AWS Sagemaker data quality job not using KMS to encrypt data on attached storage volume misconfigura

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_368
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule checks whether Amazon SageMaker Data Quality Jobs leverage AWS Key Management Service (KMS) to encrypt data on the attached storage volume. KMS encryption is crucial to safeguard sensitive information as it encrypts data on storage volumes attached to the Sagemaker instance. This prevents unauthorized access and data breaches and helps ensure compliance with regulations requiring the protection of specific data types.

How to Fix

Resource: AWS::SageMaker::DataQualityJobDefinition

• Arguments: JobResources/ClusterConfig/VolumeKmsKeyId

Provide a VolumeKmsKeyId attribute in your AWS::SageMaker::DataQualityJobDefinition of your CloudFormation configuration file, as displayed in the example below. [source,go]

MyDataQualityJobDefinitionPass: Type: "AWS::SageMaker::DataQualityJobDefinition" Properties: ... JobResources: ClusterConfig: ... VolumeKmsKeyId: "arn:aws:kms:us-west-2:123456789012:key/my-existing-volume-kms-key-id"