A dataset in S3 is encrypted with SSE-KMS. What must be done so a SageMaker notebook instance can read that S3 data?

To access SSE-KMS encrypted data, the SageMaker notebook instance needs an IAM role with two permissions: S3 read access to the bucket and permission to use the specific KMS key for decryption. Attaching this IAM role to the notebook instance and including the role in the KMS key policy ensures the notebook can perform both actions. Incorrect options: Opening all HTTP traffic is a security risk and doesn't address KMS permissions. Placing the notebook in a VPC and granting VPC access in the KMS key policy is insufficient; the notebook's underlying compute still needs explicit IAM permissions to use the key. Assigning the KMS key directly to the notebook instance is not how AWS KMS and SageMaker permissions work; access is managed through IAM roles and policies.