SageMaker endpoint not deployed inside VPC

Severity: Medium
Service: SageMaker
Check ID: SAGEMAKER_ENDPOINT_NO_VPC

What this check finds

A SageMaker inference endpoint is deployed without a VPC configuration. Internet-accessible endpoints expose model inference to potential data exfiltration.

Passing looks like: SageMaker endpoint deployed inside VPC.

How to fix it

Update the endpoint configuration to include a VPC config: --vpc-config SubnetIds=...,SecurityGroupIds=...

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to SageMaker endpoint not deployed inside VPC
Framework	Controls
PCI-DSS v4.0.1	1.3 Network access to and from the cardholder data environment is restricted
HIPAA Security Rule	164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI in transit
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.8.20 Networks security

AI risk mappings

AI risk taxonomies mapped to SageMaker endpoint not deployed inside VPC
Framework	Controls
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0024 Exfiltration via ML Inference API AML.T0025 Exfiltration via Cyber Means

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More SageMaker checks

All SageMaker checks