gcp-vertexai-explicit-cross-project-trust
A training job, pipeline job, or notebook execution job binds a cross-project service account.
where
the runtime SA's project (extracted from the SA email suffix) differs from the job's project
emit
| source type | Project |
|---|---|
| target type | ServiceAccount |
| source | <job.project> |
| target | <runtime SA (cross-project)> |
Raw rule rules/explicit/gcp-vertexai.yaml
id: gcp-vertexai-explicit-cross-project-trust
emits: CrossProjectTrust
description: A training job, pipeline job, or notebook execution job binds a cross-project service account.
source_record:
api: aiplatform.projects.locations.customJobs.get OR aiplatform.projects.locations.trainingPipelines.get
OR aiplatform.projects.locations.pipelineJobs.get OR aiplatform.projects.locations.notebookExecutionJobs.get
field: jobSpec.serviceAccount OR serviceAccount OR runtimeConfig.serviceAccount OR trialJobSpec.serviceAccount
where:
- the runtime SA's project (extracted from the SA email suffix) differs from the job's project
emit:
source_type: Project
target_type: ServiceAccount
source: <job.project>
target: <runtime SA (cross-project)>
permissions: []
note: Cross-project SA binding creates a trust relationship. Feeds cross-project entry derivations.