SageMaker models should use private registry in VPC for primary containers

How to fix it

Set at creation: fixing it means replacing the resource.

Give the model's primary container an image configuration whose repository access mode is Vpc, so the image is pulled from a private Docker registry inside your VPC. There is no update operation for a model, so this means a new model with every endpoint, batch transform job and pipeline step repointed at it. For the pull to work the registry has to be reachable from the VPC the model attaches to, present a TLS certificate from a public certificate authority, and accept inbound traffic from the model's security groups; one needing credentials also names a Lambda function that supplies them. A model that defines a container list instead is checked by SageMaker.19, and one carrying both members raises both findings.

With the AWS CLI

aws sagemaker create-model --model-name <model-name> --execution-role-arn <execution-role-arn> --primary-container '{"Image":"<private-registry-image-uri>","ImageConfig":{"RepositoryAccessMode":"Vpc"}}' --vpc-config '{"SecurityGroupIds":["<security-group-id>"],"Subnets":["<subnet-id>"]}' --region <region>

With Terraform

resource "aws_sagemaker_model" "this" {
  name               = var.model_name
  execution_role_arn = var.execution_role_arn

  primary_container {
    image = var.private_registry_image_uri

    image_config {
      repository_access_mode = "Vpc"
    }
  }

  vpc_config {
    security_group_ids = var.security_group_ids
    subnets            = var.subnet_ids
  }
}