How to allowlist sagemaker IP?

Question

I want to allowlist the Sagemaker studio IP so people can access certain allowlisted services from Sagemaker. I created a sagemaker domain in my private subnet of my VPC, so theoretically it should use the IP of the associated NAT gateway, right? But I see a different IP 🤔

Accepted Answer

I should've read through my terraform code that created Sagemaker more carefully, I specified a VPC so I thought it would be *in* the VPC but it turns out I needed to specify the AppNetworkAccessType too.

bad:
```hcl
resource "aws_sagemaker_domain" "my_domain" {
  domain_name = var.domain_name
  auth_mode   = "IAM"
  vpc_id      = var.vpc_id
  subnet_ids  = var.subnet_ids
```

good:
```hcl
resource "aws_sagemaker_domain" "my_domain" {
  domain_name = var.domain_name
  auth_mode   = "IAM"
  vpc_id      = var.vpc_id
  subnet_ids  = var.subnet_ids
  app_network_access_type = "VpcOnly"
```

Answer

When you create a SageMaker Studio in a private subnet, it is associated with a NAT gateway that allows the Studio to access the internet. However, the IP address of the NAT gateway is not typically used for inbound connections to the Studio. Instead, the IP address of the VPC endpoint for SageMaker Studio is used for inbound connections.

The VPC endpoint for SageMaker Studio is a highly available, scalable, and secure connection to the SageMaker Studio service without the need to traverse the internet or a NAT gateway.

Therefore, if you want to allowlist the IP of the SageMaker Studio, you would need to whitelist the IP address of the VPC endpoint for SageMaker Studio, rather than the IP address of the NAT gateway.

You can find the IP address of the VPC endpoint for SageMaker Studio in the VPC console under "Endpoints" tab, or you can use aws ec2 describe-vpc-endpoints command to retrieve information about your VPC endpoint.

It is also possible to use security groups or Network ACLs to specify allowlisted IPs that can access the VPC endpoint.

How to allowlist sagemaker IP?

Relevant content