All checks
High
SageMaker notebook instances should be launched in a custom VPC
Checks that the SageMaker notebook instance is attached to a subnet. Without one it runs in the SageMaker service VPC, where your security groups and network controls do not apply. Any subnet passes: the check does not judge which VPC the subnet is in.
- service
- SageMaker
- severity
- High
- scope
- evaluated in every region
How to fix it
- Replaces the resource: The subnet is fixed at creation: copy anything under /home/ec2-user/SageMaker to Git or Amazon S3, create the new instance, then stop and delete this one.
- Affects another check: A subnet alone does not stop internet access: create the new instance with Direct internet access set to Disable, or it fails SageMaker.1.
In the console
SageMaker AI → Notebook instances → Create notebook instance → Network → VPC and Subnet
- VPC
- A VPC of your own
- Subnet
- A subnet in that VPC
- Security Group
- One allowing only the inbound and outbound traffic the notebook needs
With Terraform
resource "aws_sagemaker_notebook_instance" "this" {
name = var.notebook_instance_name
instance_type = var.instance_type
role_arn = var.role_arn
subnet_id = var.subnet_id
}See which of your accounts this check is failing on.
Book a live scan