Back to All Checks
Medium SageMaker Regional

SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys

Description

Flags Amazon SageMaker feature groups whose online store uses standard storage without a KMS key. Without an explicit KmsKeyId the online store relies on default service encryption rather than a key you control.

Remediation

Recreate each feature group with OnlineStoreConfig.SecurityConfig.KmsKeyId set.

Steps

  1. Identify the affected feature group via the SageMaker console.
  2. Re-create it (create_feature_group) with OnlineStoreConfig.SecurityConfig.KmsKeyId pointing at a KMS key.
  3. Migrate downstream consumers to the new feature group.
Start Your Free Security Check