SageMaker endpoint configuration should specify a KMS key for its storage volume

What it checks

SageMaker endpoint configuration should specify a KMS key for its storage volume

Where it applies

Terraform: aws_sagemaker_endpoint_configuration

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Set kms_key_arn to a customer-managed KMS key to control encryption of the endpoint's EBS storage volume (set at endpoint-config creation). If every production_variants instance type is a Nitro-based instance whose data lives only on hardware-encrypted local NVMe storage, kms_key_arn does not apply to that storage — baseline this finding for such endpoints.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules