These rules identify running SageMaker notebook instances and idle real-time endpoints that may no longer be needed, helping avoid unnecessary compute charges.
| Rule ID | Scan Type | Severity | Name |
|---|---|---|---|
| CLDBRN-AWS-SAGEMAKER-1 | Discovery | High | SageMaker Notebook Instance Running |
| CLDBRN-AWS-SAGEMAKER-2 | Discovery | High | SageMaker Endpoint Idle |
CLDBRN-AWS-SAGEMAKER-1
SageMaker Notebook Instance Running
Scan type: Discovery
Severity: High
What it checks
Flags SageMaker notebook instances whose status remains InService. Running notebook instances incur compute charges continuously until stopped.
Why it matters
SageMaker notebook instances are billed per second while in the InService state. A ml.t3.medium notebook instance costs roughly $50/month running 24/7. Data scientists frequently leave notebook instances running after their analysis is complete, leading to persistent compute charges for idle resources.
What triggers a finding
notebookInstanceStatus is InService.
How to remediate
Stop the notebook instance when it is not actively in use. Consider implementing lifecycle configuration scripts that automatically stop idle instances after a period of inactivity. SageMaker Studio provides a more managed alternative with automatic shutdown capabilities.
aws sagemaker stop-notebook-instance --notebook-instance-name my-notebook
CLDBRN-AWS-SAGEMAKER-2
SageMaker Endpoint Idle
Scan type: Discovery
Severity: High
What it checks
Flags SageMaker real-time inference endpoints that are InService, old enough to have a full observation window, and have received zero invocations over the past 14 days.
Why it matters
A real-time SageMaker endpoint keeps its underlying instances running around the clock regardless of traffic. An idle ml.m5.xlarge endpoint costs well over $150/month for zero inference requests. Endpoints are easy to leave behind after a model evaluation or demo project wraps up, since nothing about the endpoint signals it's unused the way a stopped instance would.
What triggers a finding
All of the following must be true:
endpointStatusisInServicetotalInvocationsLast14Daysis exactly0(anullvalue means CloudWatch didn't return complete coverage for the window, and the endpoint is skipped rather than flagged)creationTimeis 14 or more days in the past
How to remediate
Confirm no application or scheduled job depends on the endpoint, then delete it:
aws sagemaker delete-endpoint --endpoint-name my-endpoint
For endpoints with genuinely intermittent traffic, consider SageMaker Serverless Inference, which scales to zero between invocations automatically. Asynchronous Inference can also reach zero instances, but only when you configure Application Auto Scaling with a minimum capacity of 0 and a scale-out policy — without that, an async endpoint keeps billing for its provisioned instances just like the real-time endpoint it replaced.
See Also
- CLI discover command - scan live AWS resources
- SDK Reference - run discovery programmatically