Guides

Ensure that SageMaker Notebook Instance Data Encryption with KMS CMKs is enabled

AWS SageMaker removes the barriers that typically slow down data developers who want to use machine learning in the cloud.A SageMaker notebook instance is a fully managed Machine Learning (ML) instance based on the Jupyter Notebook web application. It is recommended that your SageMaker notebook instance storage volumes are encrypted with Amazon KMS Customer Master Keys (CMKs) instead of AWS managed-keys in order to have a more granular control over the data-at-rest encryption/decryption process and meet compliance requirements. SageMaker is a fully-managed AWS service that enables data scientists and developers to build, train and deploy machine learning models at any scale. A SageMaker notebook instance is a fully managed Machine Learning (ML) instance based on the Jupyter Notebook web application.

Suggest Edits

Risk Level: Low
Cloud Entity: Amazon SageMaker
CloudGuard Rule ID: D9.AWS.CRY.36
Category: Machine learning

GSL LOGIC

SageMakerNotebook where kmsKey should have kmsKey.isCustomerManaged=true

REMEDIATION

From Portal
We can not enable encryption to an existing SageMaker instance. You need to re-create the new instance using customer managed encryption key. You can enable data-at-rest encryption and copy your existing data to it, perform the following actions to create a new instance using customer managed key.

  1. Log in to the AWS Management Console.
  2. Go to to SageMaker service dashboard at https://console.aws.amazon.com/sagemaker/.
  3. Click on 'Create notebook Instance'.
  4. Under 'Permissions and encryption' section, select Customer managed key from the Encryption key drop down. (select Enter a KMS key ARN option, then enter the full ARN of the customer managed key)
  5. Complete the rest of the configurations and Create your notebook instance.

From TF

resource "aws_sagemaker_notebook_instance" "test" {
	name          = "my-notebook-instance"
	role_arn      = aws_iam_role.role.arn
	instance_type = "ml.t2.medium"
	+ kms_key_id = "Customer_Managed_Key_ARN"
	
	tags = {
		Name = "foo"
	}
}

From Command Line

  1. We can not enable encryption to an existing SageMaker instance. Create a new notebook instance using customer managed key to enable encryption for the instances. Following are the commands:
    Note: --kms-key-id parameter will enable encryption for the required notebook instance.
aws sagemaker create-notebook-instance --notebook-instance-name INSTANCE_NAME --instance-type VALUE --kms-key-id CUSTOMER_MANAGED_Key_ARN
  1. Copy your data from the old notebook instance to the newly created instance.
  2. Once data is copied, you can remove the old notebook instance using below command.
aws sagemaker delete-notebook-instance --notebook-instance-name INSTANCE_NAME

References

  1. https://docs.aws.amazon.com/sagemaker/latest/dg/howitworks-create-ws.html
  2. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_notebook_instance
  3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sagemaker/create-notebook-instance.html
  4. https://docs.aws.amazon.com/sagemaker/latest/dg/gs-setup-working-env.html

Amazon SageMaker

Amazon SageMaker provides every developer and data scientist with the ability to build, train, and deploy machine learning models quickly. Amazon SageMaker is a fully-managed service that covers the entire machine learning workflow to label and prepare your data, choose an algorithm, train the model, tune and optimize it for deployment, make predictions, and take action.

Compliance Frameworks

  • AWS CloudGuard Best Practices
  • AWS CloudGuard SOC2 based on AICPA TSC 2017
  • AWS CloudGuard Well Architected Framework
  • AWS HITRUST
  • AWS HITRUST v11.0.0
  • AWS ITSG-33
  • AWS MAS TRM Framework
  • AWS MITRE ATT&CK Framework v10
  • AWS MITRE ATT&CK Framework v11.3
  • AWS NIST 800-53 Rev 5
  • AWS PCI-DSS 4.0

Updated over 1 year ago