Sagemaker Notebook Instance Should Be In VPC Only Mode

1. Attached to a VPC subnet and security group
2. With Direct internet access disabled

​

A. If the notebook is already in a VPC (has subnet & security group)

1. Open the SageMaker console
   • Go to: https://console.aws.amazon.com/sagemaker/
   • In the left menu, choose Notebook instances.
2. Stop the notebook instance
   • Find your notebook instance.
   • If the status is InService, select it and choose Actions → Stop.
   • Wait until the status is Stopped.
3. Edit the notebook instance
   • Select the stopped notebook.
   • Choose Actions → Update settings (or Edit depending on console version).
4. Disable direct internet access
   • In the Network or Internet access section:
     • Set Direct internet access to Disable.
   • Confirm the other network settings (VPC, Subnet, Security groups) are already set; if they are, this notebook will now be VPC‑only.
5. Save and restart
   • Click Update notebook instance.
   • After the update completes, select the instance and choose Actions → Start.

​

B. If the notebook is NOT in a VPC (no subnet / SG options shown)

​

1. Prepare VPC networking (if not already available)

• A VPC
• One or more subnets (typically private subnets)
• At least one security group
• Optional but common: a NAT Gateway in a public subnet so the notebook can reach the internet via the VPC if needed (for pip installs, etc.), while still being VPC‑only from SageMaker’s perspective.

​

2. Create a new VPC‑only SageMaker notebook

1. Go to Notebook instances
   • In SageMaker console, choose Notebook instances → Create notebook instance.
2. Basic settings
   • Notebook instance name: e.g., my-notebook-vpc-only.
   • Notebook instance type: same as old instance (or as required).
   • IAM role: choose the same role as the old instance if appropriate.
3. Configure VPC‑only networking
   • In the Network section:
     • VPC: choose your target VPC.
     • Subnet: choose a private subnet where you want the notebook to run.
     • Security groups: choose a security group that allows required traffic (e.g., to S3, training jobs, databases, etc. via VPC endpoints or NAT).
   • Direct internet access: set to Disable.
4. Additional options (optional)
   • Match lifecycle configuration, encryption keys (KMS), etc., with your existing environment.
5. Create the notebook
   • Click Create notebook instance.
   • Wait until status is InService.

​

3. Migrate content from old notebook

• Using the same EBS volume (if possible)
  • If your old notebook used its default volume and you want to re‑use it, you’d need to stop the old instance and re‑attach the volume to a new instance programmatically (this is easier via CLI and is more advanced).
• Export / import notebooks
  • Open the old notebook instance.
  • In Jupyter/JupyterLab, download your notebooks (.ipynb), scripts, and data to your local machine or to S3.
  • Open the new VPC‑only notebook and upload the files or pull them from S3.
• Use S3 as a source of truth
  • If your code/data already lives in S3 or a repo, just configure the new notebook to pull it (git clone, S3 copy, etc.).

​

4. Decommission the old non‑VPC notebook

1. Ensure all code/data is migrated.
2. In the SageMaker console → Notebook instances, stop the old notebook.
3. When no longer needed, select it and choose Actions → Delete.

• It runs inside a VPC subnet with appropriate security groups.
• Direct internet access is disabled.

• Attach it to a VPC subnet and security group(s)
• Disable direct internet access

​

1. Prerequisites

• A VPC ID (e.g., vpc-0123456789abcdef0)
• A private subnet ID in that VPC (e.g., subnet-0123456789abcdef0)
• One or more security group IDs (e.g., sg-0123456789abcdef0)
• Your notebook instance name (e.g., my-notebook)

aws ec2 describe-vpcs
aws ec2 describe-subnets --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"
aws ec2 describe-security-groups --filters "Name=vpc-id,Values=vpc-0123456789abcdef0"

​

2. Confirm current notebook configuration (optional)

aws sagemaker describe-notebook-instance \
  --notebook-instance-name my-notebook

​

3. Stop the notebook instance (required to update)

aws sagemaker stop-notebook-instance \
  --notebook-instance-name my-notebook

aws sagemaker wait notebook-instance-stopped \
  --notebook-instance-name my-notebook

​

4. Update notebook to VPC-only mode

• Set --subnet-id and --security-group-ids
• Set --direct-internet-access Disabled

aws sagemaker update-notebook-instance \
  --notebook-instance-name my-notebook \
  --subnet-id subnet-0123456789abcdef0 \
  --security-group-ids sg-0123456789abcdef0 sg-0fedcba9876543210 \
  --direct-internet-access Disabled

• The subnet must be in the specified VPC and have required routing (e.g., to a NAT gateway or VPC endpoints, depending on how you want the notebook to reach AWS services).
• Security groups should allow required outbound traffic (e.g., to SageMaker, S3 via VPC endpoints, etc.).

​

5. Start the notebook instance

aws sagemaker start-notebook-instance \
  --notebook-instance-name my-notebook

aws sagemaker wait notebook-instance-in-service \
  --notebook-instance-name my-notebook

​

6. Verify VPC-only configuration

aws sagemaker describe-notebook-instance \
  --notebook-instance-name my-notebook \
  --query '{SubnetId:SubnetId,SecurityGroups:SecurityGroups,DirectInternetAccess:DirectInternetAccess}'

• SubnetId set
• SecurityGroups list populated
• DirectInternetAccess = "Disabled" (VPC-only mode)

• Stop the notebook
• Attach it to a VPC (subnet + security groups)
• Disable direct internet access

​

1. Prerequisites

• boto3 installed and configured with AWS credentials/region.
• An existing VPC subnet ID and one or more security group IDs that allow the traffic you need (e.g., to SageMaker, S3 via VPC endpoint, etc.).

pip install boto3

​

2. Identify the Notebook and Target VPC Settings

• NOTEBOOK_INSTANCE_NAME
• SUBNET_ID (e.g., subnet-0123456789abcdef0)
• SECURITY_GROUP_IDS (e.g., ['sg-0123456789abcdef0'])

​

3. Stop the Notebook Instance (if running)

import boto3
import time

sm = boto3.client("sagemaker")

NOTEBOOK_INSTANCE_NAME = "my-notebook-instance"

def wait_for_notebook_status(name, target_status):
    while True:
        resp = sm.describe_notebook_instance(NotebookInstanceName=name)
        status = resp["NotebookInstanceStatus"]
        if status == target_status:
            break
        time.sleep(10)

# Stop if not already stopped
resp = sm.describe_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME)
if resp["NotebookInstanceStatus"] != "Stopped":
    sm.stop_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME)
    wait_for_notebook_status(NOTEBOOK_INSTANCE_NAME, "Stopped")

​

4. Update Notebook to VPC-Only Mode

• Set SubnetId and SecurityGroupIds (attach to VPC)
• Disable DirectInternetAccess ('Disabled' = VPC‑only)

SUBNET_ID = "subnet-0123456789abcdef0"
SECURITY_GROUP_IDS = ["sg-0123456789abcdef0"]  # list of one or more SG IDs

sm.update_notebook_instance(
    NotebookInstanceName=NOTEBOOK_INSTANCE_NAME,
    SubnetId=SUBNET_ID,
    SecurityGroupIds=SECURITY_GROUP_IDS,
    DirectInternetAccess="Disabled",  # Enforces VPC-only mode
)

• You can supply only the parameters you want to change; the above shows them explicitly.
• If the notebook was already in a subnet/SG but with direct internet access enabled, you can just call with DirectInternetAccess="Disabled".

​

5. Start the Notebook Instance

sm.start_notebook_instance(NotebookInstanceName=NOTEBOOK_INSTANCE_NAME)
wait_for_notebook_status(NOTEBOOK_INSTANCE_NAME, "InService")

• Attached to your VPC (SubnetId + SecurityGroupIds)
• Running with DirectInternetAccess disabled → VPC-only mode.

​

6. (Optional) Enforce for New Notebooks (Example)

sm.create_notebook_instance(
    NotebookInstanceName="my-new-notebook",
    InstanceType="ml.t3.medium",
    RoleArn="arn:aws:iam::<account-id>:role/SageMakerExecutionRole",
    SubnetId=SUBNET_ID,
    SecurityGroupIds=SECURITY_GROUP_IDS,
    DirectInternetAccess="Disabled",
)