SageMaker Studio domain not encrypted with a KMS key

Severity: Medium
Service: SageMaker
Check ID: SAGEMAKER_DOMAIN_NO_KMS

What this check finds

A SageMaker Studio domain has no customer-managed KMS key for its home EFS volume, so user notebooks and data rest under a key you do not control.

Passing looks like: SageMaker Studio domains use a KMS key.

How to fix it

Set a KMS key when creating the domain (--kms-key-id). It cannot be added to an existing domain, so recreate the domain to change it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to SageMaker Studio domain not encrypted with a KMS key
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-12 Cryptographic Key Establishment and Management SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

AI risk mappings

AI risk taxonomies mapped to SageMaker Studio domain not encrypted with a KMS key
Framework	Controls
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0057 LLM Data Leakage

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More SageMaker checks

All SageMaker checks