SageMaker model explainability job definitions should have network isolation enabled
Flags Amazon SageMaker model explainability monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containers can reach external networks.
- service
- SageMaker
- severity
- High
- scope
- evaluated in every region
How to fix it
Set at creation: fixing it means replacing the resource.
Set NetworkConfig.EnableNetworkIsolation to true on the model explainability job definition the finding names by ARN. There is no update operation for one, so create a replacement identical apart from this setting, repoint every monitoring schedule and anything else that names the old definition, and only then delete it. Check what the container fetches at run time first: isolation is absolute, so it makes no outbound call and gets no AWS credentials, and anything it pulls for itself stops working. SageMaker's own S3 transfers run outside the container and still work.
See which of your accounts this check is failing on.
Book a demo