Project: KICS (Provisioning / Security & Compliance)
File: 9c7028d9-04c2-45be-b8b2-1188ccaefb36.md

title: SageMaker Notebook Not Placed In VPC hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 9c7028d9-04c2-45be-b8b2-1188ccaefb36 Query name: SageMaker Notebook Not Placed In VPC Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: SageMaker Notebook must be placed in a VPC<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="7" AWSTemplateFormatVersion: "2010-09-09" Description: "NotebookInstance" Resources: NotebookInstance: Type: "AWS::SageMaker::NotebookInstance" DependsOn: [ MountTarget1, MountTarget2, MountTarget3, VpcS3Endpoint ] Properties: NotebookInstanceName: !Ref NotebookInstanceName InstanceType: !Ref NotebookInstanceType RoleArn: !GetAtt ExecutionRole.Arn RootAccess: Enabled SecurityGroupIds: !GetAtt VpcSecurityGroup.GroupId DirectInternetAccess: Disabled AdditionalCodeRepositories: !If CreateCodeRepo [!GetAtt CodeRepo.CodeRepositoryName] !Ref 'AWS::NoValue' LifecycleConfigName: !GetAtt NotebookStartConfig.NotebookInstanceLifecycleConfigName VolumeSizeInGB: !Ref EbsVolumeSize Tags: Key: Name Value: !Ref 'AWS::StackName' Vpc: Type: 'AWS::EC2::VPC' Properties: CidrBlock: !Ref VpcCIDR EnableDnsSupport: 'true' EnableDnsHostnames: 'true' Tags: Key: Name Value: !Ref 'AWS::StackName' ``` ```json title="Positive test num. 2 - json file" hl_lines="27" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "NotebookInstance", "Resources": { "Vpc": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": "VpcCIDR", "EnableDnsSupport": "true", "EnableDnsHostnames": "true", "Tags": [ { "Key": "Name", "Value": "AWS::StackName" } ] } }, "NotebookInstance": { "Type": "AWS::SageMaker::NotebookInstance", "DependsOn": [ "MountTarget1", "MountTarget2", "MountTarget3", "VpcS3Endpoint" ], "Properties": { "VolumeSizeInGB": "EbsVolumeSize", "Tags": [ { "Key": "Name", "Value": "AWS::StackName" } ], "NotebookInstanceName": "NotebookInstanceName", "SecurityGroupIds": [ "VpcSecurityGroup.GroupId" ], "DirectInternetAccess": "Disabled", "AdditionalCodeRepositories": [ "CreateCodeRepo", [ "CodeRepo.CodeRepositoryName" ], "AWS::NoValue" ], "LifecycleConfigName": "NotebookStartConfig.NotebookInstanceLifecycleConfigName", "InstanceType": "NotebookInstanceType", "RoleArn": "ExecutionRole.Arn", "RootAccess": "Enabled" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: "NotebookInstance" Resources: NotebookInstance: Type: "AWS::SageMaker::NotebookInstance" DependsOn: [ MountTarget1, MountTarget2, MountTarget3, VpcS3Endpoint ] Properties: NotebookInstanceName: !Ref NotebookInstanceName InstanceType: !Ref NotebookInstanceType RoleArn: !GetAtt ExecutionRole.Arn RootAccess: Enabled SecurityGroupIds: !GetAtt VpcSecurityGroup.GroupId SubnetId: !Ref PrivateSubnet1 DirectInternetAccess: Disabled AdditionalCodeRepositories: !If CreateCodeRepo [!GetAtt CodeRepo.CodeRepositoryName] !Ref 'AWS::NoValue' LifecycleConfigName: !GetAtt NotebookStartConfig.NotebookInstanceLifecycleConfigName VolumeSizeInGB: !Ref EbsVolumeSize Tags: Key: Name Value: !Ref 'AWS::StackName' Vpc: Type: 'AWS::EC2::VPC' Properties: CidrBlock: !Ref VpcCIDR EnableDnsSupport: 'true' EnableDnsHostnames: 'true' Tags: Key: Name Value: !Ref 'AWS::StackName' ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "NotebookInstance", "Resources": { "NotebookInstance": { "Type": "AWS::SageMaker::NotebookInstance", "DependsOn": [ "MountTarget1", "MountTarget2", "MountTarget3", "VpcS3Endpoint" ], "Properties": { "InstanceType": "NotebookInstanceType", "RoleArn": "ExecutionRole.Arn", "SecurityGroupIds": [ "VpcSecurityGroup.GroupId" ], "AdditionalCodeRepositories": [ "CreateCodeRepo", [ "CodeRepo.CodeRepositoryName" ], "AWS::NoValue" ], "VolumeSizeInGB": "EbsVolumeSize", "Tags": [ { "Key": "Name", "Value": "AWS::StackName" } ], "NotebookInstanceName": "NotebookInstanceName", "SubnetId": "PrivateSubnet1", "DirectInternetAccess": "Disabled", "LifecycleConfigName": "NotebookStartConfig.NotebookInstanceLifecycleConfigName", "RootAccess": "Enabled" } }, "Vpc": { "Properties": { "CidrBlock": "VpcCIDR", "EnableDnsSupport": "true", "EnableDnsHostnames": "true", "Tags": [ { "Key": "Name", "Value": "AWS::StackName" } ] }, "Type": "AWS::EC2::VPC" } } } ```