# SageMaker Notebook Not In A VPC

> No subnet on a SageMaker notebook means the instance runs on a SageMaker-managed network where none of your security groups, route tables, or VPC endpoints apply. ZopNight flags in-service notebooks whose subnetId is confirmed empty at discovery; attachment happens only at creation, so remediation is a rebuild into 1 chosen subnet.

Source: https://zop.dev/integrations/aws/recommendations/sagemaker-notebook-not-in-a-vpc
Updated: 2026-08-19

---

## A workload your network model does not contain

Every diagram of your VPC (the security groups, the inspected egress, the private S3 access
through endpoints) describes traffic from resources inside it. A notebook created without a
subnet is not in that diagram. Its traffic originates from a SageMaker-managed network, so the
controls your organisation reasons with simply do not apply to one of the most data-heavy
interactive workloads you run. That mismatch, not any specific packet, is the finding.

## How the condition is proven

The discoverer records `subnetId` from the notebook description only when the describe call
succeeds; a present-but-empty value is the API's own statement that no VPC attachment exists,
and that is the only state that fires. Failed describes leave the field absent and the rule
silent. The status gate matters too: only in-service notebooks are flagged, because a
stopped or failed instance is the deletion-review rule's territory.

## Enumerate the unattached fleet

```bash
aws sagemaker list-notebook-instances --query 'NotebookInstances[].NotebookInstanceName' --output text \
  | xargs -n1 -I{} aws sagemaker describe-notebook-instance --notebook-instance-name {} \
      --query '[NotebookInstanceName,SubnetId,DirectInternetAccess]' --output text
```

Rows with an empty subnet column are this finding; the third column tells you whether the
sibling internet-access finding fires alongside.

## Rebuilding into the VPC properly

VPC placement is a creation-time property, so the remediation is a replacement instance in a
private subnet with a purpose-built security group. Plan the notebook's dependencies before
the move: S3 access flows through a gateway endpoint, the SageMaker API and Runtime need
interface endpoints (or NAT), and package installs need either NAT egress or an internal
mirror. A notebook moved into a VPC without those paths "breaks" on day one and generates
pressure to move it back out. That is the failure mode that keeps this finding alive in fleets.

## Severity in context

Rated medium rather than high: the managed network is not an open door, and the exposure is
governance rather than direct reachability. Combined with direct internet access enabled,
though, the pair describes a data-rich instance with ungoverned egress. Resolve them in the
same rebuild, and encode VPC attachment in the template that creates notebooks so the class
dies at the source.