Sagemaker Notebook Instance Should Not Have Root Access Enabled

# List all notebook instances
aws sagemaker list-notebook-instances

# Describe a specific notebook instance to check its root access setting
aws sagemaker describe-notebook-instance --notebook-instance-name <YourNotebookInstanceName>

# Update the notebook instance to disable root access
aws sagemaker update-notebook-instance \
    --notebook-instance-name <YourNotebookInstanceName> \
    --root-access Disabled

# Restart the notebook instance to apply changes
aws sagemaker stop-notebook-instance --notebook-instance-name <YourNotebookInstanceName>
aws sagemaker start-notebook-instance --notebook-instance-name <YourNotebookInstanceName>

pip install boto3

import boto3

sagemaker = boto3.client('sagemaker')

def list_notebook_instances():
    response = sagemaker.list_notebook_instances()
    return response['NotebookInstances']

def describe_notebook_instance(notebook_instance_name):
    response = sagemaker.describe_notebook_instance(
        NotebookInstanceName=notebook_instance_name
    )
    return response

def update_notebook_instance(notebook_instance_name):
    response = sagemaker.update_notebook_instance(
        NotebookInstanceName=notebook_instance_name,
        RootAccess='Disabled'
    )
    print(response)

def restart_notebook_instance(notebook_instance_name):
    sagemaker.stop_notebook_instance(NotebookInstanceName=notebook_instance_name)
    waiter = sagemaker.get_waiter('notebook_instance_stopped')
    waiter.wait(NotebookInstanceName=notebook_instance_name)
    sagemaker.start_notebook_instance(NotebookInstanceName=notebook_instance_name)

# Identify and update notebook instances with root access enabled
notebook_instances = list_notebook_instances()
for instance in notebook_instances:
    instance_name = instance['NotebookInstanceName']
    details = describe_notebook_instance(instance_name)
    if details.get('RootAccess', '').lower() == 'enabled':
        print(f"Disabling root access for notebook instance: {instance_name}")
        update_notebook_instance(instance_name)
        restart_notebook_instance(instance_name)

resource "aws_sagemaker_notebook_instance" "THIS_NOTEBOOK" {
  name                   = "YOUR_NOTEBOOK_NAME"          # replace with the notebook instance name
  role_arn               = "YOUR_SAGEMAKER_ROLE_ARN"     # replace with the IAM role ARN
  instance_type          = "YOUR_INSTANCE_TYPE"          # e.g., "ml.t3.medium"
  subnet_id              = "YOUR_SUBNET_ID"              # optional: replace if using VPC
  security_groups        = ["YOUR_SECURITY_GROUP_ID"]    # optional: replace with SG IDs

  # Critical setting: disable root access
  root_access            = "Disabled"
}