Amazon SageMaker notebook instances should not have direct internet access

How to fix it

• Replaces the resource: The setting is fixed at creation: copy anything under /home/ec2-user/SageMaker to Git or Amazon S3, create the new instance, then stop and delete this one.
• Can break clients: The new instance reaches nothing outside your VPC, including SageMaker training and hosting, until the VPC has an interface endpoint or a NAT gateway.
• Affects another check: The new instance has a subnet, so it also passes SageMaker.2.

In the console

SageMaker AI → Notebook instances → Create notebook instance → Network → Direct internet access

VPC

A VPC of your own, with a subnet and security group; AWS allows Disable only on an instance with a subnet

Direct internet access

Disable

With Terraform

resource "aws_sagemaker_notebook_instance" "this" {
  name                   = var.notebook_instance_name
  instance_type          = var.instance_type
  role_arn               = var.role_arn
  subnet_id              = var.subnet_id
  direct_internet_access = "Disabled"
}