gcp-vertexai-explicit-executes-as-training
Training job, pipeline job, or notebook execution job explicitly declares its service account.
emit
| source type | Compute |
|---|---|
| target type | ServiceAccount |
| source | <custom training job / pipeline job / notebook execution job> |
| target | <runtime service account> |
Raw rule rules/explicit/gcp-vertexai.yaml
id: gcp-vertexai-explicit-executes-as-training
emits: ExecutesAs
description: Training job, pipeline job, or notebook execution job explicitly declares its service account.
source_record:
api: aiplatform.projects.locations.customJobs.get OR aiplatform.projects.locations.trainingPipelines.get
OR aiplatform.projects.locations.pipelineJobs.get OR aiplatform.projects.locations.notebookExecutionJobs.get
field: jobSpec.serviceAccount OR serviceAccount OR runtimeConfig.serviceAccount OR trialJobSpec.serviceAccount
default: Compute Engine default SA PROJECT_NUMBER-compute@developer.gserviceaccount.com when unset
emit:
source_type: Compute
target_type: ServiceAccount
source: <custom training job / pipeline job / notebook execution job>
target: <runtime service account>
permissions: []
note: Extracted from job configuration. The job's worker VMs will run as this SA. If multiple job types
reference the same SA, each job-to-SA pair produces its own ExecutesAs edge.