SageMaker model quality job definitions should have network isolation enabled
Flags Amazon SageMaker model quality monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containers can reach external networks.
- service
- SageMaker
- severity
- High
- scope
- evaluated in every region
How to fix it
Set at creation: fixing it means replacing the resource.
Set NetworkConfig.EnableNetworkIsolation to true on the model quality job definition the finding names by ARN. There is no update operation for one, so create a replacement identical apart from this setting, repoint every monitoring schedule and anything else that names the old definition, and only then delete it. Check where the ground-truth labels come from first: isolation is absolute, so the container makes no outbound call and gets no AWS credentials. Labels SageMaker stages for the job survive, because it does the S3 transfer outside the container; anything the container fetches for itself stops.
See which of your accounts this check is failing on.
Book a demo