gcp-vertexai-explicit-cross-project-trust

A training job, pipeline job, or notebook execution job binds a cross-project service account.

explicit gcp emits CrossProjectTrust

where

the runtime SA's project (extracted from the SA email suffix) differs from the job's project

emit

source typeProject
target typeServiceAccount
source<job.project>
target<runtime SA (cross-project)>

Raw rule rules/explicit/gcp-vertexai.yaml

id: gcp-vertexai-explicit-cross-project-trust
emits: CrossProjectTrust
description: A training job, pipeline job, or notebook execution job binds a cross-project service account.
source_record:
  api: aiplatform.projects.locations.customJobs.get OR aiplatform.projects.locations.trainingPipelines.get
    OR aiplatform.projects.locations.pipelineJobs.get OR aiplatform.projects.locations.notebookExecutionJobs.get
  field: jobSpec.serviceAccount OR serviceAccount OR runtimeConfig.serviceAccount OR trialJobSpec.serviceAccount
where:
- the runtime SA's project (extracted from the SA email suffix) differs from the job's project
emit:
  source_type: Project
  target_type: ServiceAccount
  source: <job.project>
  target: <runtime SA (cross-project)>
  permissions: []
  note: Cross-project SA binding creates a trust relationship. Feeds cross-project entry derivations.
move · open · esc close