gcp-batch-executes-as
match (record)
{
"field": "allocationPolicy.serviceAccount.email",
"resource_type": "google.batch.Job"
}
where
runtime SA = allocationPolicy.serviceAccount.email, or the Compute Engine default SA PROJECT_NUMBER[email protected] if unset
emit
| source type | Compute |
|---|---|
| source | <batch job> |
| target | <runtime service account> |
Narrative
{job.name} executes as runtime service account {sa.name} on its Batch-provisioned Compute Engine VMs.
Raw rule rules/derived/gcp/batch.yaml
id: gcp-batch-executes-as
emits: ExecutesAs
match_record:
resource_type: google.batch.Job
field: allocationPolicy.serviceAccount.email
where:
- runtime SA = allocationPolicy.serviceAccount.email, or the Compute Engine default SA PROJECT_NUMBER[email
protected] if unset
emit:
source_type: Compute
source: <batch job>
target: <runtime service account>
permissions: []
note: Zero-cost fact. Default Compute Engine SA typically holds roles/editor.
narrative: '{job.name} executes as runtime service account {sa.name} on its Batch-provisioned Compute
Engine VMs.'