> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # SageMaker Notebook Instance Root Access Should Be Disabled ### More Info: SageMaker Notebook Instance root access should be disabled ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * ISO 27001 * ISO/IEC 27018 * ISO/IEC 27701 * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Below are the console steps to disable root access for an existing (or new) SageMaker notebook instance. *** ## A. Check current root access setting 1. Sign in to the **AWS Management Console**. 2. Open the **Amazon SageMaker** console. 3. In the left menu, choose **Notebook instances**. 4. Find your notebook instance and look at the **Root access** column: * It will show **Enabled** or **Disabled**. If it’s already **Disabled**, no further change is needed. *** ## B. Disable root access for an existing notebook instance 1. In the **Notebook instances** list, select the notebook you want to change. 2. Make sure the notebook is **Stopped**: * If it is **InService**, choose **Stop** and wait until the status becomes **Stopped**. 3. With the notebook instance selected, choose **Edit** (or **Actions ➜ Edit** depending on the UI). 4. In the edit screen, locate the **Root access** setting. 5. Change **Root access** to: * **Disabled** 6. Review any other settings you do not want to change, then scroll down and choose **Submit** or **Save changes**. 7. After the edit completes, select the notebook instance and choose **Start** to bring it back **InService**. *** ## C. Disable root access when creating a new notebook instance 1. In the SageMaker console, go to **Notebook instances**. 2. Choose **Create notebook instance**. 3. Configure the required details (name, instance type, IAM role, VPC, etc.). 4. Find the **Root access** setting. 5. Set **Root access** to: * **Disabled** 6. Complete the rest of the configuration as required and choose **Create notebook instance**. The notebook instance will now come up with root access disabled. To disable root access on a SageMaker Notebook Instance using AWS CLI, you must set the `--root-access` parameter to `Disabled` (either when creating the instance or by updating an existing one). Below are step‑by‑step instructions for both scenarios. *** ## 1. For a new Notebook Instance When creating a notebook instance, specify `--root-access Disabled`: ```bash theme={null} aws sagemaker create-notebook-instance \ --notebook-instance-name my-notebook-instance \ --instance-type ml.t3.medium \ --role-arn arn:aws:iam::123456789012:role/MySageMakerRole \ --root-access Disabled \ --region us-east-1 ``` Wait for the instance to be `InService` (you can check with): ```bash theme={null} aws sagemaker describe-notebook-instance \ --notebook-instance-name my-notebook-instance \ --region us-east-1 \ --query 'NotebookInstanceStatus' ``` *** ## 2. For an existing Notebook Instance You must update the configuration and then restart the instance. ### Step 2.1 – Stop the notebook instance (if running) ```bash theme={null} aws sagemaker stop-notebook-instance \ --notebook-instance-name my-notebook-instance \ --region us-east-1 ``` (Optional) Wait until it is stopped: ```bash theme={null} aws sagemaker describe-notebook-instance \ --notebook-instance-name my-notebook-instance \ --region us-east-1 \ --query 'NotebookInstanceStatus' ``` Ensure the status is `Stopped`. ### Step 2.2 – Update to disable root access ```bash theme={null} aws sagemaker update-notebook-instance \ --notebook-instance-name my-notebook-instance \ --root-access Disabled \ --region us-east-1 ``` ### Step 2.3 – Start the notebook instance again ```bash theme={null} aws sagemaker start-notebook-instance \ --notebook-instance-name my-notebook-instance \ --region us-east-1 ``` *** ## 3. Verify root access is disabled ```bash theme={null} aws sagemaker describe-notebook-instance \ --notebook-instance-name my-notebook-instance \ --region us-east-1 \ --query 'RootAccess' ``` Expected output: ```text theme={null} "Disabled" ``` You disable root access on a SageMaker notebook instance by updating its configuration via the SageMaker API (boto3). Below are the minimal steps in Python. *** ### 1. Prerequisites * AWS credentials/config set (via environment variables, IAM role, or config files). * `boto3` installed: ```bash theme={null} pip install boto3 ``` *** ### 2. Disable root access on an existing Notebook Instance ```python theme={null} import boto3 sagemaker = boto3.client("sagemaker", region_name="us-east-1") # change region if needed notebook_instance_name = "your-notebook-instance-name" # 1) Stop the notebook instance (must be stopped to update) sagemaker.stop_notebook_instance(NotebookInstanceName=notebook_instance_name) # Wait until it stops waiter = sagemaker.get_waiter("notebook_instance_stopped") waiter.wait(NotebookInstanceName=notebook_instance_name) # 2) Update the notebook instance to disable root access sagemaker.update_notebook_instance( NotebookInstanceName=notebook_instance_name, RootAccess="Disabled" # or "Enabled" ) # 3) Start the notebook instance again sagemaker.start_notebook_instance(NotebookInstanceName=notebook_instance_name) ``` *** ### 3. Create a new Notebook Instance with root access disabled ```python theme={null} import boto3 sagemaker = boto3.client("sagemaker", region_name="us-east-1") response = sagemaker.create_notebook_instance( NotebookInstanceName="my-secure-notebook", InstanceType="ml.t3.medium", RoleArn="arn:aws:iam::123456789012:role/SageMakerExecutionRole", RootAccess="Disabled", # add other parameters as needed, e.g. SubnetId, SecurityGroupIds, etc. ) ``` This will create/run the notebook instance with root access disabled from the start.