Connection to SageMaker Studio Space bypasses proxy
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 807
- Avg merge
- 10h 12m
- Merged PRs (30d)
- 7
Description
## Problem
I am trying to use the toolkit to connect to my SageMaker Studio JupyterLab Space and I sit behind a corporate proxy.
Corporate policy is such that all internet traffic must to be routed through the proxy.
Environment variables HTTP_PROXY and HTTPS_PROXY have been set on the system.
I am able to authenticate against Identity Center in the toolkit, and also list the available Spaces in toolkit.
However, when I try to connect to my JupyterLab Space, I get a `TimeoutError`.
From `sagemaker-local-server.err.log` I can see it timing-out trying to hit the SageMaker endpoint.
```
Failed to start SageMaker session for [Space ARN redacted]: AggregateError [ETIMEDOUT]:
at internalConnectMultiple (node:net:1134:18)
at afterConnectMultiple (node:net:1715:7) {
code: 'ETIMEDOUT',
name: 'TimeoutError',
'$metadata': { attempts: 3, totalRetryDelay: 104 },
[errors]: [
Error: connect ETIMEDOUT 18.204.246.77:443
at createConnectionError (node:net:1678:14)
at Timeout.internalConnectMultipleTimeout (node:net:1737:38)
at listOnTimeout (node:internal/timers:590:11)
at process.processTimers (node:internal/timers:523:7) {
errno: -4039,
code: 'ETIMEDOUT',
syscall: 'connect',
address: '18.204.246.77',
port: 443
},
Error: connect ETIMEDOUT 18.204.185.72:443
at createConnectionError (node:net:1678:14)
at Timeout.internalConnectMultipleTimeout (node:net:1737:38)
at listOnTimeout (node:internal/timers:590:11)
at process.processTimers (node:internal/timers:523:7) {
errno: -4039,
code: 'ETIMEDOUT',
syscall: 'connect',
address: '18.204.185.72',
port: 443
},
Error: connect ETIMEDOUT 34.201.234.253:443
at createConnectionError (node:net:1678:14)
at afterConnectMultiple (node:net:1708:16) {
errno: -4039,
code: 'ETIMEDOUT',
syscall: 'connect',
address: '34.201.234.253',
port: 443
}
]
}
```
I can also see Code.exe trying to open (SYN_SENT) a direct connection to the SageMaker endpoint instead of going through the proxy.
After tracing down the toolkit source code, I can only suspect if the issue is coming from here?
That somehow the SageMakerClient is not picking up the proxy configuration when firing off `send`?
(I get those three IP addresses in the error log above when I do `nslookup sagemaker.us-east-1.amazonaws.com`)
https://github.com/aws/aws-toolkit-vscode/blob/e06830b540f0836cfd6b6c4e58223902db29dda7/packages/core/src/awsService/sagemaker/detached-server/utils.ts#L85-L88
## Steps to reproduce the issue
Connect to SageMaker Space behind a corporate firewall that blocks direct internet connection.
## Expected behavior
New connections initiated from toolkit should go through proxy, if configured.
## System details
- OS: Windows_NT x64 10.0.26100
- Visual Studio Code extension host: 1.104.0
- AWS Toolkit: 3.74.0
- node: 22.18.0
- electron: 37.3.1
Contributor guide
Research direction
Start with packages/core/src/awsService/sagemaker/detached-server/utils.ts at lines 85-88 and trace how the SageMaker client sends requests when connecting to a Space. Reproduce the connection behind a corporate proxy using the reported environment variables and inspect the SageMaker local-server log. Done means new toolkit connections use the configured proxy instead of attempting direct SageMaker endpoint connections.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript, vscode
- Domain
- cloud, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100