aws / aws/aws-toolkit-vscode

Connection to SageMaker Studio Space bypasses proxy

Open
#8,059 2 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
2k
Forks
807
Avg merge
10h 12m
Merged PRs (30d)
7

Description

## Problem
I am trying to use the toolkit to connect to my SageMaker Studio JupyterLab Space and I sit behind a corporate proxy.
Corporate policy is such that all internet traffic must to be routed through the proxy.
Environment variables HTTP_PROXY and HTTPS_PROXY have been set on the system.

I am able to authenticate against Identity Center in the toolkit, and also list the available Spaces in toolkit.
However, when I try to connect to my JupyterLab Space, I get a `TimeoutError`.

From `sagemaker-local-server.err.log` I can see it timing-out trying to hit the SageMaker endpoint.
```
Failed to start SageMaker session for [Space ARN redacted]: AggregateError [ETIMEDOUT]:
at internalConnectMultiple (node:net:1134:18)
at afterConnectMultiple (node:net:1715:7) {
code: 'ETIMEDOUT',
name: 'TimeoutError',
'$metadata': { attempts: 3, totalRetryDelay: 104 },
[errors]: [
Error: connect ETIMEDOUT 18.204.246.77:443
at createConnectionError (node:net:1678:14)
at Timeout.internalConnectMultipleTimeout (node:net:1737:38)
at listOnTimeout (node:internal/timers:590:11)
at process.processTimers (node:internal/timers:523:7) {
errno: -4039,
code: 'ETIMEDOUT',
syscall: 'connect',
address: '18.204.246.77',
port: 443
},
Error: connect ETIMEDOUT 18.204.185.72:443
at createConnectionError (node:net:1678:14)
at Timeout.internalConnectMultipleTimeout (node:net:1737:38)
at listOnTimeout (node:internal/timers:590:11)
at process.processTimers (node:internal/timers:523:7) {
errno: -4039,
code: 'ETIMEDOUT',
syscall: 'connect',
address: '18.204.185.72',
port: 443
},
Error: connect ETIMEDOUT 34.201.234.253:443
at createConnectionError (node:net:1678:14)
at afterConnectMultiple (node:net:1708:16) {
errno: -4039,
code: 'ETIMEDOUT',
syscall: 'connect',
address: '34.201.234.253',
port: 443
}
]
}
```

I can also see Code.exe trying to open (SYN_SENT) a direct connection to the SageMaker endpoint instead of going through the proxy.

After tracing down the toolkit source code, I can only suspect if the issue is coming from here?
That somehow the SageMakerClient is not picking up the proxy configuration when firing off `send`?
(I get those three IP addresses in the error log above when I do `nslookup sagemaker.us-east-1.amazonaws.com`)

https://github.com/aws/aws-toolkit-vscode/blob/e06830b540f0836cfd6b6c4e58223902db29dda7/packages/core/src/awsService/sagemaker/detached-server/utils.ts#L85-L88

## Steps to reproduce the issue

Connect to SageMaker Space behind a corporate firewall that blocks direct internet connection.

## Expected behavior

New connections initiated from toolkit should go through proxy, if configured.

## System details

- OS: Windows_NT x64 10.0.26100
- Visual Studio Code extension host: 1.104.0
- AWS Toolkit: 3.74.0
- node: 22.18.0
- electron: 37.3.1

Contributor guide

Open the contributing guide

Research direction

Start with packages/core/src/awsService/sagemaker/detached-server/utils.ts at lines 85-88 and trace how the SageMaker client sends requests when connecting to a Space. Reproduce the connection behind a corporate proxy using the reported environment variables and inspect the SageMaker local-server log. Done means new toolkit connections use the configured proxy instead of attempting direct SageMaker endpoint connections.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript, vscode
Domain
cloud, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.