AWS SageMaker notebook instance is not placed in VPC misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_306
Category - Subcategory	Public Exposure - VPC VCN VNet
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	e776dc78-2f1a-4b19-b86f-79eeec8c90c0

Impact

If a SageMaker notebook instance is not launched into a custom VPC, it might be exposed to security vulnerabilities. This exposure could arise from traffic not being restricted to a confined, secure environment. An instance launched outside of a custom VPC might also be at risk of unwanted access from unknown entities, which could lead to potential data breaches or unauthorized changes.

Therefore, launching instances into a custom VPC helps in the prevention of unauthorized access, minimizes attack surface, and provides a more secure and controlled environment. It helps safeguard valuable data and promotes safe business practices.

How to Fix

Resource: aws_sagemaker_notebook_instance

• Arguments: subnet_id

To fix this issue, you need to specify a subnet_id to create your SageMaker Notebook instance within a pre-defined VPC. Here is an example: [source,go]

resource "aws_sagemaker_notebook_instance" "notebook" { name = "notebook" role_arn = aws_iam_role.role.arn

• subnet_id = aws_subnet.example.id # This launches it within a custom VPC instance_type = "ml.t2.medium"

lifecycle_config_name = aws_sagemaker_notebook_instance_lifecycle_configuration.lifecycle_configuration.name }