Skip to main content
compliance · aws

SageMaker notebooks with a direct route to the public internet

resource types
1
rule IDs covered
1
severity
high

What does ZopNight detect here?

Direct internet access gives a notebook a SageMaker-managed egress path that bypasses your VPC's security groups, NAT, and endpoint policies entirely. ZopNight fires on in-service notebooks whose directInternetAccess reads Enabled; closing the gap means recreating the instance inside a VPC subnet, since the 1 setting is fixed at creation.

Signal and threshold

How ZopNight evaluates SageMaker notebooks with a direct route to the public internet.
Field Value
Rule IDsRC-1617
Categorycompliance
Severityhigh
Metricnone — pure configuration read
Sourcesagemaker_compliance.go

The egress path your network team cannot see

With direct internet access enabled, a notebook reaches the internet through a SageMaker-managed network path: not through your subnets, not through your NAT gateways, not subject to your security groups or egress inspection. Data on that notebook (and training data mounted into it) can leave through a door your VPC controls do not cover. For a service whose whole workload is loading datasets and pulling packages, “egress nobody governs” is the finding, not a technicality.

Why remediation is a recreate

Unlike root access, this setting is fixed when the instance is created. Turning it off means recreating the notebook inside a VPC subnet with direct internet access disabled, then providing whatever outbound reach users actually need through governed paths: a NAT gateway for general egress, or VPC endpoints for S3 and the SageMaker APIs when the goal is keeping traffic on the AWS network entirely. Budget for the migration as user-visible work, since home directories on the old instance need moving via EBS snapshot or S3.

What fires and what abstains

The rule reads the discoverer-stamped directInternetAccess state and fires only on a confirmed Enabled for an in-service instance. Notebooks in stopped or failed states are out of scope, and an instance whose describe call failed contributes no finding. Absence of evidence never reads as exposure.

Audit the fleet in one pass

Terminal window
aws sagemaker list-notebook-instances --query 'NotebookInstances[].NotebookInstanceName' --output text \
| xargs -n1 -I{} aws sagemaker describe-notebook-instance --notebook-instance-name {} \
--query '[NotebookInstanceName,DirectInternetAccess,SubnetId]' --output text

Pair it with the VPC finding

An instance with direct internet access enabled and no subnet is the fully unmanaged case and will also trip the not-in-a-VPC rule; the two findings resolve together in one recreation. Doing the pair properly (private subnet, restrictive security group, S3 and SageMaker API endpoints, internet access off) produces a notebook whose network posture matches the rest of your VPC workloads instead of standing outside them.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·