Question

A healthcare company runs a SageMaker real-time endpoint that processes protected health information (PHI). A compliance auditor requires that all model prediction logs and captured inference data be encrypted at rest with a customer-managed key, and that any attempt to disable logging or delete the key be centrally recorded for audit. The ML engineer has already enabled SageMaker Data Capture writing to an S3 bucket. Which combination of actions BEST satisfies these requirements with the least custom code?

Accepted Answer

Configure the Data Capture S3 destination and CloudWatch Logs log group to use a customer-managed AWS KMS key, and enable AWS CloudTrail with a trail that logs management events including KMS and logging configuration changes.

Answer

Encrypt the S3 bucket with SSE-S3, enable CloudWatch Logs default encryption, and write a Lambda function triggered on a schedule to check whether logging is still enabled.

Answer

Enable server-side encryption on the endpoint with an EBS volume key and configure Amazon Macie to scan the captured data bucket for policy violations daily.

Answer

Use SageMaker Model Monitor with a data quality baseline and rely on its built-in encryption and audit dashboard to track key and logging changes.