SageMaker notebook instances in a VPC use interface endpoints so API traffic stays on the AWS network, but users outside the VPC still can access the notebook instances over the internet. What actions should you take to prevent external users from accessing the notebooks while allowing legitimate VPC-based access?

The correct answer is to create an IAM policy that restricts sagemaker:CreatePresignedNotebookInstanceUrl and sagemaker:DescribeNotebookInstance actions to only originate from VPC endpoints. This ensures that even if a user has valid credentials, they can only access the notebook instance from within the specified VPC, preventing external internet access while allowing legitimate VPC-based access. Modifying security groups to only allow traffic from VPC CIDR ranges is insufficient because SageMaker notebook instances are accessed via presigned URLs, not direct network connections. The security group controls network-level access to the underlying EC2 instance, but the control plane access (creating the presigned URL) is what needs restriction. Adding a NAT gateway and converting subnets to private only affects outbound internet access for the notebook instances themselves, not inbound access for users trying to connect to the notebook service. Changing the subnet network ACL to block traffic from outside the VPC would also not prevent access via the SageMaker control plane, which is how users initiate connections to notebook instances.