Back to Checks
aws

Amazon SageMaker training job has inter-container traffic encryption enabled

sagemaker_training_jobs_intercontainer_encryption_enabled
Service: sagemakerSeverity: medium
OfficialBuilt-inVerified
Categories:encryptiongen-ai
Resource Type:Other

Amazon SageMaker training jobs have inter-container traffic encryption configured for container-to-container communications during training.

The evaluation inspects the EnableInterContainerTrafficEncryption setting on training jobs.

Prowler logoProwlerprowler-provider-aws

Risk

Without inter-container encryption, in-node traffic may be plaintext, enabling capture by a compromised host or co-resident workload. This threatens confidentiality (training data, model parameters, credentials) and integrity (tampering with gradients/results), and can facilitate lateral movement via token or session theft.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sagemaker_training_jobs_intercontainer_encryption_enabled

Recommendation

Enable EnableInterContainerTrafficEncryption on all training jobs to enforce encryption in transit.

Apply defense in depth: combine with network isolation, limit roles and container privileges per least privilege, and standardize secure job templates or guardrails to prevent launching unencrypted jobs.

Remediation

Terraform

# Terraform: SageMaker Training Job with inter-container traffic encryption enabled
resource "aws_sagemaker_training_job" "job" {
  name     = "<example_resource_name>"
  role_arn = "<example_resource_id>"

  algorithm_specification {
    training_image      = "<example_resource_id>"
    training_input_mode = "File"
  }

  output_data_config {
    s3_output_path = "s3://<example_resource_name>/"
  }

  resource_config {
    instance_count = 1
    instance_type  = "ml.m5.large"
    volume_size_gb = 10
  }

  stopping_condition {
    max_runtime_in_seconds = 3600
  }

  enable_inter_container_traffic_encryption = true  # Critical: ensures inter-container traffic is encrypted
}

NativeIaC

# CloudFormation: SageMaker Training Job with inter-container traffic encryption enabled
Resources:
  SageMakerTrainingJob:
    Type: AWS::SageMaker::TrainingJob
    Properties:
      TrainingJobName: <example_resource_name>
      RoleArn: <example_resource_id>
      AlgorithmSpecification:
        TrainingImage: <example_resource_id>
        TrainingInputMode: File
      OutputDataConfig:
        S3OutputPath: s3://<example_resource_name>/
      ResourceConfig:
        InstanceCount: 1
        InstanceType: ml.m5.large
        VolumeSizeInGB: 10
      StoppingCondition:
        MaxRuntimeInSeconds: 3600
      EnableInterContainerTrafficEncryption: true  # Critical: encrypts traffic between containers to pass the check

Other

1In the AWS console, go to Amazon SageMaker > Training jobs
2Click Create training job
3Configure required fields (algorithm, role, inputs, output, resources)
4Enable the setting: Enable inter-container traffic encryption
5Click Create to start the new job (existing jobs cannot be modified)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client


class sagemaker_training_jobs_intercontainer_encryption_enabled(Check):
    def execute(self):
        findings = []
        for training_job in sagemaker_client.sagemaker_training_jobs:
            report = Check_Report_AWS(metadata=self.metadata(), resource=training_job)
            report.status = "PASS"
            report.status_extended = f"Sagemaker training job {training_job.name} has intercontainer encryption enabled."
            if not training_job.container_traffic_encryption:
                report.status = "FAIL"
                report.status_extended = f"Sagemaker training job {training_job.name} has intercontainer encryption disabled."

            findings.append(report)

        return findings

References