Notebook Direct Internet Access
Ensure Notebook Instance is not publicly available.
SageMaker notebooks should not be exposed to the Internet. Public availability can be configured via the DirectInternetAccess attribute.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
-
Log into the AWS Management Console.
-
Select the “Services” option and search for Sagemaker.
-
Scroll down the left navigation panel and choose the “Notebook instances” under “Notebook” in Amazon Sagemaker.
-
Select the “Notebook instance” that needs to be verified and click on the “Name” to access the selected “Notebook instance” configuration.
-
On the selected “Notebook instance” configuration page scroll down and check the “Network” tab. If “Direct internet access” is set to “Enabled” then the selected “Notebook instance” is exposed to the Internet.
-
Repeat step number 2 - 5 to verify other “Notebook instances” in the selected AWS region.
-
Navigate to “Sagemaker” and select the “Notebook instance” under “Notebook” and click on the “Create notebook instance” to create a new “Notebook instance” with data encrypted.
-
On the “Create notebook instance” page provide a unique name under the “Notebook instance name” and select the “Notebook instance type” as per the requirements.
-
Scroll down the “Create notebook instance” page and on the “Network” tab select the “VPC” from the dropdown menu and choose “Subnets & Security Groups” as per the requirements. Select the “Disable - Access the internet through a VPC” button under the “Direct internet access” to disable direct internet access for the new “Notebook instance”.
-
Click on the “Create notebook instance” button at the bottom to create a new “Notebook instance”.
-
Once the new “Notebook instance” status is “InService” copy all the data from old “Notebook instance” to the new instance.
-
Repeat steps number 7 - 11 to create the “Notebook instances” without exposing it to the Internet.