SageMaker notebook storage volumes without a customer-managed KMS key
What does ZopNight detect here?
A notebook's ML storage volume caches datasets, credentials, and model artefacts, and without a customer-managed key you hold no audit trail and no revocation lever over that data. ZopNight fires when discovery confirms the kmsKeyId field is present but empty; the key can only be set at creation, so the fix is 1 recreate.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1618 |
| Category | compliance |
| Severity | high |
| Metric | none — pure configuration read |
| Source | sagemaker_compliance.go |
Where it applies
Present-but-empty is the signal
The detection here hinges on a distinction worth spelling out. The discoverer writes the
notebook’s kmsKeyId into metadata only when the describe call succeeds. A present-but-empty
value is AWS confirming no key is configured, and that fires. An absent key means the describe
never completed, and the rule abstains: “unencrypted” is claimed only when the API positively
said so, never assumed from a failed lookup.
What a CMK adds over default encryption
The volume is not sitting in plaintext without a CMK; SageMaker encrypts it regardless. What you lack is control: with an AWS-owned key there is no CloudTrail entry naming your key on each decrypt, no key policy restricting which principals can use it, and no kill switch. A customer-managed key gives you the audit trail, scoped access, and the ability to revoke. Disable the key and data encrypted under it becomes unreadable, which is the lever compliance frameworks are actually asking for when they say “customer-managed encryption”.
Why notebooks specifically deserve it
Notebook volumes accumulate exactly the material data-governance policies care about: pulled training datasets, cached feature tables, connection secrets pasted into cells, and half-trained model artefacts. The volume outlives sessions and survives stop/start cycles, so that residue persists for the instance’s lifetime.
The immovable part
Volume encryption is set at instance creation and cannot be changed afterwards. No stop-edit-start shortcut exists as it does for root access. Remediation means creating a replacement notebook with the key specified, migrating the working directory (snapshot or S3), and deleting the original. Verify the key policy grants decrypt to the notebook’s execution role and to the humans who need it, and nobody else.
Query the current state
aws sagemaker describe-notebook-instance \ --notebook-instance-name my-notebook \ --query '[NotebookInstanceName,KmsKeyId]'An empty KmsKeyId is this finding; fleet-wide, loop the same query over
list-notebook-instances. Fixing the template that creates notebooks (IaC default, console
runbook) is what stops the finding recurring on every new instance, and there is no charge
difference beyond the ~$1/month for the KMS key itself serving the whole fleet.