How do I configure KMS encryption in a SageMaker AI Notebook instance?

Short description

SageMaker AI Notebook instances support the use of AWS KMS keys to encrypt the storage volumes for protection of your notebook data.

Note: To complete the steps in this article, you must have an existing KMS key.

Resolution

SageMaker AI Notebook instances support the use of AWS KMS keys to encrypt the storage volumes for protection of your notebook data.

Important: To configure your AWS Key encryption, you must have an existing KMS key.

You can add a KMS key to only a new SageMaker AI Notebook instance. Complete the following steps:

1. Open the SageMaker AI console.

2. In the navigation pane, choose Notebooks.

3. Choose Create Notebook Instance, and then enter a name for your notebook instance.

4. In the Permissions and encryption section, under Encryption key, select your AWS KMS key from the dropdown list. Or, enter an ARN.
   Note: Check that the role has sufficient access to the key.

   Example:

   {
   "Version": "2012-10-17",
       "Statement": [
           {
               "Action": [
                   "kms:CreateGrant",
                   "kms:Decrypt",
                   "kms:GenerateDataKey",
                   "kms:GenerateDataKeyWithoutPlaintext",
                   "kms:DescribeKey"
               ],
               "Resource": [
                 "<KMS key ARN>"
               ],
               "Effect": "Allow"
           }
       ]
   }

5. Review the remaining settings, and then choose Create notebook instance.

To add or edit your custom AWS KMS key to an existing SageMaker AI Notebook instance, create a backup of the notebook instance. Then, create a new notebook instance that you can sync the backup to. Complete the following steps:

1. Complete the steps in Migrate your work to an Amazon SageMaker notebook instance with Amazon Linux 2.
   Note: Review the Considerations section.
2. When your sync completes, launch the new notebook instance, and then confirm that the content has synced.

Note: For notebook instances that don't have a specified AWS KMS key, SageMaker AI encrypts the storage volumes with a system-managed KMS key.