SageMaker notebook instance has direct internet access

Severity: High
Service: SageMaker
Check ID: SAGEMAKER_NOTEBOOK_DIRECT_INTERNET

What this check finds

SageMaker notebook instance has DirectInternetAccess enabled. This allows egress to the internet — a risk for data exfiltration and unauthorized package installation.

Passing looks like: SageMaker notebook has no direct internet access.

How to fix it

Set DirectInternetAccess=Disabled on the notebook instance. Use a NAT gateway or PrivateLink for controlled outbound access.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to SageMaker notebook instance has direct internet access
Framework	Controls
PCI-DSS v4.0.1	1.3 Network access to and from the cardholder data environment is restricted
HIPAA Security Rule	164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI in transit
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.8.20 Networks security

AI risk mappings

AI risk taxonomies mapped to SageMaker notebook instance has direct internet access
Framework	Controls
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0012 Valid Accounts AML.T0025 Exfiltration via Cyber Means

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More SageMaker checks

All SageMaker checks