> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Sagemaker notebook instance vpc only enabled remediation ### Triage and Remediation ### Remediation To put a SageMaker notebook instance into **VPC‑only mode** using the AWS Console, you need the notebook: 1. Attached to a **VPC subnet and security group** 2. With **Direct internet access disabled** Note: You **cannot** change the VPC networking of an existing notebook that was created without a VPC. In that case, you must create a new VPC‑only notebook and migrate. *** ## A. If the notebook is already in a VPC (has subnet & security group) Here you only need to disable direct internet access. 1. **Open the SageMaker console** * Go to: `https://console.aws.amazon.com/sagemaker/` * In the left menu, choose **Notebook instances**. 2. **Stop the notebook instance** * Find your notebook instance. * If the status is **InService**, select it and choose **Actions → Stop**. * Wait until the status is **Stopped**. 3. **Edit the notebook instance** * Select the stopped notebook. * Choose **Actions → Update settings** (or **Edit** depending on console version). 4. **Disable direct internet access** * In the **Network** or **Internet access** section: * Set **Direct internet access** to **Disable**. * Confirm the other network settings (VPC, Subnet, Security groups) are already set; if they are, this notebook will now be VPC‑only. 5. **Save and restart** * Click **Update notebook instance**. * After the update completes, select the instance and choose **Actions → Start**. The instance now only communicates through the VPC (no direct internet access). *** ## B. If the notebook is NOT in a VPC (no subnet / SG options shown) You must create a new VPC‑only notebook and migrate your code/data. ### 1. Prepare VPC networking (if not already available) You need: * A **VPC** * One or more **subnets** (typically private subnets) * At least one **security group** * Optional but common: a **NAT Gateway** in a public subnet so the notebook can reach the internet via the VPC if needed (for pip installs, etc.), while still being VPC‑only from SageMaker’s perspective. These are usually already present in many environments; if not, create them via the **VPC console**. ### 2. Create a new VPC‑only SageMaker notebook 1. **Go to Notebook instances** * In SageMaker console, choose **Notebook instances → Create notebook instance**. 2. **Basic settings** * **Notebook instance name**: e.g., `my-notebook-vpc-only`. * **Notebook instance type**: same as old instance (or as required). * **IAM role**: choose the same role as the old instance if appropriate. 3. **Configure VPC‑only networking** * In the **Network** section: * **VPC**: choose your target VPC. * **Subnet**: choose a private subnet where you want the notebook to run. * **Security groups**: choose a security group that allows required traffic (e.g., to S3, training jobs, databases, etc. via VPC endpoints or NAT). * **Direct internet access**: set to **Disable**. 4. **Additional options** (optional) * Match lifecycle configuration, encryption keys (KMS), etc., with your existing environment. 5. **Create the notebook** * Click **Create notebook instance**. * Wait until status is **InService**. ### 3. Migrate content from old notebook Typical options: * **Using the same EBS volume (if possible)** * If your old notebook used its default volume and you want to re‑use it, you’d need to stop the old instance and re‑attach the volume to a new instance programmatically (this is easier via CLI and is more advanced). * **Export / import notebooks** * Open the old notebook instance. * In Jupyter/JupyterLab, download your notebooks (`.ipynb`), scripts, and data to your local machine or to S3. * Open the new VPC‑only notebook and upload the files or pull them from S3. * **Use S3 as a source of truth** * If your code/data already lives in S3 or a repo, just configure the new notebook to pull it (git clone, S3 copy, etc.). ### 4. Decommission the old non‑VPC notebook 1. Ensure all code/data is migrated. 2. In the SageMaker console → **Notebook instances**, stop the old notebook. 3. When no longer needed, select it and choose **Actions → Delete**. *** After these steps, your SageMaker notebook usage will be compliant with “Notebook Instance Should Be In VPC Only Mode” by ensuring: * It runs inside a **VPC subnet** with appropriate security groups. * **Direct internet access** is **disabled**. To put a SageMaker notebook instance into **VPC-only mode** using AWS CLI, you must: * Attach it to a VPC subnet and security group(s) * Disable direct internet access Below are step‑by‑step commands. *** ### 1. Prerequisites You must have: * A VPC ID (e.g., `vpc-0123456789abcdef0`) * A **private** subnet ID in that VPC (e.g., `subnet-0123456789abcdef0`) * One or more security group IDs (e.g., `sg-0123456789abcdef0`) * Your notebook instance name (e.g., `my-notebook`) If you need to look these up: ```bash theme={null} aws ec2 describe-vpcs aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0123456789abcdef0" aws ec2 describe-security-groups --filters "Name=vpc-id,Values=vpc-0123456789abcdef0" ``` *** ### 2. Confirm current notebook configuration (optional) ```bash theme={null} aws sagemaker describe-notebook-instance \ --notebook-instance-name my-notebook ``` Check `SubnetId`, `SecurityGroups`, and `DirectInternetAccess`. *** ### 3. Stop the notebook instance (required to update) ```bash theme={null} aws sagemaker stop-notebook-instance \ --notebook-instance-name my-notebook aws sagemaker wait notebook-instance-stopped \ --notebook-instance-name my-notebook ``` *** ### 4. Update notebook to VPC-only mode Use `update-notebook-instance` to: * Set `--subnet-id` and `--security-group-ids` * Set `--direct-internet-access Disabled` ```bash theme={null} aws sagemaker update-notebook-instance \ --notebook-instance-name my-notebook \ --subnet-id subnet-0123456789abcdef0 \ --security-group-ids sg-0123456789abcdef0 sg-0fedcba9876543210 \ --direct-internet-access Disabled ``` Notes: * The subnet must be in the specified VPC and have required routing (e.g., to a NAT gateway or VPC endpoints, depending on how you want the notebook to reach AWS services). * Security groups should allow required outbound traffic (e.g., to SageMaker, S3 via VPC endpoints, etc.). *** ### 5. Start the notebook instance ```bash theme={null} aws sagemaker start-notebook-instance \ --notebook-instance-name my-notebook aws sagemaker wait notebook-instance-in-service \ --notebook-instance-name my-notebook ``` *** ### 6. Verify VPC-only configuration ```bash theme={null} aws sagemaker describe-notebook-instance \ --notebook-instance-name my-notebook \ --query '{SubnetId:SubnetId,SecurityGroups:SecurityGroups,DirectInternetAccess:DirectInternetAccess}' ``` You should see: * `SubnetId` set * `SecurityGroups` list populated * `DirectInternetAccess` = `"Disabled"` (VPC-only mode) To force a SageMaker Notebook Instance into **VPC-only mode** using Python (boto3), you must: * Stop the notebook * Attach it to a VPC (subnet + security groups) * Disable direct internet access Below is a step‑by‑step approach. *** ## 1. Prerequisites * `boto3` installed and configured with AWS credentials/region. * An existing **VPC subnet ID** and one or more **security group IDs** that allow the traffic you need (e.g., to SageMaker, S3 via VPC endpoint, etc.). ```bash theme={null} pip install boto3 ``` *** ## 2. Identify the Notebook and Target VPC Settings Decide: * `NOTEBOOK_INSTANCE_NAME` * `SUBNET_ID` (e.g., `subnet-0123456789abcdef0`) * `SECURITY_GROUP_IDS` (e.g., `['sg-0123456789abcdef0']`) *** ## 3. Stop the Notebook Instance (if running) SageMaker does **not** allow modifying network settings on a running notebook. Stop it first: ```python theme={null} import boto3 import time sm = boto3.client("sagemaker") NOTEBOOK_INSTANCE_NAME = "my-notebook-instance" def wait_for_notebook_status(name, target_status): while True: resp = sm.describe_notebook_instance(NotebookInstanceName=name) status = resp["NotebookInstanceStatus"] if status == target_status: break time.sleep(10) # Stop if not already stopped resp = sm.describe_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME) if resp["NotebookInstanceStatus"] != "Stopped": sm.stop_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME) wait_for_notebook_status(NOTEBOOK_INSTANCE_NAME, "Stopped") ``` *** ## 4. Update Notebook to VPC-Only Mode Use `update_notebook_instance` to: * **Set SubnetId and SecurityGroupIds** (attach to VPC) * **Disable DirectInternetAccess** (`'Disabled'` = VPC‑only) ```python theme={null} SUBNET_ID = "subnet-0123456789abcdef0" SECURITY_GROUP_IDS = ["sg-0123456789abcdef0"] # list of one or more SG IDs sm.update_notebook_instance( NotebookInstanceName=NOTEBOOK_INSTANCE_NAME, SubnetId=SUBNET_ID, SecurityGroupIds=SECURITY_GROUP_IDS, DirectInternetAccess="Disabled", # Enforces VPC-only mode ) ``` Note: * You can supply only the parameters you want to change; the above shows them explicitly. * If the notebook was already in a subnet/SG but with direct internet access enabled, you can just call with `DirectInternetAccess="Disabled"`. *** ## 5. Start the Notebook Instance ```python theme={null} sm.start_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME) wait_for_notebook_status(NOTEBOOK_INSTANCE_NAME, "InService") ``` At this point, the notebook is: * Attached to your VPC (`SubnetId` + `SecurityGroupIds`) * Running with **DirectInternetAccess disabled** → VPC-only mode. *** ## 6. (Optional) Enforce for New Notebooks (Example) When creating **new** notebook instances, specify these options up front: ```python theme={null} sm.create_notebook_instance( NotebookInstanceName="my-new-notebook", InstanceType="ml.t3.medium", RoleArn="arn:aws:iam:::role/SageMakerExecutionRole", SubnetId=SUBNET_ID, SecurityGroupIds=SECURITY_GROUP_IDS, DirectInternetAccess="Disabled", ) ``` This ensures all new notebooks are compliant by default. ```hcl theme={null} # New VPC-only SageMaker notebook instance (replacement for the old one) resource "aws_sagemaker_notebook_instance" "NOTEBOOK_VPC_ONLY" { # Change this to the new name you want, e.g. "-vpc-only" name = "NEW_NOTEBOOK_NAME_VPC_ONLY" # replace with desired notebook name instance_type = "INSTANCE_TYPE_FROM_OLD_NOTEBOOK" # e.g. "ml.t3.medium" role_arn = "IAM_ROLE_ARN_FROM_OLD_NOTEBOOK" # Ensure the notebook is in VPC-only mode: subnet_id = "SUBNET_ID_FROM_OLD_NOTEBOOK" security_groups = [ "SECURITY_GROUP_ID_1_FROM_OLD_NOTEBOOK", # add any additional security group IDs from the old instance ] # Critical setting for VPC-only mode: disable direct internet access direct_internet_access = "Disabled" # Optional: copy these from the existing notebook configuration if used kms_key_id = "KMS_KEY_ID_FROM_OLD_NOTEBOOK" # optional lifecycle_config_name = "LIFECYCLE_CONFIG_NAME_FROM_OLD_NOTEBOOK" # optional tags = { # copy existing tags "KEY1" = "VALUE1" "KEY2" = "VALUE2" } } ``` * This change **forces replacement** of the notebook instance: the `direct_internet_access` setting cannot be changed in-place. You must: * Create this new VPC-only notebook (with a new `name`). * Manually migrate any data from the old notebook’s volume to the new one. * Then remove the old `aws_sagemaker_notebook_instance` resource from Terraform (or mark it `lifecycle { prevent_destroy = false }` and let Terraform destroy it) and/or delete it in the console/CLI once migration is complete. * WARNING: This is a destructive operation for the old instance; any data on its EBS volume not backed up or migrated will be lost when it is deleted. Verification with Terraform: * `terraform plan` should show: * `+` creation of `aws_sagemaker_notebook_instance.NOTEBOOK_VPC_ONLY` with `direct_internet_access = "Disabled"` and VPC settings (`subnet_id`, `security_groups`) set. * `-` destruction of the old non-compliant notebook instance resource once you remove it from your configuration or rename resources appropriately.