SageMaker notebook instance has root access enabled

Severity: Medium
Service: SageMaker
Check ID: SAGEMAKER_NOTEBOOK_ROOT_ACCESS

What this check finds

Root access is enabled on a SageMaker notebook instance. Root access allows users to install arbitrary packages and modify the underlying OS, violating least privilege.

Passing looks like: SageMaker notebook root access disabled.

How to fix it

Set RootAccess=Disabled on the notebook instance. Recreate the instance if currently running: stop → update → start.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to SageMaker notebook instance has root access enabled
Framework	Controls
PCI-DSS v4.0.1	2.2 System components are configured and managed securely 7.2 Access to system components and data is appropriately defined and assigned
HIPAA Security Rule	164.308(a)(5) Security Awareness — Protection from Malicious Software 164.312(a)(1) Access Control — Unique User Identification
SOC 2 — Trust Services Criteria	CC6.2 Role-Based Access Control CC7.1 Threat and Vulnerability Detection
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege CM-7 Least Functionality
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.PS-01 Configuration management practices are applied
ISO/IEC 27001:2022 Annex A	A.8.2 Privileged access rights A.8.19 Installation of software on operational systems

AI risk mappings

AI risk taxonomies mapped to SageMaker notebook instance has root access enabled
Framework	Controls
MITRE ATLAS (Adversarial Threat Landscape for AI Systems)	AML.T0012 Valid Accounts

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More SageMaker checks

All SageMaker checks