> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sagemaker notebook instance kms key configured remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. **Log in to the AWS Management Console:**
           * Open the AWS Management Console and navigate to the SageMaker service.

        2. **Create a New Notebook Instance:**
           * Click on "Create notebook instance."

        3. **Configure Notebook Instance:**
           * Fill in the "Notebook instance name," "Notebook instance type," and other required fields.

        4. **Configure Encryption:**
           * Scroll down to the "Encryption settings" section.
           * Under "KMS key," select an existing KMS key from the dropdown or enter the KMS key ID manually.

        5. **Create the Notebook Instance:**
           * After configuring all necessary settings, click on "Create notebook instance."
      </Accordion>

      <Accordion title="Using CLI">
        To create a SageMaker notebook instance with a specified KMS key, you can use the following CLI command:

        ```sh theme={null}
        aws sagemaker create-notebook-instance \
            --notebook-instance-name <YourNotebookInstanceName> \
            --instance-type <InstanceType> \
            --role-arn <IAMRoleARN> \
            --kms-key-id <KMSKeyID> \
            --volume-size-in-gb <VolumeSize> \
            --default-code-repository <CodeRepositoryURL> \
            --additional-code-repositories <AdditionalCodeRepositories>
        ```

        Replace the placeholders (`<YourNotebookInstanceName>`, `<InstanceType>`, `<IAMRoleARN>`, `<KMSKeyID>`, `<VolumeSize>`, `<CodeRepositoryURL>`, and `<AdditionalCodeRepositories>`) with appropriate values.
      </Accordion>

      <Accordion title="Using Python">
        To create a SageMaker notebook instance with a specified KMS key using a Python script, you'll need the `boto3` library:

        1. **Install `boto3` (if not already installed):**

        ```sh theme={null}
        pip install boto3
        ```

        2. **Script to Create a Notebook Instance:**

        ```python theme={null}
        import boto3

        sagemaker = boto3.client('sagemaker')

        def create_notebook_instance():
            response = sagemaker.create_notebook_instance(
                NotebookInstanceName='<YourNotebookInstanceName>',
                InstanceType='<InstanceType>',
                RoleArn='<IAMRoleARN>',
                KmsKeyId='<KMSKeyID>',
                VolumeSizeInGB=<VolumeSize>,
                DefaultCodeRepository='<CodeRepositoryURL>',
                AdditionalCodeRepositories=['<AdditionalCodeRepositories>']
            )
            print(response)

        # Replace placeholders with appropriate values
        create_notebook_instance()
        ```

        Replace the placeholders (`<YourNotebookInstanceName>`, `<InstanceType>`, `<IAMRoleARN>`, `<KMSKeyID>`, `<VolumeSize>`, `<CodeRepositoryURL>`, and `<AdditionalCodeRepositories>`) with appropriate values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_sagemaker_notebook_instance" "THIS_NOTEBOOK" {
          name                    = "NOTEBOOK_INSTANCE_NAME"        # substitute with the notebook instance name
          role_arn                = aws_iam_role.sagemaker_role.arn # or an existing role ARN
          instance_type           = "ml.t3.medium"                  # substitute as appropriate
          subnet_id               = "SUBNET_ID"                     # if applicable
          security_groups         = ["SECURITY_GROUP_ID"]           # if applicable

          # This is the critical fix: configure a KMS key for the notebook volume
          kms_key_id              = "KMS_KEY_ID_OR_ARN"             # substitute with your KMS key ID or ARN

          # other required arguments as used in your environment...
        }
        ```

        Changing `kms_key_id` on an existing `aws_sagemaker_notebook_instance` causes Terraform to perform an in‑place update that mirrors the CLI sequence (stop → update → start), resulting in a temporary service interruption but not a resource replacement.

        Ensure the SageMaker execution role attached to this notebook instance has permissions on the specified KMS key (for example `kms:CreateGrant`, `kms:Encrypt`, `kms:Decrypt`).

        Verification: `terraform plan` should show an in‑place update of `aws_sagemaker_notebook_instance.THIS_NOTEBOOK` with `kms_key_id` changing from `null` (or the old key) to `"KMS_KEY_ID_OR_ARN"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>