Check ID: sagemaker_training_jobs_intercontainer_encryption_enabled
Provider: AWS
Service: sagemaker
Severity: MEDIUM
Categories: encryption, gen-ai
Resource type: Other

​
What this check verifies

Amazon SageMaker training jobs have inter-container traffic encryption configured for container-to-container communications during training. The evaluation inspects the EnableInterContainerTrafficEncryption setting on training jobs.

​
Risk

Without inter-container encryption, in-node traffic may be plaintext, enabling capture by a compromised host or co-resident workload. This threatens confidentiality (training data, model parameters, credentials) and integrity (tampering with gradients/results), and can facilitate lateral movement via token or session theft.

​
Recommendation

Enable EnableInterContainerTrafficEncryption on all training jobs to enforce encryption in transit. Apply defense in depth: combine with network isolation, limit roles and container privileges per least privilege, and standardize secure job templates or guardrails to prevent launching unencrypted jobs.

​
Remediation

# Terraform: SageMaker Training Job with inter-container traffic encryption enabled
resource "aws_sagemaker_training_job" "job" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  algorithm_specification {
    training_image      = "<example_resource_id>"
    training_input_mode = "File"
  }

  output_data_config {
    s3_output_path = "s3://<example_resource_name>/"
  }

  resource_config {
    instance_count = 1
    instance_type  = "ml.m5.large"
    volume_size_gb = 10
  }

  stopping_condition {
    max_runtime_in_seconds = 3600
  }

  enable_inter_container_traffic_encryption = true  # Critical: ensures inter-container traffic is encrypted
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = sagemaker_training_jobs_intercontainer_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks