Back to Checks
aws

Amazon SageMaker notebook instance has VPC settings configured

sagemaker_notebook_instance_vpc_settings_configured
Service: sagemakerSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedgen-ai
Resource Type:AwsSageMakerNotebookInstance

SageMaker notebook instances are evaluated for VPC attachment. Instances configured with a VPC (via a subnet_id and security groups) use private networking; those without VPC settings rely on public networking.

Prowler logoProwlerprowler-provider-aws

Risk

Without a VPC, notebooks lose network isolation. Traffic to AWS services may traverse the public internet, limiting egress control and private endpoints, enabling data exfiltration and interception, and easing lateral movement-impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sagemaker_notebook_instance_vpc_settings_configured

Recommendation

Run notebooks in a private VPC, applying least-privilege security groups and network segmentation. Prefer VPC endpoints for AWS services and restrict outbound traffic to approved destinations to enforce defense in depth.

Remediation

Terraform

resource "aws_sagemaker_notebook_instance" "<example_resource_name>" {
  name          = "<example_resource_name>"
  role_arn      = "<example_resource_id>"
  instance_type = "ml.t3.medium"
  subnet_id     = "<example_resource_id>" # critical: ensures the notebook is in a VPC subnet to pass the check
}

NativeIaC

# CloudFormation: SageMaker Notebook Instance with VPC settings
Resources:
  <example_resource_name>:
    Type: AWS::SageMaker::NotebookInstance
    Properties:
      InstanceType: ml.t3.medium
      RoleArn: <example_resource_id>
      SubnetId: <example_resource_id>  # critical: places the notebook in a VPC subnet so the check passes

Other

1In the AWS Console, go to SageMaker > Notebook instances
2Select the failing notebook instance, choose Stop, then Delete
3Click Create notebook instance and use the same name
4Under Network, select your VPC and a Subnet (select any required Security group)
5Create the notebook instance
6After it is InService, rerun the check

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client


class sagemaker_notebook_instance_vpc_settings_configured(Check):
    def execute(self):
        findings = []
        for notebook_instance in sagemaker_client.sagemaker_notebook_instances:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=notebook_instance
            )
            report.status = "PASS"
            report.status_extended = (
                f"Sagemaker notebook instance {notebook_instance.name} is in a VPC."
            )
            if not notebook_instance.subnet_id:
                report.status = "FAIL"
                report.status_extended = f"Sagemaker notebook instance {notebook_instance.name} has VPC settings disabled."

            findings.append(report)

        return findings

References