SageMaker data quality job definitions should have network isolation enabled

How to fix it

Set at creation: fixing it means replacing the resource.

Set NetworkConfig.EnableNetworkIsolation to true on the data quality job definition the finding names by ARN. There is no update operation for one, so create a replacement identical apart from this setting, repoint every monitoring schedule and anything else that names the old definition, and only then delete it. Check what the container fetches at run time first: isolation is absolute, so it makes no outbound call and gets no AWS credentials, and anything it pulls for itself stops working. SageMaker's own S3 transfers run outside the container and still work.

With Terraform

resource "aws_sagemaker_data_quality_job_definition" "this" {
  role_arn = var.role_arn

  data_quality_app_specification {
    image_uri = var.monitor_image_uri
  }

  data_quality_job_input {
    endpoint_input {
      endpoint_name = var.endpoint_name
    }
  }

  data_quality_job_output_config {
    monitoring_outputs {
      s3_output {
        s3_uri = var.report_s3_uri
      }
    }
  }

  job_resources {
    cluster_config {
      instance_count    = var.instance_count
      instance_type     = var.instance_type
      volume_size_in_gb = var.volume_size_in_gb
    }
  }

  network_config {
    enable_network_isolation = true
  }
}