🛡️ AWS SageMaker Notebook Instance is not encrypted with a Customer-Managed KMS key🟢

• Contextual name: 🛡️ Notebook Instance is not encrypted with a Customer-Managed KMS key🟢
• ID: /ce/ca/aws/sagemaker/notebook-instance-encryption-with-cmk
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS SageMaker Notebook Instance
  • 🔌 AWS SageMaker Notebook Instance - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Cloud Conformity: Notebook Data Encrypted With KMS Customer Managed Keys

Description

Open File

Description

This policy identifies AWS SageMaker Notebook Instances that are not configured to use a Customer-Managed Key (CMK) from AWS Key Management Service (KMS) for encrypting data at rest. By default, SageMaker uses an AWS-managed key for encryption; however, using a Customer-Managed Key provides enhanced control over key management and access policies.

Rationale

Encrypting SageMaker notebook instance volumes with a Customer-Managed Key provides stronger security and compliance controls. It allows for full lifecycle management of the encryption key, including creation, rotation, and deactivation. It also enables fine-grained access controls and auditing of key usage, supporting adherence to organizational and regulatory data protection requirements.

Impact

Remediation requires provisioning a new SageMaker notebook instance configured with the desired Customer-Managed Key, as the encryption key of an existing instance cannot be modified. This process may involve migrating data from the current instance to the newly created one.

... see more

Remediation

Open File

Remediation

Enable Encryption for SageMaker Notebook Instances Using Customer-Managed KMS Keys

To remediate this violation, create a new SageMaker notebook instance configured with a Customer-Managed Key (CMK) from AWS KMS and migrate any required data from the existing unencrypted instance. The encryption key cannot be modified for an existing notebook instance.

From Command Line

1. Create a new SageMaker notebook instance Ensure that the desired CMK already exists before running the following command:

   aws sagemaker create-notebook-instance \
       --notebook-instance-name {{new-instance-name}} \
       --instance-type {{instance-type}} \
       --role-arn {{iam-role-arn}} \
       --kms-key-id {{kms-key-arn}}

2. Migrate data and remove the incompliant instance

   • Once the new notebook instance is in the InService state, transfer any data, notebooks, or configurations from the old instance.
   • Thoroughly test the new notebook instance to ensure all data has been migrated correctly and that it functions as expected.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest			20		no data
💼 Cloudaware Framework → 💼 Data Encryption			70		no data