---
title: "Ensure all data stored in SageMaker is securely encrypted at rest"
canonical: "https://kb.cynergy.app/space/MD/991592881/Ensure%20all%20data%20stored%20in%20SageMaker%20is%20securely%20encrypted%20at%20rest"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_14  
Severity: HIGH

# Data stored in SageMaker is not securely encrypted at rest

# Description

Amazon SageMaker enables you to pass a KMS key to SageMaker notebooks, securing the following resources:

- Storage volume
- Processing jobs
- Training jobs
- Hyperparameter tuning jobs
- Batch transform jobs
- Endpoints

By applying encryption at-rest you ensure that the data stored on your AWS SageMaker notebook instances meet regulatory requirements and protect your SageMaker data at rest.

# Fix - Runtime

## AWS Console

1. Log in to the AWS Management Console at <u>[https://console.aws.amazon.com/](https://console.aws.amazon.com/)</u>.
2. Open the <u>[Amazon SageMaker console](https://console.aws.amazon.com/sagemaker/)</u>.
3. Select Notebook instances, then click **Create Notebook Instance**.
4. On the Create Notebook Instance page, provide the required information.
5. The **Encryption key** lets you encrypt data on the ML storage volume attached to the notebook instance using an AWS Key Management Service (AWS KMS) key. If you plan to store sensitive information on the ML storage volume, consider encrypting the information.

## CLI Command

To create a SageMaker notebook instance:

Shell

```shell
create-notebook-instance
--notebook-instance-name <value>
--instance-type <value>
--kms-key-id <value>

```

# Fix - Build time

## Terraform

- **Resource**: aws_sagemaker_notebook_instance
- **Attribute**: kms_key_id - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption.

Go

```go
resource "aws_sagemaker_notebook_instance" "example" {
  ...
  name          = "my-notebook-instance"
+ kms_key_id    = <value>
  ...
}

```