Disable output encryption in AWS Sagemaker

Question

The documentation for TransformOutput states that if KmsKeyId isn't specified, that the default encryption for the configured role is used for encrypting data output.

Indeed, when I exclude that configuration item, it ends up encrypted. Is there a way to disable encrypted output in Sagemaker? I can currently just do a copy_object from the output keys to themselves using boto3 but it would be nice to skip this step.

Answer 1

Thanks for using Amazon SageMaker!

Unfortunately, SageMaker Batch Transform currently does not support disabling encryption on the job output.

The service team uses customer requests like this to re-evaluate the backlog of features, so the feedback is appreciated!

Answer 2

Still not possible. Got this from the support today:

To answer your question, unfortunately we cannot disable encryption as SageMaker encrypts SageMaker Studio notebooks, notebook instances, model-building data and model artifacts, as well as output from Training and Batch Transform jobs by default using the AWS Managed Key for Amazon S3 in order to protect data at rest as explained in resource