Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · SageMaker

SageMaker.11: Data quality jobs network isolation

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub SageMaker.11 check?

SageMaker.11 fails when a data quality job definition has `EnableNetworkIsolation` set to false, leaving the job's containers internet-enabled by default.

Why does SageMaker.11 matter?

Network isolation does more than block packets: when on, AWS withholds AWS credentials from the container's runtime entirely, so even a malicious or buggy container has nothing to call the AWS API with. For data quality jobs, where SageMaker stages the input and output for you, isolation rarely costs anything, and leaving it off means a job container can reach out unrestricted.

How do I fix SageMaker.11?

  1. List data quality job definitions and check `EnableNetworkIsolation` to find the failing ones.
  2. Recreate each definition with isolation enabled; the setting is immutable, so it cannot be patched.
  3. Confirm the job's input and baseline data are staged so it does not need a runtime call-out under isolation.
  4. Make isolation the default in your IaC, and fix siblings .12 and .14 in the same pass.

Remediation script · bash

# Disable root across every notebook that has it on (mutable on a stopped instance).
for n in $(aws sagemaker list-notebook-instances \
    --query 'NotebookInstances[].NotebookInstanceName' --output text); do
  root=$(aws sagemaker describe-notebook-instance --notebook-instance-name "$n" \
    --query 'RootAccess' --output text)
  if [ "$root" = "Enabled" ]; then
    aws sagemaker stop-notebook-instance --notebook-instance-name "$n"
    aws sagemaker wait notebook-instance-stopped --notebook-instance-name "$n"
    aws sagemaker update-notebook-instance --notebook-instance-name "$n" --root-access Disabled
    aws sagemaker start-notebook-instance --notebook-instance-name "$n"
    echo "$n: root access disabled"
  fi
done

# Immutable settings need a rebuild. Recreate a notebook locked down: private subnet,
# no direct internet. (DirectInternetAccess and SubnetId cannot be changed in place.)
aws sagemaker create-notebook-instance \
  --notebook-instance-name ml-feature-exploration \
  --instance-type ml.t3.medium \
  --role-arn arn:aws:iam::111122223333:role/SageMakerExecution \
  --subnet-id subnet-0ab12cd34ef56 \
  --security-group-ids sg-0aa11bb22cc33 \
  --direct-internet-access Disabled \
  --root-access Disabled

Full walkthrough (console steps, edge cases and verification) in the lesson Harden SageMaker and ML workloads.

Is SageMaker.11 a false positive?

Network isolation cuts off all outbound calls and strips the container's AWS credentials, which breaks a data quality job that genuinely needs to reach out at runtime: a bring-your-own-container monitor that pulls a package or model artifact from a private registry, calls a VPC-hosted feature service, or fetches a baseline from somewhere SageMaker doesn't stage for it. Such a definition correctly fails SageMaker.11 yet is configured as intended, because isolation would stop the job from running at all. The handling is to confirm the runtime dependency is real (not just unoptimised staging), then suppress the finding with a note naming the call-out the job requires, rather than enabling isolation and silently breaking the monitor.

Full lesson Harden SageMaker and ML workloads Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for SageMaker controls ↗ Check your own account for SageMaker.11 →
Part of the learning path Lock down access

More SageMaker controls