Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · SageMaker

SageMaker.13: Model quality jobs inter-container encryption

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub SageMaker.13 check?

SageMaker.13 fails when a model quality job definition has `EnableInterContainerTrafficEncryption` set to false, leaving traffic between the job's containers unencrypted.

Why does SageMaker.13 matter?

Model quality monitoring runs distributed jobs that shuttle prediction and ground-truth data between containers. Off by default, the flag means that data crosses the network in the clear. The setting is immutable (there is no UpdateModelQualityJobDefinition that flips it) because the encryption decision shapes how SageMaker provisions the cluster's TLS material up front.

How do I fix SageMaker.13?

  1. List model quality job definitions and check `EnableInterContainerTrafficEncryption`.
  2. Delete and recreate each failing definition with the flag set to true; there is no in-place patch.
  3. Make the flag a required field in your job-definition IaC so every new monitoring job is compliant.
  4. Remediate the sibling controls (.9, .10, .15) together, as they all check this flag.

Remediation script · bash

# Disable root across every notebook that has it on (mutable on a stopped instance).
for n in $(aws sagemaker list-notebook-instances \
    --query 'NotebookInstances[].NotebookInstanceName' --output text); do
  root=$(aws sagemaker describe-notebook-instance --notebook-instance-name "$n" \
    --query 'RootAccess' --output text)
  if [ "$root" = "Enabled" ]; then
    aws sagemaker stop-notebook-instance --notebook-instance-name "$n"
    aws sagemaker wait notebook-instance-stopped --notebook-instance-name "$n"
    aws sagemaker update-notebook-instance --notebook-instance-name "$n" --root-access Disabled
    aws sagemaker start-notebook-instance --notebook-instance-name "$n"
    echo "$n: root access disabled"
  fi
done

# Immutable settings need a rebuild. Recreate a notebook locked down: private subnet,
# no direct internet. (DirectInternetAccess and SubnetId cannot be changed in place.)
aws sagemaker create-notebook-instance \
  --notebook-instance-name ml-feature-exploration \
  --instance-type ml.t3.medium \
  --role-arn arn:aws:iam::111122223333:role/SageMakerExecution \
  --subnet-id subnet-0ab12cd34ef56 \
  --security-group-ids sg-0aa11bb22cc33 \
  --direct-internet-access Disabled \
  --root-access Disabled

Full walkthrough (console steps, edge cases and verification) in the lesson Harden SageMaker and ML workloads.

Is SageMaker.13 a false positive?

The underlying Config rule (sagemaker-model-quality-job-encrypt-in-transit) is only NON_COMPLIANT when the job runs on an instance count of 2 or more: a single-instance job definition has no inter-container hop to protect, so the flag being false there is harmless by design. A finding on a definition you know runs on one instance is effectively a false positive; rather than recreating it, set EnableInterContainerTrafficEncryption to true anyway (it costs nothing on a single instance) so the page stays clean if you later scale up, or document a Security Hub suppression that records the single-instance design decision. Don't suppress blindly: confirm the instance count first, since a definition that scales to 2+ with the flag off is a genuine gap.

Full lesson Harden SageMaker and ML workloads Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for SageMaker controls ↗ Check your own account for SageMaker.13 →
Part of the learning path Lock down access

More SageMaker controls