AWS SageMaker notebook instance not configured with data encryption at rest using KMS key misconfigu

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_22
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	99872307-ffae-4bc9-8b7b-17597c4054bf

Impact

Amazon SageMaker enables you to pass a KMS key to SageMaker notebooks, securing the following resources:

• Storage volume
• Processing jobs
• Training jobs
• Hyperparameter tuning jobs
• Batch transform jobs
• Endpoints

By applying encryption at-rest you ensure that the data stored on your AWS SageMaker notebook instances meet regulatory requirements and protect your SageMaker data at rest.

How to Fix

Resource: aws_sagemaker_notebook_instance

• Attribute: kms_key_id - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption. [source,go]

---

resource "aws_sagemaker_notebook_instance" "example" { ... name = "my-notebook-instance"

• kms_key_id = ... }

---