A Notebook that Is Not Root with Open Egress
AWS defaults a notebook to direct internet access AND root access: a root shell with a path off the network that misses your NAT, routing and DNS firewall, holding a role chosen to read your training data. Both off here, IMDSv2 only.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "sagemaker_notebook" {
source = "www.iac-bazaar.com/iac-bazaar/aws-sagemaker-notebook/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-sagemaker-notebook?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Notebook that Is Not Root with Open Egress](https://www.iac-bazaar.com/catalog/aws-sagemaker-notebook?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "sagemaker_notebook" {
source = "www.iac-bazaar.com/iac-bazaar/aws-sagemaker-notebook/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-sagemaker-notebook
A SageMaker notebook instance, with the two AWS defaults that combine into the
worst shape in this service turned off. Works with Terraform and OpenTofu
(>= 1.6), AWS provider >= 6.0, < 7.0.
Both of these are on unless you turn them off:
direct_internet_access = Enabledgives the notebook an egress path that does not pass through your VPC at all - not your NAT gateway, not your routing, not your DNS firewall, not anything you inspect. Exposed here as a plaininternet_accessbool, defaulting to falseroot_access = Enabledgives whoever opens the notebook root on the instance
Together that is a root shell with an unfiltered path off the network, holding an IAM role chosen so it can read your training data. A notebook is an interactive machine other people type into, which is exactly why it should be the least trusted thing in the account rather than the most convenient. This module turns both off, requires a subnet, and makes each exception an explicit statement.
egress_goes_through_your_vpc and has_root_access are outputs so a policy
test can assert on them rather than a person reading the plan.
Three more things it does:
- IMDSv2 only. IMDSv1 lets any process that can make an HTTP request read the instance role's credentials - including a notebook cell somebody pasted in
- Requires security groups when the notebook is in a subnet. Without them AWS attaches the VPC default group, which is rarely what anybody inspected
- Refuses an unencrypted volume unless stated. The volume holds whatever the notebook has pulled down, which for a notebook is the interesting subset
lifecycle_config_name is documented rather than defaulted, because it is where
an auto-stop timer goes and an idle notebook nobody stopped is the commonest
surprise on a SageMaker bill.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- One suppressed policy, and why
- Usage
Related modules
aws-bedrock-guardrail
Creating a guardrail does not apply it: the application must send guardrailIdentifier and guardrailVersion on every call, and DRAFT is mutable. This publishes a numbered version, outputs the two values your code needs, and refuses a guardrail with no policies at all - which attaches successfully, filters nothing, and reports as active.
huawei-machine-learning
A ModelArts workspace and notebook with allowed_access_ips required, since empty means any address and the notebook has your training data mounted and your credentials in its environment. auth_type PUBLIC means every user in the account rather than the internet. There is no auto-stop argument, and the module says so rather than implying a protection it cannot give.
alicloud-machine-learning
A PAI workspace and the people in it. Created with no members the workspace belongs to whoever ran the apply and the team seeing nothing reads as a permissions problem elsewhere. env_types is fixed at creation and decides whether a dev-to-prod pipeline is even possible, and the role names are the permission model, so each member names their own.
azure-machine-learning
The workspace endpoint is public by default, and the managed network compute runs in defaults to Disabled isolation - unrestricted outbound internet from a network that holds training data. Private workspace, outbound isolation on, high-business-impact flag set so less leaves for Microsoft, identity-based storage access, and a customer-managed key; the four dependencies stay yours.
oci-data-science
A notebook session with no subnet runs on Oracle's network with internet egress and no path to your VCN, and a session left ACTIVE bills its shape - a GPU, over a weekend - whether or not anyone is in it. Sessions attach to your subnet, the shape and storage are set on purpose, and the sessions that are billing from the moment of apply are listed in an output.
gcp-vertex-ai
A Vertex AI Endpoint for online prediction with optional CMEK, optional Private Service Access networking and request/response logging - model deployment left to you, so it stands up for cents.