gcp-vertexai-create-workload-as-notebook

Create a Workbench notebook instance whose underlying GCE VM runs as a passable SA. The instance persists; accessing JupyterLab (notebooks.instances.use) executes code as the SA.

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ServiceAccount`
source	`<principal>`
target	`<service account>`
permissions	`notebooks.instances.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE if iam.serviceAccounts.actAs on ?sa is confirmed AND notebooks.instances.create are present. The instance creation capability is ACTIVE regardless of whether the principal holds notebooks.instances.use — the use permission gates the downstream CanExecuteCommand (via gcp-vertexai-notebook-use-execute-command), not the creation capability itself. CONDITIONAL(service_state) if the newly created instance is not yet RUNNING. POTENTIAL(iam_permission) if actAs is not confirmed. BLOCKED if org policy iam.disableCrossProjectServiceAccountUsage is active AND ?sa is cross-project.

source type

Identity

target type

ServiceAccount

source

<principal>

target

<service account>

permissions

notebooks.instances.create iam.serviceAccounts.actAs

conditions

iam_permission role_compatibility

state logic

ACTIVE if iam.serviceAccounts.actAs on ?sa is confirmed AND notebooks.instances.create are present. The instance creation capability is ACTIVE regardless of whether the principal holds notebooks.instances.use — the use permission gates the downstream CanExecuteCommand (via gcp-vertexai-notebook-use-execute-command), not the creation capability itself. CONDITIONAL(service_state) if the newly created instance is not yet RUNNING. POTENTIAL(iam_permission) if actAs is not confirmed. BLOCKED if org policy iam.disableCrossProjectServiceAccountUsage is active AND ?sa is cross-project.

Narrative

{principal.name} can create a Workbench notebook instance running as {sa.name} (notebooks.instances.create + iam.serviceAccounts.actAs); code execution requires separate notebooks.instances.use permission.

Raw rule rules/derived/gcp/vertexai.yaml

id: gcp-vertexai-create-workload-as-notebook
emits: CanCreateWorkloadAs
description: Create a Workbench notebook instance whose underlying GCE VM runs as a passable SA. The instance
  persists; accessing JupyterLab (notebooks.instances.use) executes code as the SA.
match:
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- ?principal has EFFECTIVE notebooks.instances.create in the target project/location
- ?principal has iam.serviceAccounts.actAs on ?sa (confirmed present)
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: <principal>
  target: <service account>
  permissions:
  - notebooks.instances.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: "ACTIVE if iam.serviceAccounts.actAs on ?sa is confirmed AND notebooks.instances.create\
    \ are present. The instance creation capability is ACTIVE regardless of whether the principal holds\
    \ notebooks.instances.use \u2014 the use permission gates the downstream CanExecuteCommand (via gcp-vertexai-notebook-use-execute-command),\
    \ not the creation capability itself. CONDITIONAL(service_state) if the newly created instance is\
    \ not yet RUNNING. POTENTIAL(iam_permission) if actAs is not confirmed. BLOCKED if org policy iam.disableCrossProjectServiceAccountUsage\
    \ is active AND ?sa is cross-project."
  derived_from:
  - <CanPassIdentity edge_id>
  false_positive_note: The Workbench instance is a persistent GCE VM (not ephemeral like a training job).
    Creating it alone gives a running VM. CanCreateWorkloadAs models the create capability, not the subsequent
    execution (use) step. The downstream CanExecuteCommand via gcp-vertexai-notebook-use-execute-command
    requires notebooks.instances.use, not this rule. actAs is required on the exact SA.
  narrative: '{principal.name} can create a Workbench notebook instance running as {sa.name} (notebooks.instances.create
    + iam.serviceAccounts.actAs); code execution requires separate notebooks.instances.use permission.'