Back to Checks
aws

Amazon SageMaker Clarify processing jobs exist in the region

sagemaker_clarify_exists
Service: sagemakerSeverity: low
OfficialBuilt-inVerified
Categories:gen-ai
Resource Type:Other

SageMaker Clarify provides bias detection and model explainability for ML workloads.

This check verifies that at least one SageMaker processing job using the AWS-managed Clarify container image exists in each successfully scanned region. The absence of Clarify jobs indicates that responsible-AI controls such as bias detection and explainability are not in place.

Prowler logoProwlerprowler-provider-aws

Risk

Without SageMaker Clarify processing jobs, ML models may be deployed without bias analysis or explainability reports. This can lead to:

  • Regulatory non-compliance with AI governance frameworks
  • Undetected bias in model predictions affecting protected groups
  • Lack of accountability for ML model decisions in production

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sagemaker_clarify_exists

Recommendation

Create SageMaker Clarify processing jobs to evaluate models for bias and explainability before deployment. Integrate Clarify into your ML pipeline to ensure responsible AI practices.

Remediation

CLI

aws sagemaker create-processing-job --processing-job-name clarify-bias-check --app-specification ImageUri=<clarify-image-uri> --role-arn <role-arn> --processing-resources 'ClusterConfig={InstanceCount=1,InstanceType=ml.m5.xlarge,VolumeSizeInGB=20}'

Other

1Open the AWS Console and go to Amazon SageMaker
2Navigate to Processing > Processing jobs
3Click Create processing job
4Select the SageMaker Clarify container image for your region
5Configure input/output paths and the analysis configuration
6Click Create processing job

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client


class sagemaker_clarify_exists(Check):
    """Check whether at least one SageMaker Clarify processing job exists per region.

    A region is reported only when ListProcessingJobs succeeded for it; regions
    where the API call failed (e.g. AccessDenied, unsupported region) are
    skipped at the service layer and produce no finding.

    - PASS: At least one processing job uses the AWS-managed Clarify container
      image in the region (one finding per job).
    - FAIL: No processing job uses the Clarify container image in the region
      (one finding per region).
    """

    def execute(self) -> list[Check_Report_AWS]:
        """Execute the SageMaker Clarify exists check.

        Returns:
            A list of reports containing the result of the check.
        """
        findings = []
        for region in sorted(sagemaker_client.processing_jobs_scanned_regions):
            clarify_jobs = sorted(
                (
                    job
                    for job in sagemaker_client.sagemaker_processing_jobs
                    if job.region == region
                    and job.image_uri
                    and "sagemaker-clarify-processing" in job.image_uri
                ),
                key=lambda job: job.name,
            )

            if clarify_jobs:
                for job in clarify_jobs:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=job)
                    report.status = "PASS"
                    report.status_extended = f"SageMaker Clarify processing job {job.name} exists in region {region}."
                    findings.append(report)
            else:
                report = Check_Report_AWS(metadata=self.metadata(), resource={})
                report.region = region
                report.resource_id = "sagemaker-clarify"
                report.resource_arn = f"arn:{sagemaker_client.audited_partition}:sagemaker:{region}:{sagemaker_client.audited_account}:processing-job"
                report.status = "FAIL"
                report.status_extended = (
                    f"No SageMaker Clarify processing jobs found in region {region}."
                )
                findings.append(report)

        return findings

References