AWS SageMaker Flow Definition does not use KMS for output configurations misconfiguration detected i

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_372
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule checks whether Amazon SageMaker Flow Definitions leverage Key Management Service (KMS) for output configurations. Unencrypted outputs expose sensitive data, increasing the risk of unauthorized access and breaches. KMS ensures data security by encrypting it before storage and physically separating the storage of key material. This strengthens your security posture and adheres to data protection regulations.

How to Fix

Resource: aws_sagemaker_flow_definition

• Arguments: output_config/kms_key_id

Add a KMS key to your SageMaker Flow Definition output configurations, by defining a kms_key_id property in the output_config block of your AWS SageMaker Flow Definition. [source,go]

resource "aws_sagemaker_flow_definition" "example" { ... output_config {

• kms_key_id = "example" } }

---