SageMaker notebook instance should not enable root access

What it checks

SageMaker notebook instance should not enable root access

Where it applies

Terraform: aws_sagemaker_notebook_instance

CloudFormation: AWS::SageMaker::NotebookInstance

How to fix it

1. Set root_access = "Disabled". Users can still install packages via conda/pip in their home directory — root is not required for normal ML work.

Frameworks

• AWS FSBP SageMaker.3
• SOC 2 CC6.1
• NIST 800-53 rev5 AC-3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules