More Info:
Sagemaker Endpoint should have data capture enabledRisk Level
MediumAddress
Monitoring, SecurityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- ISO 27001
- ISO/IEC 27018
- ISO/IEC 27701
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SOC2
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
Below are step‑by‑step AWS Console instructions to enable Data Capture on a SageMaker endpoint.
1. Prerequisites
- You must have:
- An existing SageMaker endpoint.
- An S3 bucket where captured data will be stored (or permission to create one).
- IAM permissions to update the endpoint configuration and write to the S3 bucket.
2. Identify the Endpoint Configuration
- Sign in to the AWS Management Console.
- Go to Amazon SageMaker.
- In the left navigation pane, select Inference → Endpoints.
- Click your endpoint name.
- On the endpoint details page, note the Endpoint configuration name (you’ll need it if you want to clone/modify it).
3. Create a New Endpoint Configuration with Data Capture Enabled
You can’t usually edit an existing endpoint configuration in-place; you create a new one with Data Capture enabled and then update the endpoint to use it.- In the SageMaker left navigation pane, go to Inference → Endpoint configurations.
- Click Create endpoint configuration.
-
Under Endpoint configuration name, enter a new name (e.g.,
my-endpoint-config-with-datacapture). -
Under Production variants, replicate the settings from your existing configuration:
- Model name
- Instance type
- Initial instance count
- Any other variant settings needed (weight, variant name, etc.).
-
Scroll down to Data capture (or Enable data capture section):
- Check Enable data capture.
- S3 location: choose or browse to an S3 bucket/prefix, e.g.,
s3://my-bucket/sagemaker/datacapture/. - Sampling percentage: enter a value (e.g.,
100to capture all requests/responses, or a lower percentage). - Capture options: select what to capture:
- Requests
- Responses
- Encryption key (optional): specify a KMS key if you want encryption using a customer-managed key.
- Leave other options as defaults unless you have specific compliance/logging needs.
- Review all settings and click Create endpoint configuration.
4. Update the Endpoint to Use the New Configuration
- Go back to Endpoints.
- Click your endpoint.
- At the top right, click Update (or Modify).
- In the Endpoint configuration section, select the new endpoint configuration you just created (e.g.,
my-endpoint-config-with-datacapture). - Click Update endpoint.
Updating). Once status becomes InService, the endpoint will be using the new configuration with Data Capture enabled.5. Verify Data Capture
- Send some inference requests to the endpoint (via your application, SDK, or SageMaker notebook).
- In the S3 console, navigate to the bucket/prefix you configured for data capture.
- Confirm that JSON lines files are appearing under paths like:
s3://my-bucket/sagemaker/datacapture/EndpointName/AllTraffic/2024/...
6. (Optional) Clean Up Old Endpoint Configuration
To avoid confusion:- In Endpoint configurations, find the old configuration that no longer has data capture.
- Confirm that no other endpoints are using it.
- Select it and choose Delete if safe to do so.
Using CLI
Using CLI
To enable data capture on a SageMaker endpoint via AWS CLI, you must (a) have an S3 bucket for captured data, and (b) use an endpoint configuration that includes
Note the If
Now create the new endpoint config:Adjust:
Wait for the update to complete:When it shows
You should see JSON files in the capture prefix.
DataCaptureConfig. Then you either create a new endpoint with that config or update an existing one to use it.Below are the minimal step‑by‑step commands.1. Prerequisites
- An S3 bucket for data capture (example:
s3://my-sagemaker-data-capture/) - The IAM role used by the endpoint must have
s3:PutObjectto that bucket.
2. Check current endpoint and its config
EndpointConfigName, e.g. my-endpoint-config.DataCaptureConfig is missing, you need a new endpoint config.3. Create a new endpoint configuration with DataCaptureConfig
You generally cannot modify an existing endpoint config; you create a new one and then update the endpoint to use it.Example JSON fileproduction-variants.json (reusing the same variant(s) as existing endpoint):InitialSamplingPercentage: e.g.,10for 10% of trafficCaptureOptions:Input,Output, or bothDestinationS3Uri: your bucket/prefix
4. Update the endpoint to use the new config
InService, data capture is enabled.5. Verify data capture
After sending some traffic to the endpoint, check S3:Using Python
Using Python
To enable data capture on a SageMaker endpoint using Python/boto3, you must:
You need:
You should now see
- Create (or update) an endpoint configuration with
DataCaptureConfig. - Point it to an S3 bucket/prefix.
- Update the endpoint to use that new endpoint configuration.
0. Prerequisites
- An existing SageMaker endpoint name (e.g.
my-endpoint) - An S3 bucket/prefix to store captured data (e.g.
s3://my-bucket/sagemaker/data-capture/) - IAM role used by SageMaker with permissions to write to that S3 location
1. Get current endpoint configuration
2. Build a new EndpointConfig with DataCaptureConfig
3. Update the Endpoint to use the new config
4. Verify data capture is enabled
EnableCapture: True and captured inference data appearing in the specified S3 prefix.
