SageMaker production variants run at least two instances

Check ID: sagemaker_endpoint_config_prod_variant_instances
Provider: AWS
Service: sagemaker
Severity: MEDIUM
Categories: resilience, gen-ai
Resource type: Other

What this check verifies

Amazon SageMaker endpoint configurations are evaluated to ensure each production variant uses an initial instance count of at least two. Variants with InitialInstanceCount less than two in instance-based endpoints are identified, indicating no built-in multi-AZ redundancy.

Risk

A single-instance variant is a single point of failure. If the instance or its Availability Zone fails, inference becomes unavailable, leading to service outages, SLA breaches, and cascading failures in dependent systems. This primarily degrades availability and reliability.

Recommendation

Apply the resilience principle:

Run each production variant with InitialInstanceCount >= 2
Spread capacity across AZs with health-based scaling
Use rolling/canary updates to avoid downtime
Right-size capacity to tolerate node loss

For bursty workloads, consider serverless or autoscaling for elasticity.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws sagemaker delete-endpoint-config —endpoint-config-name <endpoint-config-name>

# SageMaker Endpoint Configuration with InitialInstanceCount > 1
resource "aws_sagemaker_endpoint_configuration" "<example_resource_name>" {
  production_variants {
    variant_name           = "<example_resource_name>"
    model_name             = "<example_resource_name>"
    instance_type          = "ml.m5.large"
    initial_instance_count = 2 # Critical: set >=2 so the variant passes the check
  }
}

# CloudFormation: EndpointConfig with InitialInstanceCount > 1
Resources:
  <example_resource_name>:
    Type: AWS::SageMaker::EndpointConfig
    Properties:
      ProductionVariants:
        - VariantName: <example_resource_name>
          ModelName: <example_resource_name>
          InstanceType: ml.m5.large
          InitialInstanceCount: 2  # Critical: set >=2 so all variants start with at least two instances

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sagemaker_endpoint_config_prod_variant_instances. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 Multi-Region Access Point blocks all public access Amazon SageMaker model has network isolation enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires