# SageMaker Notebook Volume Not Encrypted With CMK

> A notebook's ML storage volume caches datasets, credentials, and model artefacts, and without a customer-managed key you hold no audit trail and no revocation lever over that data. ZopNight fires when discovery confirms the kmsKeyId field is present but empty; the key can only be set at creation, so the fix is 1 recreate.

Source: https://zop.dev/integrations/aws/recommendations/sagemaker-notebook-volume-not-encrypted-with-cmk
Updated: 2026-08-19

---

## Present-but-empty is the signal

The detection here hinges on a distinction worth spelling out. The discoverer writes the
notebook's `kmsKeyId` into metadata only when the describe call succeeds. A present-but-empty
value is AWS confirming no key is configured, and that fires. An absent key means the describe
never completed, and the rule abstains: "unencrypted" is claimed only when the API positively
said so, never assumed from a failed lookup.

## What a CMK adds over default encryption

The volume is not sitting in plaintext without a CMK; SageMaker encrypts it regardless. What
you lack is control: with an AWS-owned key there is no CloudTrail entry naming your key on
each decrypt, no key policy restricting which principals can use it, and no kill switch. A
customer-managed key gives you the audit trail, scoped access, and the ability to revoke.
Disable the key and data encrypted under it becomes unreadable, which is the lever compliance
frameworks are actually asking for when they say "customer-managed encryption".

## Why notebooks specifically deserve it

Notebook volumes accumulate exactly the material data-governance policies care about: pulled
training datasets, cached feature tables, connection secrets pasted into cells, and
half-trained model artefacts. The volume outlives sessions and survives stop/start cycles, so
that residue persists for the instance's lifetime.

## The immovable part

Volume encryption is set at instance creation and cannot be changed afterwards. No
stop-edit-start shortcut exists as it does for root access. Remediation means creating a
replacement notebook with the key specified, migrating the working directory (snapshot or
S3), and deleting the original. Verify the key policy grants decrypt to the notebook's
execution role and to the humans who need it, and nobody else.

## Query the current state

```bash
aws sagemaker describe-notebook-instance \
  --notebook-instance-name my-notebook \
  --query '[NotebookInstanceName,KmsKeyId]'
```

An empty `KmsKeyId` is this finding; fleet-wide, loop the same query over
`list-notebook-instances`. Fixing the template that creates notebooks (IaC default, console
runbook) is what stops the finding recurring on every new instance, and there is no charge
difference beyond the ~$1/month for the KMS key itself serving the whole fleet.