AWS Security Hub · SageMaker
SageMaker.12: Model bias jobs network isolation
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub SageMaker.12 check?
SageMaker.12 fails when a model bias job definition has `EnableNetworkIsolation` set to false. SageMaker containers are internet-enabled by default, so this is the common state unless you opt in.
Why does SageMaker.12 matter?
Isolation is strict: with it on, the container cannot reach the internet, other AWS services, or even S3 directly, and it loses its runtime AWS credentials, closing off the easiest exfiltration and lateral-movement paths from a bias job. The trade-off is that you must stage the baseline and input data so the job needs no runtime call-out.
How do I fix SageMaker.12?
- Audit model bias job definitions for `EnableNetworkIsolation` set to false.
- Recreate each failing definition with isolation enabled; it is a create-time-only setting, so you cannot patch it.
- Plan where baseline and input data live so the isolated job can run without reaching out at runtime.
- Update a running monitoring schedule to point at the new definition rather than editing in place; fix siblings .11 and .14 too.
Remediation script · bash
# Disable root across every notebook that has it on (mutable on a stopped instance).
for n in $(aws sagemaker list-notebook-instances \
--query 'NotebookInstances[].NotebookInstanceName' --output text); do
root=$(aws sagemaker describe-notebook-instance --notebook-instance-name "$n" \
--query 'RootAccess' --output text)
if [ "$root" = "Enabled" ]; then
aws sagemaker stop-notebook-instance --notebook-instance-name "$n"
aws sagemaker wait notebook-instance-stopped --notebook-instance-name "$n"
aws sagemaker update-notebook-instance --notebook-instance-name "$n" --root-access Disabled
aws sagemaker start-notebook-instance --notebook-instance-name "$n"
echo "$n: root access disabled"
fi
done
# Immutable settings need a rebuild. Recreate a notebook locked down: private subnet,
# no direct internet. (DirectInternetAccess and SubnetId cannot be changed in place.)
aws sagemaker create-notebook-instance \
--notebook-instance-name ml-feature-exploration \
--instance-type ml.t3.medium \
--role-arn arn:aws:iam::111122223333:role/SageMakerExecution \
--subnet-id subnet-0ab12cd34ef56 \
--security-group-ids sg-0aa11bb22cc33 \
--direct-internet-access Disabled \
--root-access DisabledFull walkthrough (console steps, edge cases and verification) in the lesson Harden SageMaker and ML workloads.
Is SageMaker.12 a false positive?
A custom bias-analysis container that has to reach a VPC endpoint, a private model registry, or another AWS service at runtime cannot run under network isolation: isolation blocks every outbound call and removes the container's AWS credentials, so the job would simply fail. A definition left with `EnableNetworkIsolation` false for that reason fails SageMaker.12 while being correctly configured for its workload. The right response is to verify the call-out is a genuine requirement of your container, ideally route it through a VPC interface endpoint so the job stays off the public internet, and then suppress the finding with a note explaining why isolation can't be enabled, rather than turning it on and breaking the analysis.
More SageMaker controls
- SageMaker.1 A SageMaker notebook has direct internet access
- SageMaker.2 A SageMaker notebook is not launched in a VPC
- SageMaker.3 Users have root access on a SageMaker notebook
- SageMaker.4 Endpoint variants should have > 1 instance
- SageMaker.5 Models should have network isolation enabled
- SageMaker.8 Notebook instances should run supported platforms
- SageMaker.9 Data quality jobs inter-container encryption
- SageMaker.10 Explainability jobs inter-container encryption
- SageMaker.11 Data quality jobs network isolation
- SageMaker.13 Model quality jobs inter-container encryption
- SageMaker.14 Monitoring schedules network isolation
- SageMaker.15 Model bias jobs inter-container encryption