Medium
SageMaker
Regional
SageMaker models should use private registry in VPC for multi-container inference pipelines
Description
Flags SageMaker inference-pipeline models whose Containers[] pull images via the public ECR endpoint. Every container in the pipeline must set ImageConfig.RepositoryAccessMode='Vpc' for image pulls to stay inside the VPC.
Remediation
Recreate each affected pipeline model with RepositoryAccessMode='Vpc' on every container.
Steps
- Identify the affected pipeline model via the SageMaker console.
- Re-create the model with Containers[].ImageConfig.RepositoryAccessMode='Vpc' on every container definition.
- Update endpoints / training jobs to reference the new model.