Skip to main content

Sagemaker Notebook Instance Should Have KMS Key Configured

More Info:​

Ensure Sagemaker notebook instance has KMS key configured

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • SWIFT Customer Security Controls Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

  1. Log in to the AWS Management Console:

    • Open the AWS Management Console and navigate to the SageMaker service.

  2. Create a New Notebook Instance:

    • Click on "Create notebook instance."

  3. Configure Notebook Instance:

    • Fill in the "Notebook instance name," "Notebook instance type," and other required fields.

  4. Configure Encryption:

    • Scroll down to the "Encryption settings" section.
    • Under "KMS key," select an existing KMS key from the dropdown or enter the KMS key ID manually.

  5. Create the Notebook Instance:

    • After configuring all necessary settings, click on "Create notebook instance."
Using CLI

To create a SageMaker notebook instance with a specified KMS key, you can use the following CLI command:

aws sagemaker create-notebook-instance \
    --notebook-instance-name <YourNotebookInstanceName> \
    --instance-type <InstanceType> \
    --role-arn <IAMRoleARN> \
    --kms-key-id <KMSKeyID> \
    --volume-size-in-gb <VolumeSize> \
    --default-code-repository <CodeRepositoryURL> \
    --additional-code-repositories <AdditionalCodeRepositories>

Replace the placeholders (<YourNotebookInstanceName>, <InstanceType>, <IAMRoleARN>, <KMSKeyID>, <VolumeSize>, <CodeRepositoryURL>, and <AdditionalCodeRepositories>) with appropriate values.

Using Python

To create a SageMaker notebook instance with a specified KMS key using a Python script, you'll need the boto3 library:

  1. Install boto3 (if not already installed):
pip install boto3
  1. Script to Create a Notebook Instance:
import boto3

sagemaker = boto3.client('sagemaker')

def create_notebook_instance():
    response = sagemaker.create_notebook_instance(
        NotebookInstanceName='<YourNotebookInstanceName>',
        InstanceType='<InstanceType>',
        RoleArn='<IAMRoleARN>',
        KmsKeyId='<KMSKeyID>',
        VolumeSizeInGB=<VolumeSize>,
        DefaultCodeRepository='<CodeRepositoryURL>',
        AdditionalCodeRepositories=['<AdditionalCodeRepositories>']
    )
    print(response)

# Replace placeholders with appropriate values
create_notebook_instance()

Replace the placeholders (<YourNotebookInstanceName>, <InstanceType>, <IAMRoleARN>, <KMSKeyID>, <VolumeSize>, <CodeRepositoryURL>, and <AdditionalCodeRepositories>) with appropriate values.

Using Terraform
resource "aws_sagemaker_notebook_instance" "THIS_NOTEBOOK" {
  name                    = "NOTEBOOK_INSTANCE_NAME"        # substitute with the notebook instance name
  role_arn                = aws_iam_role.sagemaker_role.arn # or an existing role ARN
  instance_type           = "ml.t3.medium"                  # substitute as appropriate
  subnet_id               = "SUBNET_ID"                     # if applicable
  security_groups         = ["SECURITY_GROUP_ID"]           # if applicable

  # This is the critical fix: configure a KMS key for the notebook volume
  kms_key_id              = "KMS_KEY_ID_OR_ARN"             # substitute with your KMS key ID or ARN

  # other required arguments as used in your environment...
}

Changing kms_key_id on an existing aws_sagemaker_notebook_instance causes Terraform to perform an in‑place update that mirrors the CLI sequence (stop → update → start), resulting in a temporary service interruption but not a resource replacement.

Ensure the SageMaker execution role attached to this notebook instance has permissions on the specified KMS key (for example kms:CreateGrant, kms:Encrypt, kms:Decrypt).

Verification: terraform plan should show an in‑place update of aws_sagemaker_notebook_instance.THIS_NOTEBOOK with kms_key_id changing from null (or the old key) to "KMS_KEY_ID_OR_ARN".