Back to All Checks
Medium SageMaker Regional

SageMaker feature group offline stores should be encrypted with AWS KMS keys

Description

Flags Amazon SageMaker feature groups whose offline store does not specify a KMS key. Without an explicit KmsKeyId, the underlying S3 storage relies on bucket-level encryption settings instead of feature-store-managed encryption.

Remediation

Recreate each feature group with OfflineStoreConfig.S3StorageConfig.KmsKeyId set.

Steps

  1. Identify the affected feature group via the SageMaker console.
  2. Re-create it (create_feature_group) with OfflineStoreConfig.S3StorageConfig.KmsKeyId pointing at a KMS key.
  3. Migrate downstream consumers to the new feature group.
Start Your Free Security Check