fix(sagemaker): canonicalize changelog fragments and clear non-remediating CLI

Author: elecelias-ux

prowler/changelog.d/sagemaker-processing-job-volume-encrypted-with-cmk.added.md

@@ -1 +1 @@
-`sagemaker_processing_job_volume_encrypted_with_cmk` checks that every SageMaker processing job encrypts its ML storage volume with a customer-managed KMS key (`ProcessingResources.ClusterConfig.VolumeKmsKeyId`), and reports MANUAL when the job details cannot be described
+`sagemaker_processing_job_volume_encrypted_with_cmk` check for AWS provider, verifying that every SageMaker processing job encrypts its ML storage volume with a customer-managed KMS key (`ProcessingResources.ClusterConfig.VolumeKmsKeyId`) and reporting MANUAL when the job details cannot be described

prowler/changelog.d/sagemaker-transform-job-volume-encrypted-with-cmk.added.md

@@ -1 +1 @@
-`sagemaker_transform_job_volume_encrypted_with_cmk` checks that every SageMaker transform job encrypts its ML storage volume with a customer-managed KMS key (`TransformResources.VolumeKmsKeyId`), and reports MANUAL when the job details cannot be described
+`sagemaker_transform_job_volume_encrypted_with_cmk` check for AWS provider, verifying that every SageMaker transform job encrypts its ML storage volume with a customer-managed KMS key (`TransformResources.VolumeKmsKeyId`) and reporting MANUAL when the job details cannot be described

prowler/providers/aws/services/sagemaker/sagemaker_processing_job_volume_encrypted_with_cmk/sagemaker_processing_job_volume_encrypted_with_cmk.metadata.json

@@ -22,7 +22,7 @@
   ],
   "Remediation": {
     "Code": {
-      "CLI": "aws sagemaker create-processing-job --processing-job-name <job_name> --role-arn <role_arn> --app-specification ImageUri=<image_uri> --processing-resources 'ClusterConfig={InstanceCount=1,InstanceType=ml.m5.xlarge,VolumeSizeInGB=30,VolumeKmsKeyId=<kms_key_id>}' --processing-output-config 'Outputs=[{OutputName=output-1,S3Output={S3Uri=s3://<bucket>/output,LocalPath=/opt/ml/processing/output,S3UploadMode=EndOfJob}}]' --processing-inputs '[{InputName=input-1,S3Input={S3Uri=s3://<bucket>/input,LocalPath=/opt/ml/processing/input,S3DataType=S3Prefix,S3InputMode=File}}]'",
+      "CLI": "",
       "NativeIaC": "```yaml\n# CloudFormation: SageMaker ProcessingJob with volume CMEK\nResources:\n  <example_resource_name>:\n    Type: AWS::SageMaker::ProcessingJob\n    Properties:\n      ProcessingJobName: <example_resource_name>\n      RoleArn: <example_role_arn>\n      AppSpecification:\n        ImageUri: <example_ecr_image_uri>\n      ProcessingResources:\n        ClusterConfig:\n          InstanceCount: 1\n          InstanceType: ml.m5.xlarge\n          VolumeSizeInGB: 30\n          VolumeKmsKeyId: <example_kms_key_arn>  # Critical: encrypts the processing EBS volume with a customer-managed key\n      ProcessingOutputConfig:\n        Outputs:\n          - OutputName: output-1\n            S3Output:\n              S3Uri: s3://<example_bucket>/output\n              LocalPath: /opt/ml/processing/output\n              S3UploadMode: EndOfJob\n```",
       "Other": "1. In the AWS console, go to SageMaker > Processing > Processing jobs\n2. Create a new processing job (existing jobs cannot change VolumeKmsKeyId)\n3. Under Resource configuration, set Volume encryption key to your customer-managed KMS key\n4. Complete required fields and create the job\n5. Verify DescribeProcessingJob shows ProcessingResources.ClusterConfig.VolumeKmsKeyId",
       "Terraform": "```hcl\n# SageMaker Processing Job with volume CMEK\n# Note: aws_sagemaker_processing_job is not a first-class Terraform resource in all\n# providers; use the AWS CLI/SDK or CloudFormation equivalent with VolumeKmsKeyId set:\n# ProcessingResources.ClusterConfig.VolumeKmsKeyId = \"<example_kms_key_arn>\"\n```"

prowler/providers/aws/services/sagemaker/sagemaker_transform_job_volume_encrypted_with_cmk/sagemaker_transform_job_volume_encrypted_with_cmk.metadata.json

@@ -22,7 +22,7 @@
   ],
   "Remediation": {
     "Code": {
-      "CLI": "aws sagemaker create-transform-job --transform-job-name <job_name> --model-name <model_name> --transform-input 'DataSource={S3DataSource={S3DataType=S3Prefix,S3Uri=s3://<bucket>/input}},ContentType=text/csv' --transform-output 'S3OutputPath=s3://<bucket>/output' --transform-resources 'InstanceType=ml.m5.xlarge,InstanceCount=1,VolumeKmsKeyId=<kms_key_id>'",
+      "CLI": "",
       "NativeIaC": "```yaml\n# CloudFormation: SageMaker TransformJob with volume CMEK\nResources:\n  <example_resource_name>:\n    Type: AWS::SageMaker::TransformJob\n    Properties:\n      TransformJobName: <example_resource_name>\n      ModelName: <example_model_name>\n      TransformInput:\n        DataSource:\n          S3DataSource:\n            S3DataType: S3Prefix\n            S3Uri: s3://<example_bucket>/input\n      TransformOutput:\n        S3OutputPath: s3://<example_bucket>/output\n      TransformResources:\n        InstanceType: ml.m5.xlarge\n        InstanceCount: 1\n        VolumeKmsKeyId: <example_kms_key_arn>  # Critical: encrypts the transform EBS volume with a customer-managed key\n```",
       "Other": "1. In the AWS console, go to SageMaker > Inference > Batch transform jobs\n2. Create a new transform job (existing jobs cannot change VolumeKmsKeyId)\n3. Under Resource configuration, set Volume encryption key to your customer-managed KMS key\n4. Complete required fields and create the job\n5. Verify DescribeTransformJob shows TransformResources.VolumeKmsKeyId",
       "Terraform": "```hcl\n# SageMaker Transform Job with volume CMEK\n# Set TransformResources.VolumeKmsKeyId via the AWS CLI/SDK or CloudFormation:\n# VolumeKmsKeyId = \"<example_kms_key_arn>\"\n```"