SageMaker domain should be in a VPC with security groups configured

What it checks

SageMaker domain: no VPC configuration is set.

Where it applies

Terraform: aws_sagemaker_domain

CloudFormation: AWS::SageMaker::Domain

How to fix it

1. Set vpc_id, subnet_ids (private subnets), and app_network_access_type = "VpcOnly". Configure security groups and VPC endpoints for S3/SageMaker API access.

Frameworks

• SOC 2 CC6.6
• NIST 800-53 rev5 SC-7

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules