Sagemaker root access remediation

Using Console

Below are the console steps to disable root access for an existing (or new) SageMaker notebook instance.

A. Check current root access setting

Sign in to the AWS Management Console.
Open the Amazon SageMaker console.
In the left menu, choose Notebook instances.
Find your notebook instance and look at the Root access column:
- It will show Enabled or Disabled.

If it’s already Disabled, no further change is needed.

B. Disable root access for an existing notebook instance

In the Notebook instances list, select the notebook you want to change.
Make sure the notebook is Stopped:
- If it is InService, choose Stop and wait until the status becomes Stopped.
With the notebook instance selected, choose Edit (or Actions ➜ Edit depending on the UI).
In the edit screen, locate the Root access setting.
Change Root access to:
- Disabled
Review any other settings you do not want to change, then scroll down and choose Submit or Save changes.
After the edit completes, select the notebook instance and choose Start to bring it back InService.

C. Disable root access when creating a new notebook instance

In the SageMaker console, go to Notebook instances.
Choose Create notebook instance.
Configure the required details (name, instance type, IAM role, VPC, etc.).
Find the Root access setting.
Set Root access to:
- Disabled
Complete the rest of the configuration as required and choose Create notebook instance.

The notebook instance will now come up with root access disabled.

Using CLI

To disable root access on a SageMaker Notebook Instance using AWS CLI, you must set the --root-access parameter to Disabled (either when creating the instance or by updating an existing one).Below are step‑by‑step instructions for both scenarios.

1. For a new Notebook Instance

When creating a notebook instance, specify --root-access Disabled:

aws sagemaker create-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --instance-type ml.t3.medium \
  --role-arn arn:aws:iam::123456789012:role/MySageMakerRole \
  --root-access Disabled \
  --region us-east-1

Wait for the instance to be InService (you can check with):

aws sagemaker describe-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --region us-east-1 \
  --query 'NotebookInstanceStatus'

2. For an existing Notebook Instance

You must update the configuration and then restart the instance.

Step 2.1 – Stop the notebook instance (if running)

aws sagemaker stop-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --region us-east-1

(Optional) Wait until it is stopped:

aws sagemaker describe-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --region us-east-1 \
  --query 'NotebookInstanceStatus'

Ensure the status is Stopped.

Step 2.2 – Update to disable root access

aws sagemaker update-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --root-access Disabled \
  --region us-east-1

Step 2.3 – Start the notebook instance again

aws sagemaker start-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --region us-east-1

3. Verify root access is disabled

aws sagemaker describe-notebook-instance \
  --notebook-instance-name my-notebook-instance \
  --region us-east-1 \
  --query 'RootAccess'

Expected output:

"Disabled"

Using Python

You disable root access on a SageMaker notebook instance by updating its configuration via the SageMaker API (boto3). Below are the minimal steps in Python.

1. Prerequisites

AWS credentials/config set (via environment variables, IAM role, or config files).
boto3 installed:

pip install boto3

2. Disable root access on an existing Notebook Instance

import boto3

sagemaker = boto3.client("sagemaker", region_name="us-east-1")  # change region if needed
notebook_instance_name = "your-notebook-instance-name"

# 1) Stop the notebook instance (must be stopped to update)
sagemaker.stop_notebook_instance(NotebookInstanceName=notebook_instance_name)

# Wait until it stops
waiter = sagemaker.get_waiter("notebook_instance_stopped")
waiter.wait(NotebookInstanceName=notebook_instance_name)

# 2) Update the notebook instance to disable root access
sagemaker.update_notebook_instance(
    NotebookInstanceName=notebook_instance_name,
    RootAccess="Disabled"  # or "Enabled"
)

# 3) Start the notebook instance again
sagemaker.start_notebook_instance(NotebookInstanceName=notebook_instance_name)

3. Create a new Notebook Instance with root access disabled

import boto3

sagemaker = boto3.client("sagemaker", region_name="us-east-1")

response = sagemaker.create_notebook_instance(
    NotebookInstanceName="my-secure-notebook",
    InstanceType="ml.t3.medium",
    RoleArn="arn:aws:iam::123456789012:role/SageMakerExecutionRole",
    RootAccess="Disabled",
    # add other parameters as needed, e.g. SubnetId, SecurityGroupIds, etc.
)

This will create/run the notebook instance with root access disabled from the start.

Using Terraform

resource "aws_sagemaker_notebook_instance" "THIS_NOTEBOOK" {
  name          = "NOTEBOOK_INSTANCE_NAME" # replace with the SageMaker notebook instance name
  role_arn      = "IAM_ROLE_ARN"           # replace with the IAM role ARN for the notebook
  instance_type = "ml.t3.medium"           # replace with the desired instance type

  # Disable root access to remediate the finding
  root_access = "Disabled"
}

The notebook instance must be in a Stopped state before Terraform can successfully apply the root_access = "Disabled" update; stopping/starting must be done outside Terraform (CLI or console) as Terraform does not expose those actions.This change does not force resource replacement; Terraform will perform an in-place update.
On terraform plan, you should see root_access changing from Enabled (or its current value) to "Disabled" for this aws_sagemaker_notebook_instance resource.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Sagemaker root access remediation

Triage and Remediation

Remediation

A. Check current root access setting

B. Disable root access for an existing notebook instance

C. Disable root access when creating a new notebook instance

1. For a new Notebook Instance

2. For an existing Notebook Instance

Step 2.1 – Stop the notebook instance (if running)

Step 2.2 – Update to disable root access

Step 2.3 – Start the notebook instance again

3. Verify root access is disabled

1. Prerequisites

2. Disable root access on an existing Notebook Instance

3. Create a new Notebook Instance with root access disabled

​Triage and Remediation

​Remediation

​A. Check current root access setting

​B. Disable root access for an existing notebook instance

​C. Disable root access when creating a new notebook instance

​1. For a new Notebook Instance

​2. For an existing Notebook Instance

​Step 2.1 – Stop the notebook instance (if running)

​Step 2.2 – Update to disable root access

​Step 2.3 – Start the notebook instance again

​3. Verify root access is disabled

​1. Prerequisites

​2. Disable root access on an existing Notebook Instance

​3. Create a new Notebook Instance with root access disabled

Triage and Remediation

Remediation

A. Check current root access setting

B. Disable root access for an existing notebook instance

C. Disable root access when creating a new notebook instance

1. For a new Notebook Instance

2. For an existing Notebook Instance

Step 2.1 – Stop the notebook instance (if running)

Step 2.2 – Update to disable root access

Step 2.3 – Start the notebook instance again

3. Verify root access is disabled

1. Prerequisites

2. Disable root access on an existing Notebook Instance

3. Create a new Notebook Instance with root access disabled