[New Check]: SageMaker Clarify processing jobs exist

Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

New provider name

No response

Service or product area

sagemaker

Suggested check name

sagemaker_clarify_exists

Context and goal

• Security condition to validate: At least one SageMaker Clarify processing job exists in the account/region.
• Why it matters: Clarify provides bias detection and explainability for ML models. Its absence is an indicator that responsible-AI controls are not in place, which is required by several AI/ML governance frameworks.
• Resource involved: SageMaker processing jobs whose AppSpecification.ImageUri corresponds to the AWS-managed Clarify container.

Expected behavior

• Resource or scope to evaluate: SageMaker processing jobs in the account/region.
• PASS when: at least one processing job uses the Clarify image.
• FAIL when: no processing job uses the Clarify image.

References

• AWS docs: https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html
• Clarify container image URIs: https://docs.aws.amazon.com/sagemaker/latest/dg-ecr-paths/sagemaker-algo-docker-registry-paths.html
• API: sagemaker:ListProcessingJobs, sagemaker:DescribeProcessingJob (returns AppSpecification.ImageUri).
• CLI: aws sagemaker list-processing-jobs; aws sagemaker describe-processing-job --processing-job-name .
• Reference implementation: check_sagemaker_clarify_usage in https://github.com/aws-samples/sample-aiml-security-assessment

Suggested severity

Low

Additional implementation notes

No response