AWS securityhub medium security documentation change
Summary
Revised SageMaker.5 control to emphasize network isolation (blocking all inbound/outbound traffic) instead of just inbound blocking, with documentation updates
Security assessment
The change explicitly states that network isolation prevents both inbound and outbound traffic, addressing potential misconfigurations where only inbound traffic was blocked. This directly prevents unintended internet exposure of SageMaker models, a security-critical configuration.
Diff
diff --git a/securityhub/latest/userguide/sagemaker-controls.md b/securityhub/latest/userguide/sagemaker-controls.md index 4a9bf9e67..d5a559619 100644 --- a//securityhub/latest/userguide/sagemaker-controls.md +++ b//securityhub/latest/userguide/sagemaker-controls.md @@ -5 +5 @@ -[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC[SageMaker.3] Users should not have root access to SageMaker notebook instances[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1[SageMaker.5] SageMaker models should block inbound traffic[SageMaker.6] SageMaker app image configurations should be tagged[SageMaker.7] SageMaker images should be tagged[SageMaker.8] SageMaker notebook instances should run on supported platforms +[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access[SageMaker.2] SageMaker notebook instances should be launched in a custom VPC[SageMaker.3] Users should not have root access to SageMaker notebook instances[SageMaker.4] SageMaker endpoint production variants should have an initial instance count greater than 1[SageMaker.5] SageMaker models should have network isolation enabled[SageMaker.6] SageMaker app image configurations should be tagged[SageMaker.7] SageMaker images should be tagged[SageMaker.8] SageMaker notebook instances should run on supported platforms @@ -111 +111 @@ For more information about the parameters of endpoint configuration, see [Create -## [SageMaker.5] SageMaker models should block inbound traffic +## [SageMaker.5] SageMaker models should have network isolation enabled @@ -125 +125 @@ For more information about the parameters of endpoint configuration, see [Create -This control checks whether an Amazon SageMaker AI hosted model blocks inbound network traffic. The control fails if the `EnableNetworkIsolation` parameter for the hosted model is set to `False`. +This control checks whether an Amazon SageMaker AI hosted model has network isolation enabled. The control fails if the `EnableNetworkIsolation` parameter for the hosted model is set to `False`. @@ -127 +127,5 @@ This control checks whether an Amazon SageMaker AI hosted model blocks inbound n -SageMaker AI training and deployed inference containers are internet-enabled by default. If you don't want SageMaker AI to provide external network access to your training or inference containers, you can enable network isolation. If you enable network isolation, the containers can't make any outbound network calls, even to other AWS services. Additionally, no AWS credentials are made available to the container runtime environment. Enabling network isolation helps prevent unintended access to your SageMaker AI resources from the internet. +SageMaker AI training and deployed inference containers are internet-enabled by default. If you don't want SageMaker AI to provide external network access to your training or inference containers, you can enable network isolation. If you enable network isolation, no inbound or outbound network calls can be made to or from the model container, including calls to or from other AWS services. Additionally, no AWS credentials are made available to the container runtime environment. Enabling network isolation helps prevent unintended access to your SageMaker AI resources from the internet. + +###### Note + +On August 13, 2025, Security Hub changed the title and description of this control. The new title and description more accurately reflect that the control checks the setting for the `EnableNetworkIsolation` parameter of Amazon SageMaker AI hosted models. Previously, the title of this control was: _SageMaker models should block inbound traffic_. @@ -131 +135 @@ SageMaker AI training and deployed inference containers are internet-enabled by -For more information about network isolation for SageMaker AI models, see [Run training and inference containers in internet-free mode](https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html) in the _Amazon SageMaker AI Developer Guide_. You can enable network isolation when you create your training job or model by setting the value of the `EnableNetworkIsolation` parameter to `True`. +For more information about network isolation for SageMaker AI models, see [Run training and inference containers in internet-free mode](https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html) in the _Amazon SageMaker AI Developer Guide_. When you create a model, you can enable network isolation by setting the value for the `EnableNetworkIsolation` parameter to `True`.