Sagemaker Endpoint Should Have KMS Key Configured
More Info:
Ensure Sagemaker enpoint has KMS key configuredRisk Level
HighAddress
SecurityCompliance Standards
ISO27001,HIPAA,NISTCSF,PCIDSS,AWSSSB,RBI_UCBTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of a Sagemaker Endpoint not having a KMS key configured for AWS DynamoDB using the AWS console, follow these steps:
- Open AWS Management Console: Go to the AWS Management Console at https://aws.amazon.com/ and log in to your account.
- Navigate to Amazon Sagemaker Console: Click on the “Services” dropdown menu at the top left corner of the console, search for “Sagemaker” and click on it to open the Amazon Sagemaker console.
- Select Endpoints: In the Amazon Sagemaker console, click on “Endpoints” from the left-hand side menu to view the list of endpoints.
- Select the Endpoint: Identify the Sagemaker Endpoint that is connected to the AWS DynamoDB table that needs a KMS key configured and click on its name to open the details page.
- Edit Endpoint Configuration: On the details page of the Sagemaker Endpoint, click on the “Edit” button to modify the endpoint configuration.
- Configure KMS Key: In the Endpoint configuration settings, look for the option to configure the KMS key for the endpoint. If the option is not available, it means that the endpoint is not encrypted with a KMS key.
- Select KMS Key: Click on the dropdown menu or input field to select or enter the KMS key that you want to use to encrypt the data for the Sagemaker Endpoint connected to the DynamoDB table.
- Save Changes: After selecting the appropriate KMS key, click on the “Save” or “Update” button to apply the changes to the Sagemaker Endpoint configuration.
- Verify Configuration: Once the changes are saved, verify that the KMS key is successfully configured for the Sagemaker Endpoint connected to the AWS DynamoDB table by checking the endpoint details.
Using CLI
Using CLI
To remediate the misconfiguration of Sagemaker Endpoint not having a KMS Key configured for AWS DynamoDB using AWS CLI, follow these steps:
-
Identify the Sagemaker Endpoint: Use the AWS CLI command to identify the Sagemaker Endpoint that needs to have a KMS Key configured. You can list all the Sagemaker endpoints using the following command:
-
Get the ARN of the Sagemaker Endpoint: Once you have identified the Sagemaker Endpoint that needs to be configured, get the ARN of that endpoint using the following command:
-
Identify the KMS Key: Next, identify the KMS Key that you want to associate with the Sagemaker Endpoint. You can list all the available KMS keys using the following command:
-
Update the Sagemaker Endpoint Configuration: Update the Sagemaker Endpoint configuration to associate it with the KMS Key. Use the following command to update the Sagemaker Endpoint configuration:
<endpoint-name> with the actual name of the Sagemaker Endpoint and <kms-key-id> with the ARN of the KMS Key that you want to associate with the Sagemaker Endpoint.By following these steps, you can successfully remediate the misconfiguration of the Sagemaker Endpoint not having a KMS Key configured for AWS DynamoDB using AWS CLI.Using Python
Using Python
To remediate the misconfiguration of Sagemaker Endpoint not having a KMS Key configured in AWS, you can follow these steps using Python:
- Import the necessary libraries:
- Initialize the DynamoDB client:
- Get the list of all the Sagemaker endpoints:
- For each Sagemaker endpoint, check if it is using the KMS key:
- Run the Python script to remediate the misconfiguration of Sagemaker Endpoint not having a KMS Key configured.