You uploaded data to an S3 bucket encrypted with AWS KMS. How should you configure a SageMaker notebook so it can read that encrypted dataset from S3?

The correct approach is to attach an IAM role to the SageMaker notebook that has permissions to read from the S3 bucket and to decrypt data using the KMS key. This IAM role then needs to be explicitly granted kms:Decrypt permission in the KMS key policy itself. This ensures that the SageMaker notebook, acting under the assumed IAM role, has both S3 object access and the necessary cryptographic permissions to decrypt the data. Incorrect options: Security group rules control network traffic, not access to KMS-encrypted S3 data. While running the notebook in a VPC can be good practice for network isolation, it doesn't inherently grant KMS decryption permissions. The notebook's KMS role needs to be the IAM role attached to the notebook, not a separate "KMS role" that is added to the key policy. You cannot directly assign a KMS key to a SageMaker notebook instance. Access is managed through IAM roles and policies.