gcp-vertexai-explicit-notebook-set-iam-policy
Principal holds notebooks.instances.setIamPolicy on a Workbench instance (explicit permission normalization).
match (effective permission)
{
"action": "notebooks.instances.setIamPolicy",
"resource_type": "google.notebooks.Instance"
}
emit
| source type | Identity |
|---|---|
| target type | ResourcePolicy |
| source | <principal> |
| target | <Workbench notebook instance's IAM policy> |
| permissions | notebooks.instances.setIamPolicy |
| state logic | ACTIVE when notebooks.instances.setIamPolicy is confirmed on the target instance. |
Raw rule rules/explicit/gcp-vertexai.yaml
id: gcp-vertexai-explicit-notebook-set-iam-policy emits: CanModifyPolicy description: Principal holds notebooks.instances.setIamPolicy on a Workbench instance (explicit permission normalization). match_effective_permission: action: notebooks.instances.setIamPolicy resource_type: google.notebooks.Instance emit: source_type: Identity target_type: ResourcePolicy source: <principal> target: <Workbench notebook instance's IAM policy> permissions: - notebooks.instances.setIamPolicy state_logic: ACTIVE when notebooks.instances.setIamPolicy is confirmed on the target instance. note: Enables self-grant of notebooks.instances.use and downstream code execution.