Amazon SageMaker notebook instances should not have direct internet access

How to fix it

Set at creation: fixing it means replacing the resource.

Set DirectInternetAccess to Disabled on the notebook instance. The setting is fixed at creation, so the end state is a replacement: stop the existing instance, delete it, and create one in its place with the setting off. Deleting a notebook instance deletes its ML storage volume, so move anything kept only under /home/ec2-user/SageMaker into a Git repository or Amazon S3 first. AWS permits the setting to be off only on an instance that has a subnet, so the replacement sits in your own VPC, which also clears the separate finding for a notebook outside a custom VPC. Once it is off the instance reaches nothing outside the VPC until you give it interface VPC endpoints for the services it calls or a NAT gateway.

In the console

SageMaker AI → Notebook instances → Create notebook instance → Network → Direct internet access

With Terraform

resource "aws_sagemaker_notebook_instance" "this" {
  name                   = var.notebook_instance_name
  instance_type          = var.instance_type
  role_arn               = var.role_arn
  subnet_id              = var.subnet_id
  direct_internet_access = "Disabled"
}