SageMaker Notebook Not Placed In VPC

• Query id: 9c7028d9-04c2-45be-b8b2-1188ccaefb36
• Query name: SageMaker Notebook Not Placed In VPC
• Platform: CloudFormation
• Severity: Medium
• Category: Networking and Firewall
• CWE: 311
• URL: Github

Description

SageMaker Notebook must be placed in a VPC
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file

AWSTemplateFormatVersion: "2010-09-09"
Description: "NotebookInstance"
Resources:
  NotebookInstance:
    Type: "AWS::SageMaker::NotebookInstance"
    DependsOn: [ MountTarget1, MountTarget2, MountTarget3, VpcS3Endpoint ]
    Properties:
      NotebookInstanceName: !Ref NotebookInstanceName
      InstanceType: !Ref NotebookInstanceType
      RoleArn: !GetAtt ExecutionRole.Arn
      RootAccess: Enabled
      SecurityGroupIds:
        - !GetAtt VpcSecurityGroup.GroupId
      DirectInternetAccess: Disabled
      AdditionalCodeRepositories: !If
        - CreateCodeRepo
        - [!GetAtt CodeRepo.CodeRepositoryName]
        - !Ref 'AWS::NoValue'
      LifecycleConfigName: !GetAtt NotebookStartConfig.NotebookInstanceLifecycleConfigName
      VolumeSizeInGB: !Ref EbsVolumeSize
      Tags:
        - Key: Name
          Value: !Ref 'AWS::StackName'
  Vpc:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
        - Key: Name
          Value: !Ref 'AWS::StackName'

Positive test num. 2 - json file

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "NotebookInstance",
  "Resources": {
    "Vpc": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "VpcCIDR",
        "EnableDnsSupport": "true",
        "EnableDnsHostnames": "true",
        "Tags": [
          {
            "Key": "Name",
            "Value": "AWS::StackName"
          }
        ]
      }
    },
    "NotebookInstance": {
      "Type": "AWS::SageMaker::NotebookInstance",
      "DependsOn": [
        "MountTarget1",
        "MountTarget2",
        "MountTarget3",
        "VpcS3Endpoint"
      ],
      "Properties": {
        "VolumeSizeInGB": "EbsVolumeSize",
        "Tags": [
          {
            "Key": "Name",
            "Value": "AWS::StackName"
          }
        ],
        "NotebookInstanceName": "NotebookInstanceName",
        "SecurityGroupIds": [
          "VpcSecurityGroup.GroupId"
        ],
        "DirectInternetAccess": "Disabled",
        "AdditionalCodeRepositories": [
          "CreateCodeRepo",
          [
            "CodeRepo.CodeRepositoryName"
          ],
          "AWS::NoValue"
        ],
        "LifecycleConfigName": "NotebookStartConfig.NotebookInstanceLifecycleConfigName",
        "InstanceType": "NotebookInstanceType",
        "RoleArn": "ExecutionRole.Arn",
        "RootAccess": "Enabled"
      }
    }
  }
}

Code samples without security vulnerabilities

Negative test num. 1 - yaml file

AWSTemplateFormatVersion: "2010-09-09"
Description: "NotebookInstance"
Resources:
  NotebookInstance:
    Type: "AWS::SageMaker::NotebookInstance"
    DependsOn: [ MountTarget1, MountTarget2, MountTarget3, VpcS3Endpoint ]
    Properties:
      NotebookInstanceName: !Ref NotebookInstanceName
      InstanceType: !Ref NotebookInstanceType
      RoleArn: !GetAtt ExecutionRole.Arn
      RootAccess: Enabled
      SecurityGroupIds:
        - !GetAtt VpcSecurityGroup.GroupId
      SubnetId: !Ref PrivateSubnet1
      DirectInternetAccess: Disabled
      AdditionalCodeRepositories: !If
        - CreateCodeRepo
        - [!GetAtt CodeRepo.CodeRepositoryName]
        - !Ref 'AWS::NoValue'
      LifecycleConfigName: !GetAtt NotebookStartConfig.NotebookInstanceLifecycleConfigName
      VolumeSizeInGB: !Ref EbsVolumeSize
      Tags:
        - Key: Name
          Value: !Ref 'AWS::StackName'
  Vpc:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
        - Key: Name
          Value: !Ref 'AWS::StackName'

Negative test num. 2 - json file

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "NotebookInstance",
  "Resources": {
    "NotebookInstance": {
      "Type": "AWS::SageMaker::NotebookInstance",
      "DependsOn": [
        "MountTarget1",
        "MountTarget2",
        "MountTarget3",
        "VpcS3Endpoint"
      ],
      "Properties": {
        "InstanceType": "NotebookInstanceType",
        "RoleArn": "ExecutionRole.Arn",
        "SecurityGroupIds": [
          "VpcSecurityGroup.GroupId"
        ],
        "AdditionalCodeRepositories": [
          "CreateCodeRepo",
          [
            "CodeRepo.CodeRepositoryName"
          ],
          "AWS::NoValue"
        ],
        "VolumeSizeInGB": "EbsVolumeSize",
        "Tags": [
          {
            "Key": "Name",
            "Value": "AWS::StackName"
          }
        ],
        "NotebookInstanceName": "NotebookInstanceName",
        "SubnetId": "PrivateSubnet1",
        "DirectInternetAccess": "Disabled",
        "LifecycleConfigName": "NotebookStartConfig.NotebookInstanceLifecycleConfigName",
        "RootAccess": "Enabled"
      }
    },
    "Vpc": {
      "Properties": {
        "CidrBlock": "VpcCIDR",
        "EnableDnsSupport": "true",
        "EnableDnsHostnames": "true",
        "Tags": [
          {
            "Key": "Name",
            "Value": "AWS::StackName"
          }
        ]
      },
      "Type": "AWS::EC2::VPC"
    }
  }
}