code in the container can call AWS APIs as this role.
Raw rule rules/explicit/aws/sagemaker.yaml
id: aws-sagemaker-executes-as-training-job
emits: ExecutesAs
description: A SageMaker training job container executes as its RoleArn.
match_record:
resource_type: AWS::SageMaker::TrainingJob
field: RoleArn
where:
- RoleArn is non-empty
emit:
source_type: BatchJob
target_type: MachineIdentity
source: <SageMaker TrainingJob>
target: <RoleArn>
state: ACTIVE
permissions: []
false_positive_note: "Training jobs are ephemeral; once Complete/Failed the credentials are gone. Model\
\ this as a transient fact tied to the job definition configuration. Credentials injected by SageMaker\
\ training toolkit into the container environment \u2014 accessible by any process running in the\
\ container."
narrative: SageMaker training job {job.name} runs its training container as {role.name}; code in the
container can call AWS APIs as this role.