gcp-vertexai-explicit-notebook-modify-config
Principal holds notebooks.instances.update or notebooks.instances.updateConfig on a Workbench instance.
match (effective permission)
{
"action": "notebooks.instances.update OR notebooks.instances.updateConfig",
"resource_type": "google.notebooks.Instance"
}
emit
| source type | Identity |
|---|---|
| target type | Notebook |
| source | <principal> |
| target | <Workbench notebook instance> |
| permissions | notebooks.instances.update |
| state logic | ACTIVE when notebooks.instances.update is confirmed on the target instance. |
Raw rule rules/explicit/gcp-vertexai.yaml
id: gcp-vertexai-explicit-notebook-modify-config
emits: CanModifyConfiguration
description: Principal holds notebooks.instances.update or notebooks.instances.updateConfig on a Workbench
instance.
match_effective_permission:
action: notebooks.instances.update OR notebooks.instances.updateConfig
resource_type: google.notebooks.Instance
emit:
source_type: Identity
target_type: Notebook
source: <principal>
target: <Workbench notebook instance>
permissions:
- notebooks.instances.update
state_logic: ACTIVE when notebooks.instances.update is confirmed on the target instance.
note: Enables CanModifyCode (startup/post-startup scripts) and CanAttachIdentity (SA swap). This is
the prerequisite edge that gcp-vertexai-notebook-update-attach-sa depends on.