SageMaker training job encrypts neither its output nor its volumes with a KMS key

What this check finds

A SageMaker training job that is running, or ran in the last 90 days, sets no KMS key for its output artifacts (OutputDataConfig.KmsKeyId) or its ML storage volumes (ResourceConfig.VolumeKmsKeyId). Both fall back to AWS-managed encryption, with no key policy you control.

Passing looks like: SageMaker training output and volumes use a KMS key.

How to fix it

Pass a customer-managed key for the output (--output-data-config KmsKeyId=...) and the volumes (--resource-config VolumeKmsKeyId=...); SDK estimator: output_kms_key= and volume_kms_key=.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

AI risk mappings

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More SageMaker checks

• HighSageMaker execution role is over-permissioned
• HighSageMaker notebook instance has direct internet access
• HighSageMaker training job has no checkpoint configuration
• MediumDistributed SageMaker training job does not encrypt traffic between containers
• MediumSageMaker endpoint not deployed inside VPC
• MediumSageMaker endpoint variant runs on one instance
• MediumSageMaker model has no VPC configuration
• MediumSageMaker monitoring schedule encrypts neither its output nor its volumes with a KMS key

All SageMaker checks