Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · SageMaker

SageMaker.19: Private registry for multi-container pipelines

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub SageMaker.19 check?

SageMaker.19 fails when any container in a multi-container model's `Containers` array pulls from a public registry rather than a private one in your VPC. Unlike SageMaker.16, it checks every container in an inference pipeline, not just the primary one.

Why does SageMaker.19 matter?

An inference pipeline is only as trustworthy as its least-trusted image. A single container pulled from a public registry under a mutable `:latest` tag means your "frozen" production pipeline silently runs whatever the upstream maintainer pushed last, a supply-chain and reproducibility hole at once. Pinning every container to a private, digest-locked copy closes both.

How do I fix SageMaker.19?

  1. Inspect each model's `Containers` array and flag any container not using `RepositoryAccessMode` set to `Vpc`.
  2. Host every image privately in Amazon ECR behind a VPC interface endpoint (or use `RepositoryAuthConfig` with a Lambda hook for non-ECR registries).
  3. Recreate the model (models are immutable, so you cannot patch the container list), pointing all containers at the private registry.
  4. Pin images by digest, not `:latest`, and default new pipelines to private pulls.

Remediation script · bash

# Disable root across every notebook that has it on (mutable on a stopped instance).
for n in $(aws sagemaker list-notebook-instances \
    --query 'NotebookInstances[].NotebookInstanceName' --output text); do
  root=$(aws sagemaker describe-notebook-instance --notebook-instance-name "$n" \
    --query 'RootAccess' --output text)
  if [ "$root" = "Enabled" ]; then
    aws sagemaker stop-notebook-instance --notebook-instance-name "$n"
    aws sagemaker wait notebook-instance-stopped --notebook-instance-name "$n"
    aws sagemaker update-notebook-instance --notebook-instance-name "$n" --root-access Disabled
    aws sagemaker start-notebook-instance --notebook-instance-name "$n"
    echo "$n: root access disabled"
  fi
done

# Immutable settings need a rebuild. Recreate a notebook locked down: private subnet,
# no direct internet. (DirectInternetAccess and SubnetId cannot be changed in place.)
aws sagemaker create-notebook-instance \
  --notebook-instance-name ml-feature-exploration \
  --instance-type ml.t3.medium \
  --role-arn arn:aws:iam::111122223333:role/SageMakerExecution \
  --subnet-id subnet-0ab12cd34ef56 \
  --security-group-ids sg-0aa11bb22cc33 \
  --direct-internet-access Disabled \
  --root-access Disabled

Full walkthrough (console steps, edge cases and verification) in the lesson Harden SageMaker and ML workloads.

Is SageMaker.19 a false positive?

Because the control flags any container in the `Containers` array that pulls in `Platform` mode, an inference pipeline that legitimately mixes an AWS-managed image (such as a first-party preprocessing or deep learning container, which is only published in AWS's own ECR and pulled in Platform mode) with your private images will fail even though the public-mode container comes from a trusted AWS source rather than an arbitrary public registry. That is a correct-by-design pipeline, not a real tampering risk. Where a stage must use an AWS-provided image, document a Security Hub suppression listing each Platform-mode container and its AWS provenance, and keep the containers you do control pinned by digest in your private VPC registry so the suppression is narrowly scoped to the AWS-managed stage.

Full lesson Harden SageMaker and ML workloads Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for SageMaker controls ↗ Check your own account for SageMaker.19 →
Part of the learning path Lock down access

More SageMaker controls