rage.fail

gcp-vertexai-explicit-notebook-cross-project-trust

A Workbench notebook instance binds a cross-project service account.

explicit gcp emits CrossProjectTrust

where

the instance SA's project differs from the notebook project

emit

source type	`Project`
target type	`ServiceAccount`
source	`<notebook.project>`
target	`<instance SA (cross-project)>`

Raw rule rules/explicit/gcp-vertexai.yaml

id: gcp-vertexai-explicit-notebook-cross-project-trust
emits: CrossProjectTrust
description: A Workbench notebook instance binds a cross-project service account.
source_record:
  api: notebooks.projects.locations.instances.get
  field: gceInstance.serviceAccount
where:
- the instance SA's project differs from the notebook project
emit:
  source_type: Project
  target_type: ServiceAccount
  source: <notebook.project>
  target: <instance SA (cross-project)>
  permissions: []
  note: Cross-project SA binding. Feeds cross-project entry derivations.