# Ensure Amazon SageMaker training jobs have intercontainer encryption enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292224602617-ensure-amazon-sagemaker-training-jobs-have-intercontainer-encryption-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon SageMaker training job has inter-container traffic encryption enabled. When the EnableInterContainerTrafficEncryption setting is turned on, the communication between the containers of a distributed training job is encrypted in transit. **Rationale** Without inter-container encryption, the traffic exchanged between training containers can be sent in plain text and captured by a compromised host or workload. This exposes training data, model parameters and credentials, and allows an attacker to tamper with intermediate results or steal tokens to move to other resources. Enabling inter-container traffic encryption on all training jobs, together with network isolation and least-privilege roles, protects the confidentiality and integrity of the training process. **Impact** - Encrypts data exchanged between training containers in transit - Protects training data and model parameters from interception and tampering - Encryption can increase the training time of distributed training jobs, and therefore their cost - Existing training jobs cannot be changed, so the setting applies only to training jobs created after the change; existing failing jobs keep failing and must be accepted as exceptions **Default Value** Inter-container traffic encryption is disabled by default for new training jobs. **Pre-Requisites** - IAM permissions: sagemaker:ListTrainingJobs, sagemaker:DescribeTrainingJob, sagemaker:CreateTrainingJob and iam:PassRole - Access to the pipelines, notebooks or scripts that create training jobs, so the setting can be added to them **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon SageMaker AI console and select **Training jobs** under **Training**. 3. Select a training job and review its network settings. 4. Check that inter-container traffic encryption is enabled. 5. Repeat for each training job in each region in use. 6. If any training job has inter-container traffic encryption disabled, follow the implementation steps. **CLI:** List the training jobs in a region: aws sagemaker list-training-jobs --region --query "TrainingJobSummaries\[\].\[TrainingJobName,TrainingJobStatus\]" --output table Show the inter-container encryption setting of a training job: aws sagemaker describe-training-job --region --training-job-name --query "EnableInterContainerTrafficEncryption" A training job fails if the output is false or null. All listed training jobs are evaluated, whatever their status. **Implementation Steps** Existing training jobs cannot be modified, and every training job that SageMaker still lists is evaluated. The original failing job therefore keeps failing even after a compliant clone is created. These steps prevent new failures; existing failing jobs must be accepted as exceptions, and they stop being reported only when SageMaker no longer returns them. **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon SageMaker AI console and select **Training jobs** under **Training**. 3. Select the failing training job, choose **Actions**, then **Clone** (or choose **Create training job**). 4. Select **Enable inter-container traffic encryption**. 5. Complete the remaining settings and choose **Create training job**. 6. Update the pipelines, notebooks or scripts that create training jobs so that new jobs enable this setting: - in the CreateTrainingJob API, set EnableInterContainerTrafficEncryption to true, - in the SageMaker Python SDK, set encrypt\_inter\_container\_traffic=True on the estimator. 7. Repeat for each affected training job in each region in use. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon SageMaker AI console and select **Training jobs** under **Training**. 3. Create new training jobs with **Enable inter-container traffic encryption** cleared, or remove the setting from the pipelines, notebooks or scripts that create them. Note: rolling back sends traffic between training containers without encryption again. **Reference** - [https://docs.aws.amazon.com/sagemaker/latest/dg/train-encrypt.html](https://docs.aws.amazon.com/sagemaker/latest/dg/train-encrypt.html) - [https://docs.aws.amazon.com/sagemaker/latest/APIReference/API\_CreateTrainingJob.html](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrainingJob.html) - [https://docs.aws.amazon.com/cli/latest/reference/sagemaker/describe-training-job.html](https://docs.aws.amazon.com/cli/latest/reference/sagemaker/describe-training-job.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.