Back to Checks
aws

Amazon SageMaker notebook instance has direct internet access disabled

sagemaker_notebook_instance_without_direct_internet_access_configured
Service: sagemakerSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundariesgen-ai
Resource Type:AwsSageMakerNotebookInstance

Amazon SageMaker notebook instances are evaluated for the DirectInternetAccess setting.

Instances with it disabled use only VPC connectivity; instances with it enabled permit direct outbound internet access.

Prowler logoProwlerprowler-provider-aws

Risk

Direct internet access from notebooks weakens egress control, risking confidentiality and integrity.

Adversaries or unvetted code can exfiltrate data, download malware, or run command-and-control. Public package installs bypass inspection, enabling supply-chain tampering and lateral movement from compromised sessions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sagemaker_notebook_instance_without_direct_internet_access_configured

Recommendation

Disable direct internet access (DirectInternetAccess: Disabled) and place notebooks in private subnets.

Use VPC endpoints/PrivateLink for required services, restrict egress with allowlists and least privilege security groups, and apply defense in depth with network isolation and monitoring of outbound traffic.

Remediation

Terraform

# SageMaker notebook with direct internet access disabled
resource "aws_sagemaker_notebook_instance" "<example_resource_name>" {
  name                = "<example_resource_name>"
  role_arn            = "<example_role_arn>"
  instance_type       = "ml.t3.medium"
  subnet_id           = "<example_subnet_id>"          # Required when disabling direct internet access
  security_groups     = ["<example_security_group_id>"] # Required when disabling direct internet access

  direct_internet_access = "Disabled" # CRITICAL: disables direct internet access to pass the check
}

NativeIaC

# CloudFormation: SageMaker notebook with direct internet access disabled
Resources:
  <example_resource_name>:
    Type: AWS::SageMaker::NotebookInstance
    Properties:
      NotebookInstanceName: <example_resource_name>
      InstanceType: ml.t3.medium
      RoleArn: <example_role_arn>
      SubnetId: <example_subnet_id>               # Required when disabling direct internet access
      SecurityGroupIds:                           # Required when disabling direct internet access
        - <example_security_group_id>
      DirectInternetAccess: "Disabled"            # CRITICAL: disables direct internet access to pass the check

Other

1In the AWS Console, go to SageMaker > Notebook instances
2Select the notebook instance, choose Stop, and wait until status is Stopped
3Click Edit
4Set Direct internet access to Disabled
5If prompted, select a Subnet and at least one Security group (VPC required when disabled)
6Click Update, then choose Start to bring the instance back online

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client


class sagemaker_notebook_instance_without_direct_internet_access_configured(Check):
    """Ensure that SageMaker notebook instances have direct internet access disabled."""

    def execute(self) -> list[Check_Report_AWS]:
        """Report whether each notebook instance has direct internet access disabled.

        - PASS: DirectInternetAccess was read and is Disabled.
        - FAIL: DirectInternetAccess was read and is Enabled, so the instance reaches the
          internet directly rather than only through the VPC.
        - MANUAL: DescribeNotebookInstance did not report DirectInternetAccess. Absent is not
          Disabled, and the two cannot share a value here or an instance whose setting was
          never read would be reported compliant.

        Returns:
            One report per notebook instance in the inventory.
        """
        findings = []
        for notebook_instance in sagemaker_client.sagemaker_notebook_instances:
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=notebook_instance
            )
            report.status = "PASS"
            report.status_extended = f"Sagemaker notebook instance {notebook_instance.name} has direct internet access disabled."
            if notebook_instance.direct_internet_access is None:
                # DescribeNotebookInstance did not report DirectInternetAccess, so the
                # setting is unknown. Defaulting to PASS would report an unread instance
                # as compliant.
                report.status = "MANUAL"
                report.status_extended = f"Sagemaker notebook instance {notebook_instance.name} did not report DirectInternetAccess, so it could not be determined; verify manually."
            elif notebook_instance.direct_internet_access:
                report.status = "FAIL"
                report.status_extended = f"Sagemaker notebook instance {notebook_instance.name} has direct internet access enabled."

            findings.append(report)

        return findings

References