Users should not have root access to SageMaker notebook instances

How to fix it

Set RootAccess to Disabled on the notebook instance. This one is changed in place, but only while the instance is stopped, so stop it, update it and start it again: that interrupts anyone working in it and any long-running job, and it comes back on a volume that kept only what was under /home/ec2-user/SageMaker. Afterwards its users can no longer install operating-system packages or write outside their own directories, so anything installed with sudo moves into a lifecycle configuration script or a conda environment, and the instance runs Rootless Docker rather than regular Docker. Lifecycle configuration scripts still run as root with the execution role, so restrict who may attach one.

In the console

SageMaker AI → Notebook instances → the stopped notebook instance → Edit → Root access

With the AWS CLI

aws sagemaker update-notebook-instance --notebook-instance-name <notebook-instance-name> --root-access Disabled --region <region>

With Terraform

resource "aws_sagemaker_notebook_instance" "this" {
  name          = var.notebook_instance_name
  instance_type = var.instance_type
  role_arn      = var.role_arn
  root_access   = "Disabled"
}