rage.fail

gcp-vertexai-explicit-executes-as-notebook

Workbench notebook instance explicitly declares its service account.

explicit gcp emits ExecutesAs

emit

source type	`Notebook`
target type	`ServiceAccount`
source	`<Workbench notebook instance>`
target	`<runtime service account>`

Raw rule rules/explicit/gcp-vertexai.yaml

id: gcp-vertexai-explicit-executes-as-notebook
emits: ExecutesAs
description: Workbench notebook instance explicitly declares its service account.
source_record:
  api: notebooks.projects.locations.instances.get
  field: gceInstance.serviceAccount
default: Compute Engine default SA PROJECT_NUMBER-compute@developer.gserviceaccount.com when unset
emit:
  source_type: Notebook
  target_type: ServiceAccount
  source: <Workbench notebook instance>
  target: <runtime service account>
  permissions: []
  note: Extracted from instance configuration. The instance (GCE VM) will run as this SA.