Sagemaker Domains Should Have VPC Only Network Access Enabled

​

1. Check existing SageMaker Domain(s)

1. Sign in to AWS Console.
2. Go to Amazon SageMaker.
3. In the left menu, choose Admin configurations → Domains (or SageMaker Studio → Domains, depending on console version).
4. For each domain, check:
   • Network access type (e.g., PublicInternetOnly or VPCOnly).
   • Region (you’ll recreate in the same Region).
   • VPC, subnets, security groups, and execution roles in use.

​

2. Prepare networking for VPC-only access

1. In the console, go to VPC.
2. Either:
   • Use an existing VPC, or
   • Create a new VPC:
     • Choose Create VPC → VPC and more.
     • Provide a name, IPv4 CIDR, and at least two private subnets (recommended).
3. Ensure:
   • Private subnets have outbound access to AWS services as required (via NAT Gateway and route tables, or VPC endpoints).
4. (Recommended) Add VPC endpoints (Interface/ Gateway) for:
   • com.amazonaws.<region>.sagemaker, sts, logs, ecr.api, ecr.dkr, s3 (Gateway), etc., depending on what Studio needs to reach without public internet.
5. Create or identify a security group to associate with the domain:
   • Outbound: allow required egress (e.g., to S3, SageMaker, etc., via endpoints / NAT).
   • Inbound: typically no inbound from the internet; inbound from load balancer/endpoints as needed.

​

3. Create a new SageMaker Domain with VPC-only access

1. Go to Amazon SageMaker → Admin configurations → Domains.
2. Click Create domain.
3. Choose Domain type (e.g., SageMaker Studio or Studio Classic, depending on what you use).
4. In Authentication:
   • Choose AWS IAM or SSO according to your environment.
5. In Network and storage (names may differ slightly by console version):
   • Network access type: select VPC Only.
   • VPC: choose the prepared VPC.
   • Subnets: choose at least one (preferably multiple) private subnets.
   • Security groups: select your security group(s).
6. In Execution role:
   • Use an existing SageMaker execution role or create a new one with appropriate IAM permissions.
7. Configure Default user settings (app types, storage, lifecycle configs, etc.).
8. Review all settings and click Create domain.
9. Wait until the new domain status is InService.

​

4. Migrate users / projects to the VPCOnly domain

1. For each user:
   • Export or copy important notebooks, code, and data from the old domain (e.g., to S3).
2. In the new VPCOnly domain:
   • Create User profiles matching the previous users (if using IAM, map to IAM users/roles as needed).
   • Have users open SageMaker Studio from the new domain and restore their notebooks/projects from S3 or version control.
3. Validate:
   • Users can access required data (S3, Git, etc.) through VPC endpoints or internal paths.
   • No direct access relies on public internet from Studio kernels unless explicitly allowed via NAT, if that’s part of your design.

​

5. Decommission non-compliant (non-VPCOnly) Domain

1. Ensure no active workspaces/apps are needed in the old domain.
2. Back up any remaining data to S3.
3. In the SageMaker console, go to Admin configurations → Domains.
4. Select the old domain (with PublicInternetOnly or mixed access).
5. Choose Delete domain (optionally delete associated user profiles and apps, depending on prompts).
6. Confirm deletion.

​

1. Prerequisites

• A VPC with:
  • Private subnets for SageMaker (no direct Internet gateway route)
  • Appropriate route tables (e.g., to a NAT gateway or no Internet at all)
• Security groups allowing required traffic inside the VPC
• (Recommended) VPC endpoints: sagemaker.api, sagemaker.runtime, s3, sts, ecr.api, ecr.dkr, logs, etc. depending on your use case

​

2. Identify your SageMaker Domain

aws sagemaker list-domains \
  --query "Domains[*].{DomainName:DomainName,DomainId:DomainId,Status:Status,AppNetworkAccessType:AppNetworkAccessType}" \
  --output table

​

3. Get current Domain configuration (for reference)

DOMAIN_ID="d-xxxxxxxxxx"

aws sagemaker describe-domain \
  --domain-id "$DOMAIN_ID" \
  --output json > domain-current.json

• VpcId
• SubnetIds
• SecurityGroupIds
• Current AppNetworkAccessType (likely PublicInternetOnly)

​

4. Update Domain to VPC-Only

aws sagemaker update-domain \
  --domain-id "$DOMAIN_ID" \
  --app-network-access-type VpcOnly

aws sagemaker describe-domain \
  --domain-id "$DOMAIN_ID" \
  --query "Status"

​

5. Verify the change

aws sagemaker describe-domain \
  --domain-id "$DOMAIN_ID" \
  --query "{DomainId:DomainId,AppNetworkAccessType:AppNetworkAccessType,Status:Status}" \
  --output table

• AppNetworkAccessType = VpcOnly
• Status = InService

​

6. (Recommended) Validate connectivity from within VPC

• Access required AWS services over VPC endpoints (e.g., aws s3 ls to S3 buckets, call SageMaker APIs, etc.)
• Reach any private data sources reachable within your VPC

• Route tables for the subnets used by the Domain
• Security group rules
• Presence and configuration of required VPC endpoints

​

1. Prerequisites

1. You have boto3 installed:
   pip install boto3
   
2. Your AWS credentials and region are configured (via environment variables, AWS CLI, or config files).
3. Your IAM principal has permissions such as:
   • sagemaker:DescribeDomain
   • sagemaker:UpdateDomain

​

2. Understand What Needs to Be Changed

• AppNetworkAccessType:
  • "PublicInternetOnly" (insecure for this requirement)
  • "VpcOnly" (what you need)

​

3. Identify Your Domain and Check Current Setting

import boto3

sm = boto3.client("sagemaker", region_name="us-east-1")  # change region if needed

def list_domains():
    paginator = sm.get_paginator("list_domains")
    for page in paginator.paginate():
        for d in page["Domains"]:
            print(f"DomainId: {d['DomainId']}, Name: {d['DomainName']}")

list_domains()

DOMAIN_ID = "d-xxxxxxxxxxxxxxxxxxxx"  # replace with your domain ID

domain_desc = sm.describe_domain(DomainId=DOMAIN_ID)
print("Current AppNetworkAccessType:", domain_desc.get("AppNetworkAccessType"))

​

4. Build the Update Payload

1. Read the existing DefaultUserSettings from DescribeDomain.
2. Reuse them when calling UpdateDomain.
3. Add AppNetworkAccessType="VpcOnly" at the top level of the call.

default_user_settings = domain_desc["DefaultUserSettings"]

# OPTIONAL: you can adjust security groups here if needed, e.g.:
# default_user_settings["SecurityGroups"] = ["sg-xxxxxxxxxxxxxxxxx"]

​

5. Update the Domain to VPC-Only

response = sm.update_domain(
    DomainId=DOMAIN_ID,
    AppNetworkAccessType="VpcOnly",
    DefaultUserSettings=default_user_settings
)

print("UpdateDomain response:", response)

​

6. Verify the Change

import time

time.sleep(10)  # short wait; you can also poll until status is 'InService'

updated = sm.describe_domain(DomainId=DOMAIN_ID)
print("Updated AppNetworkAccessType:", updated.get("AppNetworkAccessType"))

Updated AppNetworkAccessType: VpcOnly

​

7. Full Minimal Script

import time
import boto3

REGION = "us-east-1"                # change as needed
DOMAIN_ID = "d-xxxxxxxxxxxxxxxxxxxx"  # replace with your domain ID

sm = boto3.client("sagemaker", region_name=REGION)

def set_domain_vpc_only(domain_id: str):
    # Describe the domain
    desc = sm.describe_domain(DomainId=domain_id)
    print("Current AppNetworkAccessType:", desc.get("AppNetworkAccessType"))

    default_user_settings = desc["DefaultUserSettings"]

    # Optionally adjust SecurityGroups or other settings here if required
    # default_user_settings["SecurityGroups"] = ["sg-xxxxxxxxxxxxxxxxx"]

    # Update to VpcOnly
    resp = sm.update_domain(
        DomainId=domain_id,
        AppNetworkAccessType="VpcOnly",
        DefaultUserSettings=default_user_settings
    )
    print("UpdateDomain initiated:", resp["DomainArn"])

    # Wait a bit and verify
    time.sleep(20)
    updated = sm.describe_domain(DomainId=domain_id)
    print("New AppNetworkAccessType:", updated.get("AppNetworkAccessType"))

if __name__ == "__main__":
    set_domain_vpc_only(DOMAIN_ID)