> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sagemaker notebook instance root access remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. **Log in to the AWS Management Console:**
           * Open the AWS Management Console and navigate to the SageMaker service.

        2. **Identify Notebook Instances with Root Access Enabled:**
           * Go to the "Notebook instances" section.
           * Check each notebook instance for the "Root access" setting. Instances with root access enabled will have it specified in their details.

        3. **Disable Root Access:**
           * Select the notebook instance you want to modify.
           * Click "Edit."
           * In the "Notebook instance settings," find the "Root access" setting and change it to "Disabled."
           * Save the changes and restart the notebook instance for the changes to take effect.
      </Accordion>

      <Accordion title="Using CLI">
        To disable root access for a SageMaker notebook instance using the AWS CLI, you need to update the `RootAccess` parameter.

        **Identify and Update Notebook Instances:**

        ```sh theme={null}
        # List all notebook instances
        aws sagemaker list-notebook-instances

        # Describe a specific notebook instance to check its root access setting
        aws sagemaker describe-notebook-instance --notebook-instance-name <YourNotebookInstanceName>

        # Update the notebook instance to disable root access
        aws sagemaker update-notebook-instance \
            --notebook-instance-name <YourNotebookInstanceName> \
            --root-access Disabled

        # Restart the notebook instance to apply changes
        aws sagemaker stop-notebook-instance --notebook-instance-name <YourNotebookInstanceName>
        aws sagemaker start-notebook-instance --notebook-instance-name <YourNotebookInstanceName>
        ```
      </Accordion>

      <Accordion title="Using Python">
        To disable root access for SageMaker notebook instances using a Python script, you'll need the `boto3` library:

        1. **Install `boto3` (if not already installed):**

        ```sh theme={null}
        pip install boto3
        ```

        2. **Script to Identify and Update Notebook Instances:**

        ```python theme={null}
        import boto3

        sagemaker = boto3.client('sagemaker')

        def list_notebook_instances():
            response = sagemaker.list_notebook_instances()
            return response['NotebookInstances']

        def describe_notebook_instance(notebook_instance_name):
            response = sagemaker.describe_notebook_instance(
                NotebookInstanceName=notebook_instance_name
            )
            return response

        def update_notebook_instance(notebook_instance_name):
            response = sagemaker.update_notebook_instance(
                NotebookInstanceName=notebook_instance_name,
                RootAccess='Disabled'
            )
            print(response)

        def restart_notebook_instance(notebook_instance_name):
            sagemaker.stop_notebook_instance(NotebookInstanceName=notebook_instance_name)
            waiter = sagemaker.get_waiter('notebook_instance_stopped')
            waiter.wait(NotebookInstanceName=notebook_instance_name)
            sagemaker.start_notebook_instance(NotebookInstanceName=notebook_instance_name)

        # Identify and update notebook instances with root access enabled
        notebook_instances = list_notebook_instances()
        for instance in notebook_instances:
            instance_name = instance['NotebookInstanceName']
            details = describe_notebook_instance(instance_name)
            if details.get('RootAccess', '').lower() == 'enabled':
                print(f"Disabling root access for notebook instance: {instance_name}")
                update_notebook_instance(instance_name)
                restart_notebook_instance(instance_name)
        ```

        This script will list all notebook instances, describe each one to check its root access setting, and then disable root access for those with it enabled. Finally, it will restart the modified instances to apply the changes.

        Replace placeholders (`<YourNotebookInstanceName>`) with appropriate values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_sagemaker_notebook_instance" "THIS_NOTEBOOK" {
          name                   = "YOUR_NOTEBOOK_NAME"          # replace with the notebook instance name
          role_arn               = "YOUR_SAGEMAKER_ROLE_ARN"     # replace with the IAM role ARN
          instance_type          = "YOUR_INSTANCE_TYPE"          # e.g., "ml.t3.medium"
          subnet_id              = "YOUR_SUBNET_ID"              # optional: replace if using VPC
          security_groups        = ["YOUR_SECURITY_GROUP_ID"]    # optional: replace with SG IDs

          # Critical setting: disable root access
          root_access            = "Disabled"
        }
        ```

        This change updates the existing SageMaker notebook instance configuration so that root access is disabled; AWS requires the instance to be stopped to apply this, which will interrupt active sessions and make the instance unavailable during the update (no resource replacement is required, but a manual stop/start or failed apply/retry cycle is expected).

        For verification, `terraform plan` should show the `aws_sagemaker_notebook_instance` resource with `root_access` changing from `"Enabled"` (or omitted/default) to `"Disabled"` and no `-/+` replacement indicator on the resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>