SageMaker notebook instances should be launched in a custom VPC

How to fix it

Set at creation: fixing it means replacing the resource.

Attach the notebook instance to a subnet in a VPC of your own, with the security groups for it. SubnetId is fixed at creation and no update changes it, so the end state is a replacement: stop the existing instance, delete it, and create one in its place with a subnet set. Deleting a notebook instance deletes its ML storage volume, so move anything kept only under /home/ec2-user/SageMaker into a Git repository or Amazon S3 first. Putting the instance in a VPC does not by itself stop it reaching the internet: direct internet access is a separate setting with its own finding.

In the console

SageMaker AI → Notebook instances → Create notebook instance → Network → VPC and Subnet

With Terraform

resource "aws_sagemaker_notebook_instance" "this" {
  name          = var.notebook_instance_name
  instance_type = var.instance_type
  role_arn      = var.role_arn
  subnet_id     = var.subnet_id
}