Best Practices for Networking in AWS SageMaker

resource "aws_sagemaker_notebook_instance" "secure_notebook" {
  name                    = "my-secure-notebook"
  instance_type           = "ml.t3.medium"
  subnet_id               = "subnet-xxxxx"
  security_groups         = ["sg-xxxxx"]
  direct_internet_access  = "Disabled"
  role_arn                = "arn:aws:iam::account-id:role/SageMakerRole"
}

import pulumi_aws as aws

notebook = aws.sagemaker.NotebookInstance("secure-notebook",
    name="my-secure-notebook",
    instance_type="ml.t3.medium",
    subnet_id="subnet-xxxxx",
    security_groups=["sg-xxxxx"],
    direct_internet_access="Disabled",
    role_arn="arn:aws:iam::account-id:role/SageMakerRole"
)

import * as sagemaker from 'aws-cdk-lib/aws-sagemaker';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';

const notebook = new sagemaker.CfnNotebookInstance(this, 'SecureNotebook', {
  notebookInstanceName: 'my-secure-notebook',
  instanceType: 'ml.t3.medium',
  subnetId: 'subnet-xxxxx',
  securityGroupIds: ['sg-xxxxx'],
  directInternetAccess: 'Disabled',
  roleArn: 'arn:aws:iam::account-id:role/SageMakerRole'
});

resource "aws_sagemaker_training_job" "isolated_training" {
  training_job_name = "my-isolated-training-job"
  role_arn          = aws_iam_role.sagemaker_role.arn

  algorithm_specification {
    training_image = "my-training-image"
    training_input_mode = "File"
  }

  resource_config {
    instance_type   = "ml.p3.2xlarge"
    instance_count  = 1
    volume_size_in_gb = 50
  }

  vpc_config {
    subnets            = ["subnet-xxxxx"]
    security_group_ids = ["sg-xxxxx"]
  }

  enable_network_isolation = true

  stopping_condition {
    max_runtime_in_seconds = 86400
  }

  output_data_config {
    s3_output_path = "s3://my-bucket/output"
  }
}

import pulumi_aws as aws

training_job = aws.sagemaker.TrainingJob("isolated-training",
    training_job_name="my-isolated-training-job",
    role_arn=sagemaker_role.arn,
    algorithm_specification=aws.sagemaker.TrainingJobAlgorithmSpecificationArgs(
        training_image="my-training-image",
        training_input_mode="File"
    ),
    resource_config=aws.sagemaker.TrainingJobResourceConfigArgs(
        instance_type="ml.p3.2xlarge",
        instance_count=1,
        volume_size_in_gb=50
    ),
    vpc_config=aws.sagemaker.TrainingJobVpcConfigArgs(
        subnets=["subnet-xxxxx"],
        security_group_ids=["sg-xxxxx"]
    ),
    enable_network_isolation=True,
    stopping_condition=aws.sagemaker.TrainingJobStoppingConditionArgs(
        max_runtime_in_seconds=86400
    ),
    output_data_config=aws.sagemaker.TrainingJobOutputDataConfigArgs(
        s3_output_path="s3://my-bucket/output"
    )
)

import * as sagemaker from 'aws-cdk-lib/aws-sagemaker';

const trainingJob = new sagemaker.CfnTrainingJob(this, 'IsolatedTraining', {
  trainingJobName: 'my-isolated-training-job',
  roleArn: sagemakerRole.roleArn,
  algorithmSpecification: {
    trainingImage: 'my-training-image',
    trainingInputMode: 'File'
  },
  resourceConfig: {
    instanceType: 'ml.p3.2xlarge',
    instanceCount: 1,
    volumeSizeInGb: 50
  },
  vpcConfig: {
    subnets: ['subnet-xxxxx'],
    securityGroupIds: ['sg-xxxxx']
  },
  enableNetworkIsolation: true,
  stoppingCondition: {
    maxRuntimeInSeconds: 86400
  },
  outputDataConfig: {
    s3OutputPath: 's3://my-bucket/output'
  }
});

resource "aws_vpc_endpoint" "s3" {
  vpc_id          = "vpc-xxxxx"
  service_name    = "com.amazonaws.us-east-1.s3"
  route_table_ids = ["rtb-xxxxx"]
  vpc_endpoint_type = "Gateway"
}

import pulumi_aws as aws

s3_endpoint = aws.ec2.VpcEndpoint("s3-gateway",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.s3",
    route_table_ids=["rtb-xxxxx"],
    vpc_endpoint_type="Gateway"
)

import * as ec2 from 'aws-cdk-lib/aws-ec2';

const vpc = ec2.Vpc.fromLookup(this, 'VPC', {
  vpcId: 'vpc-xxxxx'
});

const s3Endpoint = vpc.addGatewayEndpoint('S3Endpoint', {
  service: ec2.GatewayVpcEndpointAwsService.S3
});

resource "aws_vpc_endpoint" "sagemaker_api" {
  vpc_id              = "vpc-xxxxx"
  vpc_endpoint_type   = "Interface"
  service_name        = "com.amazonaws.us-east-1.sagemaker.api"
  subnet_ids          = ["subnet-xxxxx", "subnet-yyyyy"]
  security_group_ids  = ["sg-xxxxx"]
  private_dns_enabled = true
}

import pulumi_aws as aws

sagemaker_api_endpoint = aws.ec2.VpcEndpoint("sagemaker-api",
    vpc_id="vpc-xxxxx",
    vpc_endpoint_type="Interface",
    service_name="com.amazonaws.us-east-1.sagemaker.api",
    subnet_ids=["subnet-xxxxx", "subnet-yyyyy"],
    security_group_ids=["sg-xxxxx"],
    private_dns_enabled=True
)

import * as ec2 from 'aws-cdk-lib/aws-ec2';

const vpc = ec2.Vpc.fromLookup(this, 'VPC', {
  vpcId: 'vpc-xxxxx'
});

const sagemakerApiEndpoint = vpc.addInterfaceEndpoint('SageMakerAPI', {
  service: ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_API,
  subnets: {
    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS
  }
});

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

# Or modify existing VPC attributes
data "aws_vpc" "existing" {
  id = "vpc-xxxxx"
}

resource "aws_vpc_attribute" "enable_dns_support" {
  vpc_id               = data.aws_vpc.existing.id
  enable_dns_support   = true
}

resource "aws_vpc_attribute" "enable_dns_hostnames" {
  vpc_id               = data.aws_vpc.existing.id
  enable_dns_hostnames = true
}

import pulumi_aws as aws
vpc = aws.ec2.Vpc("main",
    cidr_block="10.0.0.0/16",
    enable_dns_support=True,
    enable_dns_hostnames=True
)

# Or modify existing VPC
existing_vpc = aws.ec2.get_vpc(id="vpc-xxxxx")
# Note: Pulumi manages these through VPC resource properties

import * as ec2 from 'aws-cdk-lib/aws-ec2';
const vpc = new ec2.Vpc(this, 'MainVPC', {
  maxAzs: 2,
  // DNS support and hostnames are enabled by default in CDK
});

// For existing VPC, these attributes should be set on the VPC construct
// CDK VPCs have enableDnsHostnames and enableDnsSupport set to true by default

resource "aws_cloudwatch_log_group" "vpc_flow_logs" {
  name              = "/aws/vpc/flowlogs"
  retention_in_days = 7
}

resource "aws_iam_role" "vpc_flow_logs_role" {
  name = "vpc-flow-logs-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "vpc-flow-logs.amazonaws.com"
      }
    }]
  })
}

resource "aws_iam_role_policy" "vpc_flow_logs_policy" {
  name = "vpc-flow-logs-policy"
  role = aws_iam_role.vpc_flow_logs_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams"
      ]
      Effect   = "Allow"
      Resource = "*"
    }]
  })
}

resource "aws_flow_log" "vpc_flow_log" {
  vpc_id                   = "vpc-xxxxx"
  traffic_type             = "ALL"
  log_destination_type     = "cloud-watch-logs"
  log_destination          = aws_cloudwatch_log_group.vpc_flow_logs.arn
  iam_role_arn             = aws_iam_role.vpc_flow_logs_role.arn
}

import pulumi_aws as aws
import pulumi
log_group = aws.cloudwatch.LogGroup("vpc-flow-logs",
    name="/aws/vpc/flowlogs",
    retention_in_days=7
)

# Create IAM role for VPC Flow Logs
flow_logs_role = aws.iam.Role("vpc-flow-logs-role",
    assume_role_policy=pulumi.Output.json_dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": "vpc-flow-logs.amazonaws.com"
            }
        }]
    })
)

# Attach policy to role
flow_logs_policy = aws.iam.RolePolicy("vpc-flow-logs-policy",
    role=flow_logs_role.id,
    policy=pulumi.Output.json_dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }]
    })
)

# Create VPC Flow Log
flow_log = aws.ec2.FlowLog("vpc-flow-log",
    vpc_id="vpc-xxxxx",
    traffic_type="ALL",
    log_destination_type="cloud-watch-logs",
    log_destination=log_group.arn,
    iam_role_arn=flow_logs_role.arn
)

import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as logs from 'aws-cdk-lib/aws-logs';
import * as iam from 'aws-cdk-lib/aws-iam';
const logGroup = new logs.LogGroup(this, 'VPCFlowLogs', {
  logGroupName: '/aws/vpc/flowlogs',
  retention: logs.RetentionDays.ONE_WEEK
});

// Create VPC Flow Log (IAM role created automatically)
const vpc = ec2.Vpc.fromLookup(this, 'VPC', {
  vpcId: 'vpc-xxxxx'
});

vpc.addFlowLog('FlowLog', {
  destination: ec2.FlowLogDestination.toCloudWatchLogs(logGroup),
  trafficType: ec2.FlowLogTrafficType.ALL
});

resource "aws_vpc_endpoint" "sagemaker_api" {
  vpc_id              = "vpc-xxxxx"
  service_name        = "com.amazonaws.us-east-1.sagemaker.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = ["subnet-aaaaa", "subnet-bbbbb"]
  security_group_ids  = ["sg-training"]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "sagemaker_runtime" {
  vpc_id              = "vpc-xxxxx"
  service_name        = "com.amazonaws.us-east-1.sagemaker.runtime"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = ["subnet-aaaaa", "subnet-bbbbb"]
  security_group_ids  = ["sg-endpoint"]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "s3" {
  vpc_id          = "vpc-xxxxx"
  service_name    = "com.amazonaws.us-east-1.s3"
  route_table_ids = ["rtb-xxxxx"]
}

resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = "vpc-xxxxx"
  service_name        = "com.amazonaws.us-east-1.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = ["subnet-aaaaa", "subnet-bbbbb"]
  security_group_ids  = ["sg-training"]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = "vpc-xxxxx"
  service_name        = "com.amazonaws.us-east-1.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = ["subnet-aaaaa", "subnet-bbbbb"]
  security_group_ids  = ["sg-training"]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "logs" {
  vpc_id              = "vpc-xxxxx"
  service_name        = "com.amazonaws.us-east-1.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = ["subnet-aaaaa", "subnet-bbbbb"]
  security_group_ids  = ["sg-training"]
  private_dns_enabled = true
}

# Training Job
resource "aws_sagemaker_training_job" "secure_training" {
  training_job_name = "secure-training-job"
  role_arn          = "arn:aws:iam::account-id:role/SageMakerRole"

  algorithm_specification {
    training_image       = "my-secure-training-image"
    training_input_mode  = "File"
  }

  resource_config {
    instance_type     = "ml.p3.2xlarge"
    instance_count    = 2
    volume_size_in_gb = 100
  }

  vpc_config {
    subnets            = ["subnet-aaaaa", "subnet-bbbbb"]
    security_group_ids = ["sg-training"]
  }

  enable_network_isolation         = true
  enable_inter_container_traffic_encryption = true

  output_data_config {
    s3_output_path = "s3://my-bucket/output"
  }

  stopping_condition {
    max_runtime_in_seconds = 86400
  }
}

# Model
resource "aws_sagemaker_model" "secure_model" {
  name               = "secure-ml-model"
  execution_role_arn = "arn:aws:iam::account-id:role/SageMakerRole"

  primary_container {
    image          = "my-secure-training-image"
    model_data_url = "s3://my-bucket/model.tar.gz"
  }

  vpc_config {
    subnets            = ["subnet-aaaaa", "subnet-bbbbb"]
    security_group_ids = ["sg-endpoint"]
  }
}

# Endpoint Configuration
resource "aws_sagemaker_endpoint_configuration" "secure_config" {
  name = "secure-endpoint-config"

  production_variants {
    variant_name           = "primary"
    model_name             = aws_sagemaker_model.secure_model.name
    initial_instance_count = 2
    instance_type          = "ml.m5.xlarge"
  }
}

# Endpoint
resource "aws_sagemaker_endpoint" "secure_endpoint" {
  name                 = "secure-ml-endpoint"
  endpoint_config_name = aws_sagemaker_endpoint_configuration.secure_config.name
}

import pulumi_aws as aws
sagemaker_api = aws.ec2.VpcEndpoint("sagemaker-api",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.sagemaker.api",
    vpc_endpoint_type="Interface",
    subnet_ids=["subnet-aaaaa", "subnet-bbbbb"],
    security_group_ids=["sg-training"],
    private_dns_enabled=True
)

sagemaker_runtime = aws.ec2.VpcEndpoint("sagemaker-runtime",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.sagemaker.runtime",
    vpc_endpoint_type="Interface",
    subnet_ids=["subnet-aaaaa", "subnet-bbbbb"],
    security_group_ids=["sg-endpoint"],
    private_dns_enabled=True
)

s3_endpoint = aws.ec2.VpcEndpoint("s3",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.s3",
    route_table_ids=["rtb-xxxxx"]
)

ecr_api = aws.ec2.VpcEndpoint("ecr-api",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.ecr.api",
    vpc_endpoint_type="Interface",
    subnet_ids=["subnet-aaaaa", "subnet-bbbbb"],
    security_group_ids=["sg-training"],
    private_dns_enabled=True
)

ecr_dkr = aws.ec2.VpcEndpoint("ecr-dkr",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.ecr.dkr",
    vpc_endpoint_type="Interface",
    subnet_ids=["subnet-aaaaa", "subnet-bbbbb"],
    security_group_ids=["sg-training"],
    private_dns_enabled=True
)

logs_endpoint = aws.ec2.VpcEndpoint("logs",
    vpc_id="vpc-xxxxx",
    service_name="com.amazonaws.us-east-1.logs",
    vpc_endpoint_type="Interface",
    subnet_ids=["subnet-aaaaa", "subnet-bbbbb"],
    security_group_ids=["sg-training"],
    private_dns_enabled=True
)

# Training Job
training_job = aws.sagemaker.TrainingJob("secure-training",
    training_job_name="secure-training-job",
    role_arn="arn:aws:iam::account-id:role/SageMakerRole",
    algorithm_specification=aws.sagemaker.TrainingJobAlgorithmSpecificationArgs(
        training_image="my-secure-training-image",
        training_input_mode="File"
    ),
    resource_config=aws.sagemaker.TrainingJobResourceConfigArgs(
        instance_type="ml.p3.2xlarge",
        instance_count=2,
        volume_size_in_gb=100
    ),
    vpc_config=aws.sagemaker.TrainingJobVpcConfigArgs(
        subnets=["subnet-aaaaa", "subnet-bbbbb"],
        security_group_ids=["sg-training"]
    ),
    enable_network_isolation=True,
    enable_inter_container_traffic_encryption=True,
    output_data_config=aws.sagemaker.TrainingJobOutputDataConfigArgs(
        s3_output_path="s3://my-bucket/output"
    ),
    stopping_condition=aws.sagemaker.TrainingJobStoppingConditionArgs(
        max_runtime_in_seconds=86400
    )
)

# Model
model = aws.sagemaker.Model("secure-model",
    name="secure-ml-model",
    execution_role_arn="arn:aws:iam::account-id:role/SageMakerRole",
    primary_container=aws.sagemaker.ModelPrimaryContainerArgs(
        image="my-secure-training-image",
        model_data_url="s3://my-bucket/model.tar.gz"
    ),
    vpc_config=aws.sagemaker.ModelVpcConfigArgs(
        subnets=["subnet-aaaaa", "subnet-bbbbb"],
        security_group_ids=["sg-endpoint"]
    )
)

# Endpoint Configuration
endpoint_config = aws.sagemaker.EndpointConfiguration("secure-config",
    name="secure-endpoint-config",
    production_variants=[aws.sagemaker.EndpointConfigurationProductionVariantArgs(
        variant_name="primary",
        model_name=model.name,
        initial_instance_count=2,
        instance_type="ml.m5.xlarge"
    )]
)

# Endpoint
endpoint = aws.sagemaker.Endpoint("secure-endpoint",
    name="secure-ml-endpoint",
    endpoint_config_name=endpoint_config.name
)

import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as sagemaker from 'aws-cdk-lib/aws-sagemaker';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Stack, StackProps } from 'aws-cdk-lib';

export class SecureSageMakerStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);
    const vpc = ec2.Vpc.fromLookup(this, 'VPC', {
      vpcId: 'vpc-xxxxx'
    });

    const privateSubnet1 = ec2.Subnet.fromSubnetId(this, 'PrivateSubnet1', 'subnet-aaaaa');
    const privateSubnet2 = ec2.Subnet.fromSubnetId(this, 'PrivateSubnet2', 'subnet-bbbbb');

    // Security Groups
    const trainingSg = ec2.SecurityGroup.fromSecurityGroupId(this, 'TrainingSG', 'sg-training');
    const endpointSg = ec2.SecurityGroup.fromSecurityGroupId(this, 'EndpointSG', 'sg-endpoint');

    // VPC Endpoints
    vpc.addInterfaceEndpoint('SageMakerAPI', {
      service: ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_API,
      subnets: { subnets: [privateSubnet1, privateSubnet2] }
    });

    vpc.addInterfaceEndpoint('SageMakerRuntime', {
      service: ec2.InterfaceVpcEndpointAwsService.SAGEMAKER_RUNTIME,
      subnets: { subnets: [privateSubnet1, privateSubnet2] }
    });

    vpc.addGatewayEndpoint('S3Endpoint', {
      service: ec2.GatewayVpcEndpointAwsService.S3
    });

    vpc.addInterfaceEndpoint('ECR', {
      service: ec2.InterfaceVpcEndpointAwsService.ECR,
      subnets: { subnets: [privateSubnet1, privateSubnet2] }
    });

    vpc.addInterfaceEndpoint('ECRDocker', {
      service: ec2.InterfaceVpcEndpointAwsService.ECR_DOCKER,
      subnets: { subnets: [privateSubnet1, privateSubnet2] }
    });

    vpc.addInterfaceEndpoint('CloudWatchLogs', {
      service: ec2.InterfaceVpcEndpointAwsService.CLOUDWATCH_LOGS,
      subnets: { subnets: [privateSubnet1, privateSubnet2] }
    });

    // IAM Role
    const sagemakerRole = iam.Role.fromRoleArn(this, 'SageMakerRole',
      'arn:aws:iam::account-id:role/SageMakerRole'
    );

    // Model
    const model = new sagemaker.CfnModel(this, 'SecureModel', {
      modelName: 'secure-ml-model',
      executionRoleArn: sagemakerRole.roleArn,
      primaryContainer: {
        image: 'my-secure-training-image',
        modelDataUrl: 's3://my-bucket/model.tar.gz'
      },
      vpcConfig: {
        subnets: ['subnet-aaaaa', 'subnet-bbbbb'],
        securityGroupIds: ['sg-endpoint']
      }
    });

    // Endpoint Configuration
    const endpointConfig = new sagemaker.CfnEndpointConfig(this, 'SecureEndpointConfig', {
      endpointConfigName: 'secure-endpoint-config',
      productionVariants: [{
        variantName: 'primary',
        modelName: model.modelName!,
        initialInstanceCount: 2,
        instanceType: 'ml.m5.xlarge'
      }]
    });

    // Endpoint
    const endpoint = new sagemaker.CfnEndpoint(this, 'SecureEndpoint', {
      endpointName: 'secure-ml-endpoint',
      endpointConfigName: endpointConfig.endpointConfigName!
    });

    endpoint.addDependency(endpointConfig);
  }
}