Notebook Direct Internet Access
More Info:
Ensure that Amazon SageMaker notebook instances are not publicly accessible.Risk Level
MediumAddress
Cost optimization, Operational Maturity, SecurityCompliance Standards
GDPR, HITRUST, SOC2Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Notebook Direct Internet Access for AWS DynamoDB using the AWS console, follow these steps:
- Access AWS Management Console: Go to the AWS Management Console at https://aws.amazon.com/ and log in with your credentials.
- Navigate to DynamoDB: Click on the “Services” dropdown menu at the top of the page and select “DynamoDB” under the “Database” category.
- Select the DynamoDB Table: In the DynamoDB dashboard, select the table that you want to remediate the direct internet access for.
-
Update Table VPC Settings:
- In the table details page, click on the “Overview” tab.
- Under the “VPC Settings” section, click on the “Edit” button.
-
Modify VPC Configuration:
- In the VPC configuration window, select the appropriate VPC from the dropdown menu.
- Choose the desired security group that allows access to the DynamoDB table.
- Ensure that the selected security group allows access only from trusted sources and restricts direct internet access.
- Save Changes: After updating the VPC settings and security group, click on the “Save” button to apply the changes.
-
Verify Configuration:
- Once the changes are saved, verify that the DynamoDB table no longer has direct internet access.
- Test the access to the DynamoDB table from authorized sources within the VPC.
Using CLI
Using CLI
To remediate the misconfiguration of allowing direct internet access to an AWS DynamoDB table, you can follow these steps using the AWS CLI:
-
Update the VPC Security Group:
- Identify the VPC security group associated with the DynamoDB table.
- Modify the inbound and outbound rules of the security group to restrict access only to trusted sources, such as specific IP addresses or other AWS resources within the VPC.
-
Deny Internet Access:
- Update the security group rules to deny inbound traffic from 0.0.0.0/0 (internet) to the DynamoDB table’s port (default is 443 for DynamoDB).
- Update the outbound rules to deny traffic from the DynamoDB table to the internet.
-
Verify Changes:
- Use the AWS CLI to describe the security group associated with the DynamoDB table to verify that the changes have been applied successfully.
-
Example AWS CLI Commands:
-
To describe the security group:
-
To update the inbound rules to deny internet access:
-
To update the outbound rules to deny internet access:
-
To describe the security group:
-
Monitor and Test:
- Monitor the DynamoDB table access logs and test the application to ensure that it is functioning correctly after the changes.
Using Python
Using Python
To remediate the misconfiguration of allowing direct internet access to an AWS DynamoDB table using Python, you can follow these steps:Step 1: Update the AWS Security Group associated with the DynamoDB table to restrict access only to specific IP addresses or VPC endpoints.Step 2: Use the AWS SDK for Python (Boto3) to modify the security group settings. Here’s a sample Python code snippet to update the security group:Replace
your_security_group_id with the actual security group ID associated with the DynamoDB table and your_allowed_ip_range with the specific IP address range that should have access to the DynamoDB table.Step 3: Run the Python script to update the security group settings and restrict access to the DynamoDB table.By following these steps and running the Python script, you can remediate the misconfiguration of allowing direct internet access to an AWS DynamoDB table by restricting access to specific IP addresses or VPC endpoints.