Users should not have root access to SageMaker notebook instances

How to fix it

• Interrupts service: The instance must be stopped for the change, which ends work running on it and clears everything outside /home/ec2-user/SageMaker.
• Can break clients: Users lose sudo and Docker becomes Rootless Docker, so move anything they install as root into a lifecycle configuration script or a conda environment first.

In the console

SageMaker AI → Notebook instances → the stopped notebook instance → Edit → Root access

Root access

Disable

With the AWS CLI

aws sagemaker update-notebook-instance --notebook-instance-name <notebook-instance-name> --root-access Disabled --region <region>

With Terraform

resource "aws_sagemaker_notebook_instance" "this" {
  name          = var.notebook_instance_name
  instance_type = var.instance_type
  role_arn      = var.role_arn
  root_access   = "Disabled"
}