Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · SageMaker

SageMaker.16: Private registry for primary containers

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub SageMaker.16 check?

SageMaker.16 fails when a model's `PrimaryContainer` pulls its image with `RepositoryAccessMode` set to `Platform` (a public pull) rather than `Vpc`, which restricts it to a private registry reached over VPC endpoints.

Why does SageMaker.16 matter?

A public image pull trusts whatever answers. Supply-chain attacks exploit exactly this: publishing look-alike images to public registries and betting a misconfigured deployment pulls them by mistake. With `RepositoryAccessMode` set to `Vpc`, the model can only pull from a private registry you have explicitly wired into your network, so there is no public path for a malicious image to sneak in.

How do I fix SageMaker.16?

  1. Audit your models and inspect the `PrimaryContainer` `ImageConfig` and `RepositoryAccessMode`.
  2. Host the inference image in a private registry (such as Amazon ECR) reachable over an interface VPC endpoint.
  3. Recreate the model with `RepositoryAccessMode` set to `Vpc` and an IAM role SageMaker can assume to reach the registry.
  4. Default new models to private-registry pulls; note SageMaker.19 covers the multi-container pipeline case.

Remediation script · bash

# Disable root across every notebook that has it on (mutable on a stopped instance).
for n in $(aws sagemaker list-notebook-instances \
    --query 'NotebookInstances[].NotebookInstanceName' --output text); do
  root=$(aws sagemaker describe-notebook-instance --notebook-instance-name "$n" \
    --query 'RootAccess' --output text)
  if [ "$root" = "Enabled" ]; then
    aws sagemaker stop-notebook-instance --notebook-instance-name "$n"
    aws sagemaker wait notebook-instance-stopped --notebook-instance-name "$n"
    aws sagemaker update-notebook-instance --notebook-instance-name "$n" --root-access Disabled
    aws sagemaker start-notebook-instance --notebook-instance-name "$n"
    echo "$n: root access disabled"
  fi
done

# Immutable settings need a rebuild. Recreate a notebook locked down: private subnet,
# no direct internet. (DirectInternetAccess and SubnetId cannot be changed in place.)
aws sagemaker create-notebook-instance \
  --notebook-instance-name ml-feature-exploration \
  --instance-type ml.t3.medium \
  --role-arn arn:aws:iam::111122223333:role/SageMakerExecution \
  --subnet-id subnet-0ab12cd34ef56 \
  --security-group-ids sg-0aa11bb22cc33 \
  --direct-internet-access Disabled \
  --root-access Disabled

Full walkthrough (console steps, edge cases and verification) in the lesson Harden SageMaker and ML workloads.

Is SageMaker.16 a false positive?

The control fails whenever `RepositoryAccessMode` is `Platform` (or the image config is absent), which is exactly how a model built on an AWS-managed deep learning or first-party algorithm image is meant to run: those images live in AWS's own ECR accounts and are pulled in Platform mode, and rehosting them privately is often impractical or unsupported. A finding on such a model is technically correct but not a real supply-chain exposure, because the image source is AWS itself, not an untrusted public registry. Where you've deliberately standardised on a vetted AWS-provided image, document a Security Hub suppression that records the image URI and its provenance, rather than recreating the model just to satisfy the check.

Full lesson Harden SageMaker and ML workloads Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for SageMaker controls ↗ Check your own account for SageMaker.16 →
Part of the learning path Lock down access

More SageMaker controls