Skip to main content

More Info:

Sagemaker Endpoint should have data capture enabled

Risk Level

Medium

Address

Monitoring, Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO 27001
  • ISO/IEC 27018
  • ISO/IEC 27701
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

Below are step‑by‑step AWS Console instructions to enable Data Capture on a SageMaker endpoint.

1. Prerequisites

  1. You must have:
    • An existing SageMaker endpoint.
    • An S3 bucket where captured data will be stored (or permission to create one).
    • IAM permissions to update the endpoint configuration and write to the S3 bucket.

2. Identify the Endpoint Configuration

  1. Sign in to the AWS Management Console.
  2. Go to Amazon SageMaker.
  3. In the left navigation pane, select InferenceEndpoints.
  4. Click your endpoint name.
  5. On the endpoint details page, note the Endpoint configuration name (you’ll need it if you want to clone/modify it).

3. Create a New Endpoint Configuration with Data Capture Enabled

You can’t usually edit an existing endpoint configuration in-place; you create a new one with Data Capture enabled and then update the endpoint to use it.
  1. In the SageMaker left navigation pane, go to InferenceEndpoint configurations.
  2. Click Create endpoint configuration.
  3. Under Endpoint configuration name, enter a new name (e.g., my-endpoint-config-with-datacapture).
  4. Under Production variants, replicate the settings from your existing configuration:
    • Model name
    • Instance type
    • Initial instance count
    • Any other variant settings needed (weight, variant name, etc.).
  5. Scroll down to Data capture (or Enable data capture section):
    • Check Enable data capture.
    • S3 location: choose or browse to an S3 bucket/prefix, e.g., s3://my-bucket/sagemaker/datacapture/.
    • Sampling percentage: enter a value (e.g., 100 to capture all requests/responses, or a lower percentage).
    • Capture options: select what to capture:
      • Requests
      • Responses
    • Encryption key (optional): specify a KMS key if you want encryption using a customer-managed key.
    • Leave other options as defaults unless you have specific compliance/logging needs.
  6. Review all settings and click Create endpoint configuration.

4. Update the Endpoint to Use the New Configuration

  1. Go back to Endpoints.
  2. Click your endpoint.
  3. At the top right, click Update (or Modify).
  4. In the Endpoint configuration section, select the new endpoint configuration you just created (e.g., my-endpoint-config-with-datacapture).
  5. Click Update endpoint.
SageMaker will start updating the endpoint (status: Updating). Once status becomes InService, the endpoint will be using the new configuration with Data Capture enabled.

5. Verify Data Capture

  1. Send some inference requests to the endpoint (via your application, SDK, or SageMaker notebook).
  2. In the S3 console, navigate to the bucket/prefix you configured for data capture.
  3. Confirm that JSON lines files are appearing under paths like:
    • s3://my-bucket/sagemaker/datacapture/EndpointName/AllTraffic/2024/...

6. (Optional) Clean Up Old Endpoint Configuration

To avoid confusion:
  1. In Endpoint configurations, find the old configuration that no longer has data capture.
  2. Confirm that no other endpoints are using it.
  3. Select it and choose Delete if safe to do so.
To enable data capture on a SageMaker endpoint via AWS CLI, you must (a) have an S3 bucket for captured data, and (b) use an endpoint configuration that includes DataCaptureConfig. Then you either create a new endpoint with that config or update an existing one to use it.Below are the minimal step‑by‑step commands.

1. Prerequisites

  • An S3 bucket for data capture (example: s3://my-sagemaker-data-capture/)
  • The IAM role used by the endpoint must have s3:PutObject to that bucket.
Example policy snippet to attach to the endpoint’s execution role:

2. Check current endpoint and its config

Note the EndpointConfigName, e.g. my-endpoint-config.
If DataCaptureConfig is missing, you need a new endpoint config.

3. Create a new endpoint configuration with DataCaptureConfig

You generally cannot modify an existing endpoint config; you create a new one and then update the endpoint to use it.Example JSON file production-variants.json (reusing the same variant(s) as existing endpoint):
Now create the new endpoint config:
Adjust:
  • InitialSamplingPercentage: e.g., 10 for 10% of traffic
  • CaptureOptions: Input, Output, or both
  • DestinationS3Uri: your bucket/prefix

4. Update the endpoint to use the new config

Wait for the update to complete:
When it shows InService, data capture is enabled.

5. Verify data capture

After sending some traffic to the endpoint, check S3:
You should see JSON files in the capture prefix.
To enable data capture on a SageMaker endpoint using Python/boto3, you must:
  1. Create (or update) an endpoint configuration with DataCaptureConfig.
  2. Point it to an S3 bucket/prefix.
  3. Update the endpoint to use that new endpoint configuration.
Below is a minimal, step‑by‑step example.

0. Prerequisites

You need:
  • An existing SageMaker endpoint name (e.g. my-endpoint)
  • An S3 bucket/prefix to store captured data (e.g. s3://my-bucket/sagemaker/data-capture/)
  • IAM role used by SageMaker with permissions to write to that S3 location

1. Get current endpoint configuration


2. Build a new EndpointConfig with DataCaptureConfig


3. Update the Endpoint to use the new config


4. Verify data capture is enabled

You should now see EnableCapture: True and captured inference data appearing in the specified S3 prefix.