SageMaker endpoint variant runs on one instance
- Severity
- Medium
- Service
- SageMaker
- Type
- Operations, not counted in the security score
- Check ID
- SAGEMAKER_ENDPOINT_SINGLE_INSTANCE
What this check finds
A production variant of a SageMaker endpoint has a single instance, so one instance failure takes the endpoint down.
Passing looks like: SageMaker endpoints run on more than one instance.
How to fix it
Set InitialInstanceCount to 2 or more in a new endpoint configuration, or add auto scaling with a minimum of 2, then update the endpoint.
Compliance
This is an operational hygiene check. It flags something worth tidying rather than a control an auditor asks for, so it is not mapped to a compliance framework.
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More SageMaker checks
- HighSageMaker execution role is over-permissioned
- HighSageMaker notebook instance has direct internet access
- HighSageMaker training job has no checkpoint configuration
- MediumDistributed SageMaker training job does not encrypt traffic between containers
- MediumSageMaker endpoint not deployed inside VPC
- MediumSageMaker model has no VPC configuration
- MediumSageMaker monitoring schedule encrypts neither its output nor its volumes with a KMS key
- MediumSageMaker notebook instance allows IMDSv1