> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sagemaker Notebook Instance Should Be In VPC Only Mode

### More Info:

Sagemaker Notebook Instance should be in VPC only mode

### Risk Level

Medium

### Address

Monitoring, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* ISO 27001
* ISO/IEC 27018
* ISO/IEC 27701
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To put a SageMaker notebook instance into **VPC‑only mode** using the AWS Console, you need the notebook:

        1. Attached to a **VPC subnet and security group**
        2. With **Direct internet access disabled**

        Note: You **cannot** change the VPC networking of an existing notebook that was created without a VPC. In that case, you must create a new VPC‑only notebook and migrate.

        ***

        ## A. If the notebook is already in a VPC (has subnet & security group)

        Here you only need to disable direct internet access.

        1. **Open the SageMaker console**
           * Go to: `https://console.aws.amazon.com/sagemaker/`
           * In the left menu, choose **Notebook instances**.

        2. **Stop the notebook instance**
           * Find your notebook instance.
           * If the status is **InService**, select it and choose **Actions → Stop**.
           * Wait until the status is **Stopped**.

        3. **Edit the notebook instance**
           * Select the stopped notebook.
           * Choose **Actions → Update settings** (or **Edit** depending on console version).

        4. **Disable direct internet access**
           * In the **Network** or **Internet access** section:
             * Set **Direct internet access** to **Disable**.
           * Confirm the other network settings (VPC, Subnet, Security groups) are already set; if they are, this notebook will now be VPC‑only.

        5. **Save and restart**
           * Click **Update notebook instance**.
           * After the update completes, select the instance and choose **Actions → Start**.

        The instance now only communicates through the VPC (no direct internet access).

        ***

        ## B. If the notebook is NOT in a VPC (no subnet / SG options shown)

        You must create a new VPC‑only notebook and migrate your code/data.

        ### 1. Prepare VPC networking (if not already available)

        You need:

        * A **VPC**
        * One or more **subnets** (typically private subnets)
        * At least one **security group**
        * Optional but common: a **NAT Gateway** in a public subnet so the notebook can reach the internet via the VPC if needed (for pip installs, etc.), while still being VPC‑only from SageMaker’s perspective.

        These are usually already present in many environments; if not, create them via the **VPC console**.

        ### 2. Create a new VPC‑only SageMaker notebook

        1. **Go to Notebook instances**
           * In SageMaker console, choose **Notebook instances → Create notebook instance**.

        2. **Basic settings**
           * **Notebook instance name**: e.g., `my-notebook-vpc-only`.
           * **Notebook instance type**: same as old instance (or as required).
           * **IAM role**: choose the same role as the old instance if appropriate.

        3. **Configure VPC‑only networking**
           * In the **Network** section:
             * **VPC**: choose your target VPC.
             * **Subnet**: choose a private subnet where you want the notebook to run.
             * **Security groups**: choose a security group that allows required traffic (e.g., to S3, training jobs, databases, etc. via VPC endpoints or NAT).
           * **Direct internet access**: set to **Disable**.

        4. **Additional options** (optional)
           * Match lifecycle configuration, encryption keys (KMS), etc., with your existing environment.

        5. **Create the notebook**
           * Click **Create notebook instance**.
           * Wait until status is **InService**.

        ### 3. Migrate content from old notebook

        Typical options:

        * **Using the same EBS volume (if possible)**
          * If your old notebook used its default volume and you want to re‑use it, you’d need to stop the old instance and re‑attach the volume to a new instance programmatically (this is easier via CLI and is more advanced).
        * **Export / import notebooks**
          * Open the old notebook instance.
          * In Jupyter/JupyterLab, download your notebooks (`.ipynb`), scripts, and data to your local machine or to S3.
          * Open the new VPC‑only notebook and upload the files or pull them from S3.
        * **Use S3 as a source of truth**
          * If your code/data already lives in S3 or a repo, just configure the new notebook to pull it (git clone, S3 copy, etc.).

        ### 4. Decommission the old non‑VPC notebook

        1. Ensure all code/data is migrated.
        2. In the SageMaker console → **Notebook instances**, stop the old notebook.
        3. When no longer needed, select it and choose **Actions → Delete**.

        ***

        After these steps, your SageMaker notebook usage will be compliant with “Notebook Instance Should Be In VPC Only Mode” by ensuring:

        * It runs inside a **VPC subnet** with appropriate security groups.
        * **Direct internet access** is **disabled**.
      </Accordion>

      <Accordion title="Using CLI">
        To put a SageMaker notebook instance into **VPC-only mode** using AWS CLI, you must:

        * Attach it to a VPC subnet and security group(s)
        * Disable direct internet access

        Below are step‑by‑step commands.

        ***

        ### 1. Prerequisites

        You must have:

        * A VPC ID (e.g., `vpc-0123456789abcdef0`)
        * A **private** subnet ID in that VPC (e.g., `subnet-0123456789abcdef0`)
        * One or more security group IDs (e.g., `sg-0123456789abcdef0`)
        * Your notebook instance name (e.g., `my-notebook`)

        If you need to look these up:

        ```bash theme={null}
        aws ec2 describe-vpcs
        aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"
        aws ec2 describe-security-groups --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"
        ```

        ***

        ### 2. Confirm current notebook configuration (optional)

        ```bash theme={null}
        aws sagemaker describe-notebook-instance \
          --notebook-instance-name my-notebook
        ```

        Check `SubnetId`, `SecurityGroups`, and `DirectInternetAccess`.

        ***

        ### 3. Stop the notebook instance (required to update)

        ```bash theme={null}
        aws sagemaker stop-notebook-instance \
          --notebook-instance-name my-notebook

        aws sagemaker wait notebook-instance-stopped \
          --notebook-instance-name my-notebook
        ```

        ***

        ### 4. Update notebook to VPC-only mode

        Use `update-notebook-instance` to:

        * Set `--subnet-id` and `--security-group-ids`
        * Set `--direct-internet-access Disabled`

        ```bash theme={null}
        aws sagemaker update-notebook-instance \
          --notebook-instance-name my-notebook \
          --subnet-id subnet-0123456789abcdef0 \
          --security-group-ids sg-0123456789abcdef0 sg-0fedcba9876543210 \
          --direct-internet-access Disabled
        ```

        Notes:

        * The subnet must be in the specified VPC and have required routing (e.g., to a NAT gateway or VPC endpoints, depending on how you want the notebook to reach AWS services).
        * Security groups should allow required outbound traffic (e.g., to SageMaker, S3 via VPC endpoints, etc.).

        ***

        ### 5. Start the notebook instance

        ```bash theme={null}
        aws sagemaker start-notebook-instance \
          --notebook-instance-name my-notebook

        aws sagemaker wait notebook-instance-in-service \
          --notebook-instance-name my-notebook
        ```

        ***

        ### 6. Verify VPC-only configuration

        ```bash theme={null}
        aws sagemaker describe-notebook-instance \
          --notebook-instance-name my-notebook \
          --query '{SubnetId:SubnetId,SecurityGroups:SecurityGroups,DirectInternetAccess:DirectInternetAccess}'
        ```

        You should see:

        * `SubnetId` set
        * `SecurityGroups` list populated
        * `DirectInternetAccess` = `"Disabled"` (VPC-only mode)
      </Accordion>

      <Accordion title="Using Python">
        To force a SageMaker Notebook Instance into **VPC-only mode** using Python (boto3), you must:

        * Stop the notebook
        * Attach it to a VPC (subnet + security groups)
        * Disable direct internet access

        Below is a step‑by‑step approach.

        ***

        ## 1. Prerequisites

        * `boto3` installed and configured with AWS credentials/region.
        * An existing **VPC subnet ID** and one or more **security group IDs** that allow the traffic you need (e.g., to SageMaker, S3 via VPC endpoint, etc.).

        ```bash theme={null}
        pip install boto3
        ```

        ***

        ## 2. Identify the Notebook and Target VPC Settings

        Decide:

        * `NOTEBOOK_INSTANCE_NAME`
        * `SUBNET_ID` (e.g., `subnet-0123456789abcdef0`)
        * `SECURITY_GROUP_IDS` (e.g., `['sg-0123456789abcdef0']`)

        ***

        ## 3. Stop the Notebook Instance (if running)

        SageMaker does **not** allow modifying network settings on a running notebook. Stop it first:

        ```python theme={null}
        import boto3
        import time

        sm = boto3.client("sagemaker")

        NOTEBOOK_INSTANCE_NAME = "my-notebook-instance"

        def wait_for_notebook_status(name, target_status):
            while True:
                resp = sm.describe_notebook_instance(NotebookInstanceName=name)
                status = resp["NotebookInstanceStatus"]
                if status == target_status:
                    break
                time.sleep(10)

        # Stop if not already stopped
        resp = sm.describe_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME)
        if resp["NotebookInstanceStatus"] != "Stopped":
            sm.stop_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME)
            wait_for_notebook_status(NOTEBOOK_INSTANCE_NAME, "Stopped")
        ```

        ***

        ## 4. Update Notebook to VPC-Only Mode

        Use `update_notebook_instance` to:

        * **Set SubnetId and SecurityGroupIds** (attach to VPC)
        * **Disable DirectInternetAccess** (`'Disabled'` = VPC‑only)

        ```python theme={null}
        SUBNET_ID = "subnet-0123456789abcdef0"
        SECURITY_GROUP_IDS = ["sg-0123456789abcdef0"]  # list of one or more SG IDs

        sm.update_notebook_instance(
            NotebookInstanceName=NOTEBOOK_INSTANCE_NAME,
            SubnetId=SUBNET_ID,
            SecurityGroupIds=SECURITY_GROUP_IDS,
            DirectInternetAccess="Disabled",  # Enforces VPC-only mode
        )
        ```

        Note:

        * You can supply only the parameters you want to change; the above shows them explicitly.
        * If the notebook was already in a subnet/SG but with direct internet access enabled, you can just call with `DirectInternetAccess="Disabled"`.

        ***

        ## 5. Start the Notebook Instance

        ```python theme={null}
        sm.start_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME)
        wait_for_notebook_status(NOTEBOOK_INSTANCE_NAME, "InService")
        ```

        At this point, the notebook is:

        * Attached to your VPC (`SubnetId` + `SecurityGroupIds`)
        * Running with **DirectInternetAccess disabled** → VPC-only mode.

        ***

        ## 6. (Optional) Enforce for New Notebooks (Example)

        When creating **new** notebook instances, specify these options up front:

        ```python theme={null}
        sm.create_notebook_instance(
            NotebookInstanceName="my-new-notebook",
            InstanceType="ml.t3.medium",
            RoleArn="arn:aws:iam::<account-id>:role/SageMakerExecutionRole",
            SubnetId=SUBNET_ID,
            SecurityGroupIds=SECURITY_GROUP_IDS,
            DirectInternetAccess="Disabled",
        )
        ```

        This ensures all new notebooks are compliant by default.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>