SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys

How to fix it

Set at creation: fixing it means replacing the resource.

Name a KMS key you control in the feature group's online store SecurityConfig. The key is set when the group is created and there is no update that adds it, so the route is a new feature group with the key named, the records reloaded into it, and every reader and writer repointed before the old group is deleted. The key must be symmetric, the principal creating the group needs a wider key policy than the offline store requires, CreateGrant included, and anything calling PutRecord, GetRecord or DeleteRecord afterwards needs Decrypt. Failing does not mean the records are in the clear, only that the key is AWS's rather than yours. A group that also has an offline store carries a second, independent key that SageMaker.17 reads, so set both in the one replacement.

With the AWS CLI

aws sagemaker create-feature-group --feature-group-name <feature-group-name> --record-identifier-feature-name <record-identifier> --event-time-feature-name <event-time-feature> --feature-definitions '[{"FeatureName":"<record-identifier>","FeatureType":"String"}]' --role-arn <execution-role-arn> --online-store-config '{"EnableOnlineStore":true,"StorageType":"Standard","SecurityConfig":{"KmsKeyId":"<kms-key-arn>"}}' --region <region>

With Terraform

resource "aws_sagemaker_feature_group" "this" {
  feature_group_name             = var.feature_group_name
  record_identifier_feature_name = var.record_identifier
  event_time_feature_name        = var.event_time_feature
  role_arn                       = var.execution_role_arn

  feature_definition {
    feature_name = var.record_identifier
    feature_type = "String"
  }

  online_store_config {
    enable_online_store = true
    storage_type        = "Standard"

    security_config {
      kms_key_id = var.kms_key_arn
    }
  }
}