SageMaker feature group offline stores should be encrypted with AWS KMS keys

How to fix it

Set at creation: fixing it means replacing the resource.

Name a KMS key you control in the feature group's offline store configuration. The key is set when the group is created and there is no update that adds it, so the route is a new feature group with the key named, the historical data recopied into it, and every reader and writer repointed before the old group is deleted. The key must be symmetric, and the role passed to the create call needs kms:GenerateDataKey on it. Reusing the online store's key fails the create call if its policy carries a kms:ViaService condition, which works for the online store only. Failing does not mean the data is in the clear, only that the key is AWS's rather than yours. A group that also has an online store carries a second, independent key that SageMaker.18 reads, so set both in the one replacement.

With the AWS CLI

aws sagemaker create-feature-group --feature-group-name <feature-group-name> --record-identifier-feature-name <record-identifier> --event-time-feature-name <event-time-feature> --feature-definitions '[{"FeatureName":"<record-identifier>","FeatureType":"String"}]' --role-arn <execution-role-arn> --offline-store-config '{"S3StorageConfig":{"S3Uri":"s3://<bucket>/<prefix>","KmsKeyId":"<kms-key-arn>"}}' --region <region>

With Terraform

resource "aws_sagemaker_feature_group" "this" {
  feature_group_name             = var.feature_group_name
  record_identifier_feature_name = var.record_identifier
  event_time_feature_name        = var.event_time_feature
  role_arn                       = var.execution_role_arn

  feature_definition {
    feature_name = var.record_identifier
    feature_type = "String"
  }

  offline_store_config {
    s3_storage_config {
      s3_uri     = var.offline_store_s3_uri
      kms_key_id = var.kms_key_arn
    }
  }
}