---
title: "Ensure AWS SageMaker notebook instance is configured with data encryption at rest using KMS key"
canonical: "https://kb.cynergy.app/space/MD/991593050/Ensure%20AWS%20SageMaker%20notebook%20instance%20is%20configured%20with%20data%20encryption%20at%20rest%20using%20KMS%20key"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_40  
Severity: HIGH

# AWS SageMaker notebook instance is not configured with data encryption at rest using KMS key

# Description

This is a straightforward check to ensure data encryption for Sagemaker notebooks, this check verifies that the cluster is encrypted with a customer-managed Key (CMK).

# Fix - Runtime

## AWS Console

There is no current way of enabling encryption on an existing notebook, it will need to be recreated.

# Fix - Build time

## Terraform

- **Resource: **aws_sagemaker_endpoint_configuration
- **Argument:** kms_key_arn, specifying a KMS key will ensure data encryption.

This modification will result in the resource being recreated.

aws_sagemaker_endpoint_configuration.examplea.tf

```shell
resource "aws_sagemaker_endpoint_configuration" "example" {
  ...
  name        = "my-endpoint-config"
+ kms_key_arn = aws_kms_key.examplea.arn
  production_variants {
    variant_name           = "variant-1"
    model_name             = aws_sagemaker_model.examplea.name
    initial_instance_count = 1
    instance_type          = "ml.t2.medium"
  }
  ...
}
```