AWS sagemaker documentation change

Service: sagemaker · 2025-08-19 · Documentation medium

File: sagemaker/latest/dg/hyperpod-custom-ami-how-to.md

Summary

Added documentation on creating custom AMIs with customer-managed AWS KMS encryption for HyperPod volumes

Security assessment

The change introduces instructions for encrypting HyperPod cluster volumes using customer-managed KMS keys, enhancing data security. This is a security feature addition rather than a response to a specific vulnerability.

Diff

diff --git a/sagemaker/latest/dg/hyperpod-custom-ami-how-to.md b/sagemaker/latest/dg/hyperpod-custom-ami-how-to.md
index 6cd673435..ab4d3e75e 100644
--- a//sagemaker/latest/dg/hyperpod-custom-ami-how-to.md
+++ b//sagemaker/latest/dg/hyperpod-custom-ami-how-to.md
@@ -43 +43 @@ The following example shows how to retrieve the latest AMI ID using the AWS CLI:
-      --region us-west-2 \
+      --region us-east-1 \
@@ -65,0 +66,48 @@ After you have selected a SageMaker HyperPod public AMI, use that as the base AM
+### Build a custom AMI with customer managed AWS KMS encryption
+
+The following sections describe how to build a custom AMI with a customer managed AWS KMS key to encrypt your HyperPod cluster volumes. For more information about customer managed keys in HyperPod and granting the required IAM and KMS key policy permissions, see [Customer managed AWS KMS key encryption for SageMaker HyperPod](./smcluster-cmk.html).
+
+#### AWS CLI example: Create a new AMI using EC2 Image Builder and a HyperPod base image
+
+The following example shows how to create an AMI using Image Builder with AWS KMS encryption:
+    
+    
+    aws imagebuilder create-image-recipe \
+        name "hyperpod-custom-recipe" \
+        version "1.0.0" \
+        parent-image "<hyperpod-base-image-id>" \
+        block-device-mappings DeviceName="/dev/xvda",Ebs={VolumeSize=100,VolumeType=gp3,Encrypted=true,KmsKeyId=arn:aws:kms:us-east-1:111122223333:key/key-id,DeleteOnTermination=true}
+
+#### Amazon EC2 console: Create a new AMI from an Amazon EC2
+
+To create an AMI from an Amazon EC2 instance using the Amazon EC2 console:
+
+  1. Right-click on your customized Amazon EC2 instance and choose **Create Image**.
+
+  2. In the **Encryption** section, select **Encrypt snapshots**.
+
+  3. Select your KMS key from the dropdown. For example: `arn:aws:kms:`us-east-2`:`111122223333`:key/`<your-kms-key-id>`` or use the key alias: `alias/`<your-hyperpod-key>``.
+
+
+
+
+#### AWS CLI example: Create a new AMI from an Amazon EC2 instance
+
+Use the `aws ec2 create-image` command with AWS KMS encryption:
+    
+    
+    aws ec2 create-image \
+        instance-id "<instance-id>" \
+        name "MyCustomHyperPodAMI" \
+        description "Custom HyperPod AMI" \
+        block-device-mappings '[
+            {
+                "DeviceName": "/dev/xvda",
+                "Ebs": {
+                    "Encrypted": true,
+                    "KmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/key-id",
+                    "VolumeType": "gp2" 
+                }
+            }
+        ]'
+