SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys
Flags Amazon SageMaker inference experiments that capture data but specify no KMS key for the captured data at rest. Applies only when data storage capture is configured.
- service
- SageMaker
- severity
- Low
- scope
- evaluated in every region
How to fix it
Name a KMS key you control in the inference experiment's data storage configuration. This one does not need the experiment rebuilt: UpdateInferenceExperiment takes the whole data storage configuration, so the key can be added to an experiment that already exists, provided its status is Created or Running. A shadow test that has finished its window or been cancelled can no longer be updated, and the route to a compliant capture from there is a new experiment. The key applies from the moment it is set; payloads captured before that stay encrypted exactly as they were. SageMaker.23 reads a different key on the same experiment, over the instance storage volume, and that one does need the experiment recreated.
With the AWS CLI
aws sagemaker update-inference-experiment --name <experiment-name> --data-storage-config '{"Destination":"s3://<bucket>/<prefix>","KmsKey":"<kms-key-arn>"}' --region <region>See which of your accounts this check is failing on.
Book a demo