Checks

SageMaker Domain configured with IAM Identity Center (SSO) authentication. The check validates that each SageMaker Domain uses SSO mode (AuthMode: SSO) and is associated with an IAM Identity Center instance (SingleSignOnManagedApplicationInstanceId or SingleSignOnApplicationArn present), ensuring user access is centrally managed through AWS IAM Identity Center.

Amazon SageMaker endpoint configurations are assessed for at-rest encryption using an AWS KMS key. The finding reflects whether a KmsKeyId is configured on the endpoint configuration so inference data volumes and related storage use KMS encryption.

Amazon SageMaker endpoint configurations are evaluated to ensure each production variant uses an initial instance count of at least two. Variants with InitialInstanceCount less than two in instance-based endpoints are identified, indicating no built-in multi-AZ redundancy.

SageMaker Models Monitor detects data drift, model quality issues, and bias drift in production.

SageMaker models are evaluated for network isolation status, indicating whether model containers are blocked from initiating network connections during hosting/inference, aside from required service control traffic.

SageMaker Model Registry is evaluated to verify that at least one Model Package Group exists and contains at least one model package with ModelApprovalStatus = Approved. This confirms that the ML governance workflow (register → review → approve → deploy) is actively in use.

SageMaker models use VPC settings (VpcConfig with subnets and security groups) so inference containers communicate through a selected VPC rather than the public internet.

This evaluates whether a model defines VPC subnets for its network path.

Amazon SageMaker notebook instances are assessed for at-rest encryption using an AWS KMS key. The finding reflects whether a KmsKeyId is configured for the notebook's ML volume encryption.

SageMaker notebook instance lifecycle configuration scripts (OnCreate and OnStart) are analyzed for embedded secrets, detecting patterns like API keys, passwords, tokens, and connection strings. Findings reference the lifecycle hook and line numbers where potential secrets appear.

Amazon SageMaker notebook instances with user root access disabled. The evaluation checks whether interactive users can obtain root privileges on the instance, highlighting notebooks where RootAccess is not set to Disabled.

SageMaker notebook instances are evaluated for VPC attachment. Instances configured with a VPC (via a subnet_id and security groups) use private networking; those without VPC settings rely on public networking.

Amazon SageMaker notebook instances are evaluated for the DirectInternetAccess setting.

Instances with it disabled use only VPC connectivity; instances with it enabled permit direct outbound internet access.

Amazon SageMaker training jobs have inter-container traffic encryption configured for container-to-container communications during training.

The evaluation inspects the EnableInterContainerTrafficEncryption setting on training jobs.

SageMaker training jobs have network isolation enabled, preventing the training container from making any inbound or outbound network calls during execution

Amazon SageMaker training jobs use KMS encryption for their attached ML storage volumes via VolumeKmsKeyId.

The finding identifies training jobs where the volume encryption key is not configured.

SageMaker training jobs are evaluated for VPC configuration by detecting defined subnets in the job settings. With VPC settings, ENIs place the job in your VPC so traffic for training volumes and outputs uses private networking.

Kubernetes scheduler is configured with --bind-address=127.0.0.1 so its health and metrics endpoints listen only on localhost.

The evaluation inspects scheduler pod commands for this bind address.

Kubernetes Scheduler profiling configuration, specifically whether scheduler containers run with --profiling=false to keep the profiling API disabled.

Secret Manager secrets deny access to allUsers and allAuthenticatedUsers, so only explicitly authorized identities can read or use them.

The evaluation reviews each secret's IAM policy bindings to confirm no public principals are granted access.

Secret Manager secrets have automatic rotation configured with a rotation period of 90 days or less and the next scheduled rotation has not been missed.

The evaluation reviews each secret's rotation settings to confirm both the period and the upcoming rotation time are within bounds.

AWS Secrets Manager secrets are evaluated for automatic rotation; the check determines if a rotation schedule is enabled for each secret

Secrets Manager secrets are evaluated for restrictive resource-based policies: explicit Deny for unauthorized principals, Organization boundary via PrincipalOrgID, aws:SourceAccount for service access. Per-principal NotAction restrictions are optional (defense-in-depth). Regionalized service principals are supported.

AWS Secrets Manager secrets are evaluated for public exposure through resource-based policies that grant broad access, such as Principal: "*", which would allow any principal to perform actions on the secret.

AWS Secrets Manager secrets are evaluated for periodic rotation within a configured window (default 90 days).

Secrets with no recorded rotation, or with rotation older than the allowed window, are identified for review.