SageMaker notebook instances should be encrypted with customer managed AWS KMS keys

How to fix it

Set at creation: fixing it means replacing the resource.

Name a KMS key you control for the notebook instance's ML storage volume. KmsKeyId can only be set at creation, so the route is a new notebook instance created with the key named and the old one deleted. Move the work across deliberately, because the two instances share nothing: copy /home/ec2-user/SageMaker out before deleting the original, and reproduce anything installed outside that directory with the new instance's lifecycle configuration script. The volume can be grown later but never shrunk, so size it now.

In the console

SageMaker AI → Notebook instances → Create notebook instance → Encryption key

With the AWS CLI

aws sagemaker create-notebook-instance --notebook-instance-name <notebook-instance-name> --instance-type <instance-type> --role-arn <execution-role-arn> --kms-key-id <kms-key-arn> --region <region>

With Terraform

resource "aws_sagemaker_notebook_instance" "this" {
  name          = var.notebook_instance_name
  instance_type = var.instance_type
  role_arn      = var.execution_role_arn
  kms_key_id    = var.kms_key_arn
}