How do I restrict access to my SageMaker AI notebook instance from an Amazon VPC or corporate network?

Resolution

To restrict access to your SageMaker AI notebook instance from an Amazon VPC or corporate network, use one of the following methods.

Use an IAM policy to restrict an identity from starting a notebook instance

When the system starts a SageMaker AI notebook instance, the system makes a CreatePresignedNotebookInstanceUrl API call. To restrict an identity from starting a notebook instance, you must use an AWS Identity and Access Management (IAM) policy. Set it up to restrict access to this API call.

Complete the following steps:

1. Open the IAM console.
2. In the navigation pane, choose Access Management, and then select Roles.
3. Select the role that you use with your SageMaker AI notebook instance.
4. In the Permissions section of the role details, choose Add Permissions, and then select Create inline policy.
5. Choose JSON.
6. To deny access to a SageMaker API call, use the following example policy:

   {
   "Version": "2012-10-17",
       "Statement": [
   
           {
               "Effect": "Deny",
               "Action": "sagemaker:CreatePresignedNotebookInstanceUrl",
               "Resource": "*"
            }
       ]
   }

   Note: This policy restricts system access to start any SageMaker AI Notebook instances. If the role is required to deny creating a select resource only, then change * to the relevant SageMaker AI notebook instance Amazon Resource Name (ARN).

Use SCPs

Use service control policies (SCPs) to restrict access to API calls. You can use a policy that's similar to the policy mentioned in step 6 in the previous procedure, and use the steps in Attaching organization policies with AWS Organizations.

You can also update a VPC endpoint policy to lock down a notebook. That way, the notebook is only when internet and root access options are turned off.

Use a VPC endpoint policy

You can use a VPC configuration to set access levels for your notebook instances.

Assume a scenario where you try to access the notebook instances through an Amazon Elastic Compute Cloud (Amazon EC2) instance. This Amazon EC2 instance is typically created within a VPC to uphold a security arrangement in a corporate setup. In this scenario, complete the following steps:

1. Open the Amazon VPC console.
2. Choose PrivateLink and Lattice, and then select Endpoints.
3. Select the VPC endpoint that you want to use to access the notebook with your required restrictions.
4. To edit the VPC endpoint policy, choose Actions, and then select Manage Access.
5. Apply a VPC endpoint policy on the VPC endpoint that allows you to connect to the notebook instances.
   Example:

   {
   "Statement": [
       {
           "Action": "sagemaker:CreatePresignedNotebookInstanceUrl",
           "Effect": "Allow",
           "Resource": "arn:aws:sagemaker:us-west-2:123456789012:notebook-instance/myNotebookInstance",
           "Principal": "*"
       }
       ]
   }

   This allows access to this notebook instance only through the VPC endpoint: "arn:aws:sagemaker:us-west-2:123456789012:notebook-instance/myNotebookInstance".
6. Use the following commands to access the notebook instance that you restricted access to. When you provide the VPC_Endpoint_ID, the policy takes effect and restricts access to the resources as per your requirement:

   aws sagemaker describe-notebook-instance \
                       --notebook-instance-name myNotebookInstance
                       
   {
      "NotebookInstanceArn":
      "arn:aws:sagemaker:us-west-2:123456789023:notebook-instance/mynotebookinstance",
      "NotebookInstanceName": "myNotebookInstance",
      "NotebookInstanceStatus": "InService",
      "Url": "mynotebookinstance.notebook.us-west-2.sagemaker.aws",
      "InstanceType": "ml.m4.xlarge",
      "RoleArn":
      "arn:aws:iam::123456789023:role/service-role/AmazonSageMaker-ExecutionRole-12345678T123456",
      "LastModifiedTime": 1540334777.501,
      "CreationTime": 1523050674.078,
      "DirectInternetAccess": "Disabled"
   }
   

Use a notebook execution role

To restrict access to connections made only from inside the VPC, create an IAM policy that limits access to calls that come from within your VPC. When you create the notebook instance, the IAM user that you're signed in as calls CreatePresignedNotebookInstanceUrl. You can update this identity can with the following permission set. Complete the following steps:

1. Open the IAM console.
2. Choose Access management, select Users, and then enter the username that you use to sign in to the IAM console.
3. Use the role name to open the role. Then, go to Permissions, select Add Permissions, and then choose Create Inline Policy.
4. Use the JSON editor on the policy editor page to attach the following example policy:

   {
   "Id": "notebook-example-1",
   "Version": "2012-10-17",
   "Statement": [
       {
           "Sid": "Enable Notebook Access",
           "Effect": "Allow",
           "Action": [
               "sagemaker:CreatePresignedNotebookInstanceUrl",
               "sagemaker:DescribeNotebookInstance"
           ],
           "Resource": "*",
           "Condition": {
           "StringEquals": {
               "aws:SourceVpc": "vpc-111bbaaa"
                           }
                        }
       }
               ]
   }

In this example policy, the API call is allowed only if the calls to access the notebook instance are made from "vpc-111bbaaa". Otherwise, the call is rejected.

Note: The caller must be in the subnet that has the connection to notebooks through the interface endpoint.

Instead of through the VPC, you can use the VPC interface endpoints to set up the connection.

Example:

{
    "Id": "notebook-example-1",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Enable Notebook Access",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreatePresignedNotebookInstanceUrl",
                "sagemaker:DescribeNotebookInstance"
            ],
            "Resource": "*",
            "Condition": {
                        "ForAnyValue:StringEquals": {
                            "aws:sourceVpce": [
                                "vpce-111bbccc",
                                "vpce-111bbddd"
                                               ]
                        }
            }
        }
                  ]
} 

This policy is set on the IAM user that you use to create the notebook instance. If a user assumes this role and tries to access the notebook, then they're allowed access only if they use the "vpce-111bbccc" or "vpce-111bbddd" interface endpoints.

Use the following command to access a notebook instance through the VPC endpoints after you create the IAM policy:

aws sagemaker create-presigned-notebook-instance-url
    --notebook-instance-name myNotebookInstance --endpoint-url
    VPC_Endpoint_ID.api.sagemaker.Region.vpce.amazonaws.com

You can use similar VPC subnet configurations to restrict access to notebook instances instead of VPC endpoints or VPCs. To do so, use the "sagemaker:VpcSubnets" tag in the condition block and specify the corresponding subnet ID.

Use a private network

To connect to a notebook instance that resides within a VPC, you can take the following actions:

• Connect through a supported resource that's inside a VPC.
• Use AWS VPN or AWS Direct Connect to connect the private network to the VPC.

For information about how to set up the notebook with a private network, see Connect your private network to your VPC.

Use resource tags

You can set up IAM policies with resource tags to establish access control, also known as Attribute Based Access Control (ABAC). Use tags to restrict access to specific groups of users.

Example scenario: Team 1 works on Project A. Team 2 works on Project B. You're a company administrator, and don't want either team to access the other team's notebook instances because of confidentiality and security reasons. To establish infrastructure for this situation, complete the following steps:

1. Add a tag with the following key-value pair to the SageMaker AI notebook instance that Team A uses: {"Project":"A"}

2. Add a tag with the following key-value pair to the SageMaker AI notebook instance that Team B uses: {"Project":"B"}

3. Allocate different roles to Team 1 and Team 2 for access to SageMaker AI.

4. For the role that Team A uses to access the notebook instance, use the following IAM policy to restrict access to Project B:

   {
         "Effect": "Deny",
         "Action": "sagemaker:CreatePresignedNotebookInstanceUrl",
         "Resource": "*",
         "Condition": {
           "StringEquals": {
             "sagemaker:ResourceTag/Project": "B"
           }
         }
   }

5. For the role that Team B uses to access the notebook instance, use the following IAM policy to restrict access to Project A:

   {
         "Effect": "Deny",
         "Action": "sagemaker:CreatePresignedNotebookInstanceUrl",
         "Resource": "*",
         "Condition": {
           "StringEquals": {
             "sagemaker:ResourceTag/Project": "A"
           }
         }
   }

   Note: If you want to restrict access to notebook instances for different users, use the aws:username resource tag for the users to set restrictions.
   The following example policy denies access to a particular user so they can't start, stop, or describe a notebook instance. It also restricts the user from generating presigned URLs. For more information, see Control access to SageMaker AI resources by using tags.

   { "Version": "2012-10-17", 
     "Statement": [ 
     { 
       "Sid": "VisualEditor0", 
       "Effect": "Deny", 
       "Action": [ 
                  "sagemaker:StartNotebookInstance", 
                  "sagemaker:StopNotebookInstance", 
                  "sagemaker:DescribeNotebookInstance",
                  "sagemaker:CreatePresignedNotebookInstanceUrl" 
                  ], 
       "Resource": "*",
       "Condition": { 
                   "StringNotEquals": {
                   "sagemaker:ResourceTag/owner": "${aws:username}" 
                    } 
                    } 
      } ] 
   }

   Use an allowlist and proxy setup for IP addresses

   Consider a scenario where you use a proxy to set the IP addresses that are permitted connections for your corporate network. In this scenario, use allowlist to set the IP addresses for the notebooks that you want to access different resources.

   For example, if you create your notebook within a CIDR range of 172.31.0.0 to 172.31.0.16, then allow only this CIDR block in your proxy.

   The IP address for the notebook is dynamic and assigned based on the subnet that's attached to the notebook instance. To find the IP address of the notebook, use the route -n command. For more information, see Understanding Amazon SageMaker notebook instance networking configurations and advanced routing options.

   Note: This scenario is only possible when you attach a subnet to the notebook.