Medium
SageMaker
Regional
SageMaker notebook instances should be encrypted with customer managed AWS KMS keys
Description
Flags Amazon SageMaker notebook instances that have no KMS key configured for storage-volume encryption. Without a KmsKeyId the volume is encrypted with the default AWS-owned key instead of one you manage.
Remediation
Recreate each notebook instance with a customer managed KmsKeyId set.
Steps
- Identify the affected notebook instance via the SageMaker console.
- Back up any work stored on the instance volume.
- Re-create the notebook instance (create_notebook_instance) with KmsKeyId pointing at a customer managed KMS key.