AWS SageMaker model does not use network isolation misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_370
Category - Subcategory	Public Exposure - VPC VCN VNet
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule checks whether Amazon SageMaker models leverage network isolation. Network isolation restricts unauthorized network communication between computing resources, enhancing security. When enabled for SageMaker models, it ensures inference code runs in an internet-free environment, safeguarding your models and data sets from potential breaches. A violation of this rule indicates that the SageMaker model's network isolation is disabled, potentially exposing your models and data to security threats. Enabling network isolation strengthens your security posture and protects your valuable assets.

How to Fix

Resource: AWS::SageMaker::Model

• Arguments: Properties/EnableNetworkIsolation

Enable the network isolation parameter within the AWS::SageMaker::Model resource in your CloudFormation template. This restricts unauthorized network access and strengthens your security posture. [source,go]

Resources: SageMakerModelPass: Type: 'AWS::SageMaker::Model' Properties: ...

• EnableNetworkIsolation: True

---