Sagemaker Notebook Instance Should Not Have Root Access

More Info:

Ensure Sagemaker notebook instance does not have root access enabled

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

1. Log in to the AWS Management Console:

   • Open the AWS Management Console and navigate to the SageMaker service.

2. Identify Notebook Instances with Root Access Enabled:

   • Go to the "Notebook instances" section.
   • Check each notebook instance for the "Root access" setting. Instances with root access enabled will have it specified in their details.

3. Disable Root Access:

   • Select the notebook instance you want to modify.
   • Click "Edit."
   • In the "Notebook instance settings," find the "Root access" setting and change it to "Disabled."
   • Save the changes and restart the notebook instance for the changes to take effect.

Using CLI

To disable root access for a SageMaker notebook instance using the AWS CLI, you need to update the RootAccess parameter.

Identify and Update Notebook Instances:

# List all notebook instances
aws sagemaker list-notebook-instances

# Describe a specific notebook instance to check its root access setting
aws sagemaker describe-notebook-instance --notebook-instance-name <YourNotebookInstanceName>

# Update the notebook instance to disable root access
aws sagemaker update-notebook-instance \
    --notebook-instance-name <YourNotebookInstanceName> \
    --root-access Disabled

# Restart the notebook instance to apply changes
aws sagemaker stop-notebook-instance --notebook-instance-name <YourNotebookInstanceName>
aws sagemaker start-notebook-instance --notebook-instance-name <YourNotebookInstanceName>

Using Python

To disable root access for SageMaker notebook instances using a Python script, you'll need the boto3 library:

1. Install boto3 (if not already installed):

pip install boto3

2. Script to Identify and Update Notebook Instances:

import boto3

sagemaker = boto3.client('sagemaker')

def list_notebook_instances():
    response = sagemaker.list_notebook_instances()
    return response['NotebookInstances']

def describe_notebook_instance(notebook_instance_name):
    response = sagemaker.describe_notebook_instance(
        NotebookInstanceName=notebook_instance_name
    )
    return response

def update_notebook_instance(notebook_instance_name):
    response = sagemaker.update_notebook_instance(
        NotebookInstanceName=notebook_instance_name,
        RootAccess='Disabled'
    )
    print(response)

def restart_notebook_instance(notebook_instance_name):
    sagemaker.stop_notebook_instance(NotebookInstanceName=notebook_instance_name)
    waiter = sagemaker.get_waiter('notebook_instance_stopped')
    waiter.wait(NotebookInstanceName=notebook_instance_name)
    sagemaker.start_notebook_instance(NotebookInstanceName=notebook_instance_name)

# Identify and update notebook instances with root access enabled
notebook_instances = list_notebook_instances()
for instance in notebook_instances:
    instance_name = instance['NotebookInstanceName']
    details = describe_notebook_instance(instance_name)
    if details.get('RootAccess', '').lower() == 'enabled':
        print(f"Disabling root access for notebook instance: {instance_name}")
        update_notebook_instance(instance_name)
        restart_notebook_instance(instance_name)

This script will list all notebook instances, describe each one to check its root access setting, and then disable root access for those with it enabled. Finally, it will restart the modified instances to apply the changes.

Replace placeholders (<YourNotebookInstanceName>) with appropriate values.

Using Terraform

resource "aws_sagemaker_notebook_instance" "THIS_NOTEBOOK" {
  name                   = "YOUR_NOTEBOOK_NAME"          # replace with the notebook instance name
  role_arn               = "YOUR_SAGEMAKER_ROLE_ARN"     # replace with the IAM role ARN
  instance_type          = "YOUR_INSTANCE_TYPE"          # e.g., "ml.t3.medium"
  subnet_id              = "YOUR_SUBNET_ID"              # optional: replace if using VPC
  security_groups        = ["YOUR_SECURITY_GROUP_ID"]    # optional: replace with SG IDs

  # Critical setting: disable root access
  root_access            = "Disabled"
}

This change updates the existing SageMaker notebook instance configuration so that root access is disabled; AWS requires the instance to be stopped to apply this, which will interrupt active sessions and make the instance unavailable during the update (no resource replacement is required, but a manual stop/start or failed apply/retry cycle is expected).

For verification, terraform plan should show the aws_sagemaker_notebook_instance resource with root_access changing from "Enabled" (or omitted/default) to "Disabled" and no -/+ replacement indicator on the resource.