Medium
SageMaker
Regional
SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys
Description
Flags Amazon SageMaker inference experiments that capture data but specify no KMS key for the captured data at rest. Applies only when data storage capture is configured.
Remediation
Recreate each inference experiment with DataStorageConfig.KmsKey set.
Steps
- Identify the affected inference experiment via the SageMaker console.
- Re-create it (create_inference_experiment) with DataStorageConfig.KmsKey pointing at a customer managed KMS key.
- Resume the experiment once the new configuration is in place.