SageMaker monitoring schedules should have inter-container traffic encryption enabled

How to fix it

Turn inter-container traffic encryption on for the monitoring job this schedule runs. On a schedule carrying an inline MonitoringJobDefinition, NetworkConfig.EnableInterContainerTrafficEncryption sits inside it and updating the schedule sets it; if that update is refused, a replacement schedule reaches the same end state. On a schedule that names a job definition instead, the setting is on that definition, which cannot be updated at all: correct it under a new name and repoint the schedule. Where the configuration carries a VpcConfig, its security group needs inbound and outbound rules for the encrypted transport.

With Terraform

resource "aws_sagemaker_monitoring_schedule" "this" {
  monitoring_schedule_config {
    monitoring_type = var.monitoring_type

    monitoring_job_definition {
      role_arn = var.role_arn

      monitoring_app_specification {
        image_uri = var.monitor_image_uri
      }

      monitoring_inputs {
        endpoint_input {
          endpoint_name = var.endpoint_name
          local_path    = var.input_local_path
        }
      }

      monitoring_output_config {
        monitoring_outputs {
          s3_output {
            local_path = var.output_local_path
            s3_uri     = var.report_s3_uri
          }
        }
      }

      monitoring_resources {
        cluster_config {
          instance_count    = var.instance_count
          instance_type     = var.instance_type
          volume_size_in_gb = var.volume_size_in_gb
        }
      }

      network_config {
        enable_inter_container_traffic_encryption = true
      }
    }
  }
}