> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Notebook Data Should Be Encrypted With KMS Customer Master Keys

### More Info:

Ensure that the storage volumes attached to your Amazon SageMaker notebook instances are encrypted with KMS Customer Master Keys (CMKs) instead of AWS managed-keys in order to have a more granular control over the data-at-rest encryption/decryption process and meet compliance requirements. SageMaker is a fully-managed AWS service that enables data scientists and developers to build, train, and deploy machine learning models at any scale. Amazon SageMaker removes the barriers that typically slow down data developers who want to use machine learning in the cloud. A SageMaker notebook instance is a fully managed Machine Learning (ML) instance based on the Jupyter Notebook application.

### Risk Level

High

### Address

Cost optimization, Operational Maturity, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* HIPAA
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Notebook Data Encrypted with KMS Customer Master Keys for AWS DynamoDB using the AWS console, you can follow these step-by-step instructions:

        1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/](https://aws.amazon.com/)) and log in using your credentials.

        2. **Navigate to DynamoDB**: In the AWS Management Console, search for "DynamoDB" in the services search bar and select DynamoDB from the search results.

        3. **Select the Table**: From the DynamoDB dashboard, select the table where the notebook data is stored that needs to be encrypted with AWS managed keys.

        4. **Enable Encryption**: Click on the "Manage" tab in the table details page and then click on the "Encryption" tab.

        5. **Edit Encryption Settings**: Click on the "Edit" button to edit the encryption settings for the DynamoDB table.

        6. **Select AWS Managed Key**: In the Encryption settings, select "AWS managed key" as the key provider instead of "KMS Customer Master Key".

        7. **Choose AWS Managed CMK**: Choose an AWS managed Customer Master Key (CMK) from the list provided. You can select the default AWS managed CMK or create a new one.

        8. **Update Encryption Settings**: After selecting the AWS managed CMK, click on the "Save" button to update the encryption settings for the DynamoDB table.

        9. **Monitor Encryption Status**: Once the encryption settings are updated, monitor the status to ensure that the notebook data is now encrypted with the AWS managed key.

        By following these steps, you can remediate the misconfiguration of Notebook Data Encrypted with KMS Customer Master Keys for AWS DynamoDB using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of Notebook Data Encrypted with KMS Customer Master Keys for AWS DynamoDB using AWS CLI, follow these steps:

        Step 1: Identify the DynamoDB table that has the misconfiguration:

        ```bash theme={null}
        aws dynamodb list-tables
        ```

        Step 2: Update the DynamoDB table to enable encryption with AWS managed keys:

        ```bash theme={null}
        aws dynamodb update-table \
            --table-name YOUR_TABLE_NAME \
            --sse-specification Enabled=true,SSEType=AES256
        ```

        Step 3: Verify that the encryption has been updated successfully:

        ```bash theme={null}
        aws dynamodb describe-table \
            --table-name YOUR_TABLE_NAME
        ```

        By following these steps, you can remediate the misconfiguration of Notebook Data Encrypted with KMS Customer Master Keys for AWS DynamoDB using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of notebook data being encrypted with KMS Customer Master Keys in AWS DynamoDB using Python, follow these steps:

        1. **Update the DynamoDB Table Encryption**: Configure the DynamoDB table to use AWS managed encryption instead of KMS Customer Master Keys. You can do this by updating the table settings to use the default AWS managed encryption.

        2. **Install the AWS SDK for Python (Boto3)**: If you haven't already, install the Boto3 library, which is the AWS SDK for Python. You can install it using pip:

        ```bash theme={null}
        pip install boto3
        ```

        3. **Update the DynamoDB Table Encryption Settings**: Use the following Python script to update the encryption settings of the DynamoDB table to use the default AWS managed encryption:

        ```python theme={null}
        import boto3

        # Specify the region where your DynamoDB table is located
        region = 'your-region'

        # Specify the name of the DynamoDB table
        table_name = 'your-table-name'

        # Create a DynamoDB client
        dynamodb = boto3.client('dynamodb', region_name=region)

        # Update the table encryption settings to use AWS managed encryption
        response = dynamodb.update_table(
            TableName=table_name,
            SSESpecification={
                'Enabled': True,
                'SSEType': 'AES256'
            }
        )

        print("Table encryption settings updated successfully.")
        ```

        4. **Run the Python Script**: Save the above Python script in a file (e.g., `update_dynamodb_encryption.py`) and run it using the Python interpreter. Make sure to replace `'your-region'` and `'your-table-name'` with the actual values for your DynamoDB table.

        ```bash theme={null}
        python update_dynamodb_encryption.py
        ```

        5. **Verify the Encryption Settings**: After running the script, verify that the encryption settings for the DynamoDB table have been successfully updated to use the default AWS managed encryption. You can check this in the AWS Management Console or by using the Boto3 library to describe the table.

        By following these steps, you can remediate the misconfiguration of notebook data being encrypted with KMS Customer Master Keys in AWS DynamoDB using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_dynamodb_table" "THIS_TABLE" {
          name         = "REPLACE_WITH_TABLE_NAME"
          billing_mode = "PAY_PER_REQUEST"

          hash_key = "REPLACE_WITH_HASH_KEY_ATTRIBUTE_NAME"

          attribute {
            name = "REPLACE_WITH_HASH_KEY_ATTRIBUTE_NAME"
            type = "S" # or "N" / "B" as appropriate
          }

          # Encrypt table data with a customer-managed KMS key instead of the AWS-managed key
          server_side_encryption {
            enabled     = true
            sse_type    = "KMS"
            kms_key_arn = aws_kms_key.DDB_KMS_KEY.arn
          }
        }

        resource "aws_kms_key" "DDB_KMS_KEY" {
          description             = "KMS CMK for DynamoDB table REPLACE_WITH_TABLE_NAME"
          deletion_window_in_days = 30

          # Optionally scope key usage with a key policy; ensure principals that use
          # DynamoDB have permission to use this key.
          policy = data.aws_iam_policy_document.DDB_KMS_POLICY.json
        }

        data "aws_iam_policy_document" "DDB_KMS_POLICY" {
          statement {
            sid    = "AllowDynamoDBUseOfTheKey"
            effect = "Allow"

            principals {
              type        = "Service"
              identifiers = ["dynamodb.amazonaws.com"]
            }

            actions = [
              "kms:Encrypt",
              "kms:Decrypt",
              "kms:ReEncrypt*",
              "kms:GenerateDataKey*",
              "kms:DescribeKey"
            ]

            resources = ["*"]
          }

          # Add additional statements granting your IAM roles/users permission
          # to administer and use this CMK as needed.
        }
        ```

        Substitute:

        * `REPLACE_WITH_TABLE_NAME` with your DynamoDB table name.
        * `REPLACE_WITH_HASH_KEY_ATTRIBUTE_NAME` with the primary key attribute name.
        * Extend the KMS key policy to include your IAM roles/users as appropriate.

        Changing an existing table from AWS-managed encryption to a different KMS CMK (`kms_key_arn` change) forces replacement of the DynamoDB table in Terraform, which is an outage-prone operation and will destroy/recreate the table and its data unless you manage migration separately.

        For verification, `terraform plan` should show:

        * On a new table: creation of `aws_kms_key.DDB_KMS_KEY` and `aws_dynamodb_table.THIS_TABLE` with `server_side_encryption` enabled, `sse_type = "KMS"`, and `kms_key_arn` set.
        * On an existing table: a planned destroy/create of `aws_dynamodb_table.THIS_TABLE` with the new `server_side_encryption` configuration using your CMK.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html](https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html)