Check ID: sagemaker_notebook_instance_encryption_enabled
Provider: AWS
Service: sagemaker
Severity: HIGH
Categories: encryption, gen-ai
Resource type: AwsSageMakerNotebookInstance

​
What this check verifies

Amazon SageMaker notebook instances are assessed for at-rest encryption using an AWS KMS key. The finding reflects whether a KmsKeyId is configured for the notebook’s ML volume encryption.

​
Risk

Without at-rest encryption using a customer-managed KMS key, data on notebook EBS volumes and snapshots can be exposed via storage access, copied backups, or host compromise, reducing confidentiality and limiting key rotation and revocation controls.

​
Recommendation

Use a customer-managed KMS key for notebook ML volumes by setting KmsKeyId, and apply KMS to related S3 inputs/outputs. Enforce least privilege on key usage, enable rotation, and align key access with defense in depth to protect data at rest.

​
Remediation

# SageMaker notebook with KMS encryption
resource "aws_sagemaker_notebook_instance" "<example_resource_name>" {
  name          = "<example_resource_name>"
  role_arn      = "<example_resource_arn>"
  instance_type = "ml.t3.medium"
  kms_key_id    = "<example_resource_id>"  # Critical: enables EBS encryption using this KMS key
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sagemaker_notebook_instance_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks