A Notebook that Is Not Root with Open Egress
AWS defaults a notebook to direct internet access AND root access: a root shell with a path off the network that misses your NAT, routing and DNS firewall, holding a role chosen to read your training data. Both off here, IMDSv2 only.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "sagemaker_notebook" {
source = "www.iac-bazaar.com/iac-bazaar/aws-sagemaker-notebook/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-sagemaker-notebook
A SageMaker notebook instance, with the two AWS defaults that combine into the
worst shape in this service turned off. Works with Terraform and OpenTofu
(>= 1.6), AWS provider >= 6.0, < 7.0.
Both of these are on unless you turn them off:
direct_internet_access = Enabledgives the notebook an egress path that does not pass through your VPC at all - not your NAT gateway, not your routing, not your DNS firewall, not anything you inspect. Exposed here as a plaininternet_accessbool, defaulting to falseroot_access = Enabledgives whoever opens the notebook root on the instance
Together that is a root shell with an unfiltered path off the network, holding an IAM role chosen so it can read your training data. A notebook is an interactive machine other people type into, which is exactly why it should be the least trusted thing in the account rather than the most convenient. This module turns both off, requires a subnet, and makes each exception an explicit statement.
egress_goes_through_your_vpc and has_root_access are outputs so a policy
test can assert on them rather than a person reading the plan.
Three more things it does:
- IMDSv2 only. IMDSv1 lets any process that can make an HTTP request read the instance role's credentials - including a notebook cell somebody pasted in
- Requires security groups when the notebook is in a subnet. Without them AWS attaches the VPC default group, which is rarely what anybody inspected
- Refuses an unencrypted volume unless stated. The volume holds whatever the notebook has pulled down, which for a notebook is the interesting subset
lifecycle_config_name is documented rather than defaulted, because it is where
an auto-stop timer goes and an idle notebook nobody stopped is the commonest
surprise on a SageMaker bill.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- One suppressed policy, and why
- Usage