SageMaker endpoint does not capture inference data
- Severity
- Low
- Service
- SageMaker
- Type
- Operations, not counted in the security score
- Check ID
- SAGEMAKER_ENDPOINT_NO_DATA_CAPTURE
What this check finds
A SageMaker endpoint has data capture off, so there is no record of the requests it served for debugging or drift analysis. Turning it on stores prompts and responses, so weigh that first.
Passing looks like: SageMaker endpoints capture inference data.
How to fix it
Add a DataCaptureConfig with EnableCapture=true to the endpoint configuration, with an S3 destination and a KMS key, then update the endpoint.
Compliance
This is an operational hygiene check. It flags something worth tidying rather than a control an auditor asks for, so it is not mapped to a compliance framework.
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More SageMaker checks
- HighSageMaker execution role is over-permissioned
- HighSageMaker notebook instance has direct internet access
- HighSageMaker training job has no checkpoint configuration
- MediumDistributed SageMaker training job does not encrypt traffic between containers
- MediumSageMaker endpoint not deployed inside VPC
- MediumSageMaker endpoint variant runs on one instance
- MediumSageMaker model has no VPC configuration
- MediumSageMaker monitoring schedule encrypts neither its output nor its volumes with a KMS key