Run interactive IDEs on Amazon EKS with SageMaker AI to energy up your AI workflows

To energy up AI workflows on Amazon Elastic Kubernetes Service (Amazon EKS), knowledge scientists want interactive IDEs like JupyterLab and Code Editor. But operating these IDEs often means leaving the cluster that hosts their pipelines, shifting to a standalone JupyterHub deployment or a neighborhood laptop computer. That change leaves them with out the GPU nodes, shared storage, and AWS Id and Entry Administration (IAM) roles their pipelines rely on. The Amazon SageMaker AI Areas add-on for Amazon EKS closes that hole. It runs managed JupyterLab and Code Editor environments on the cluster that you just already function. Standing up a standalone JupyterHub surroundings with GPU entry, storage, and authentication usually takes a platform group 3–5 days. With the add-on, an information scientist launches a completely configured Area in about 5 minutes.

On this publish, you put in the SageMaker AI Areas add-on on an Amazon EKS cluster. You arrange the supporting add-ons and IAM roles, deploy the AWS Load Balancer Controller, request a TLS certificates, and create an AWS Key Administration System (AWS KMS) encryption key. You then create your first Area and attain it via a presigned URL within the browser and from VS Code over SSH-over-SSM. Lastly, you overview find out how to transfer your group to OpenID Join (OIDC) sign-in with Amazon Cognito.

Answer overview

The answer runs on a single EKS cluster in three layers:

Consolidating interactive and coaching workloads on one cluster retains GPU nodes busy between jobs. This could elevate GPU utilization by as much as 30 p.c in contrast with a devoted pocket book fleet. It additionally avoids the price of an always-on GPU surroundings, which may run into 1000’s of {dollars} a month.

Determine 1: Answer structure

Conditions

To observe alongside, you want an AWS account with the AWS Command Line Interface (AWS CLI) 2.x or later configured in your goal AWS Area, plus kubectl 1.30 or later and Helm v3. You additionally want a Route 53 public hosted zone for a website you personal, referenced as all through this publish, and IAM permissions to create roles, insurance policies, EKS add-ons, entry entries, Pod Id associations, ACM certificates, and KMS keys. The Areas add-on should be model 0.1.4 or later, as a result of earlier variations supported Amazon SageMaker HyperPod solely.

Determine 2: Route 53 hosted zone with validation information

Set these variables as soon as. The remainder of the publish reuses them.

export CLUSTER_NAME=
export REGION=
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output textual content)

Each IAM position on this publish is assumed by a Kubernetes service account via EKS Pod Id, so all of them share one belief coverage. Put it aside as soon as and reuse it:

cat > pod-identity-trust.json <<'EOF'
{
  "Model": "2012-10-17",
  "Assertion": [{
    "Effect": "Allow",
    "Principal": { "Service": "pods.eks.amazonaws.com" },
    "Action": ["sts:AssumeRole", "sts:TagSession"]
  }]
}
EOF

Notice: This walkthrough creates assets that incur AWS prices: an internet-facing ALB, EBS volumes, and an EKS cluster. SSM advanced-instances tier provides about $0.00695/hr per Area pod. Observe the Cleanup part once you end.

Create the EKS cluster

Cluster creation itself follows the usual EKS getting began information. What issues right here is assembly 4 Areas-specific necessities. Maintain EKS Auto Mode disabled, as a result of the add-on requires basic EC2-backed nodes on Kubernetes 1.30 or later. Use a digital non-public cloud (VPC) with private and non-private subnets throughout a minimum of two Availability Zones, with a NAT gateway serving the non-public subnets, and set cluster endpoint entry to Private and non-private. Throughout creation, add the EKS Pod Id Agent, Amazon EBS CSI Driver, Cert supervisor, and Exterior DNS add-ons, however maintain off on Amazon SageMaker Areas and the AWS Load Balancer Controller. You put in these later. Lastly, create a managed node group in your non-public subnets with Amazon Linux 2023, m5.xlarge or bigger, and a couple of nodes. Skip forward in case you already run a cluster that matches.

One step is commonly neglected. Tag each subnet within the VPC so the AWS Load Balancer Controller can uncover them, and tag them earlier than you put in the Areas add-on. In any other case, the controller can place the ALB on non-public subnets, making Areas unreachable.

export VPC_ID=$(aws eks describe-cluster 
  --name $CLUSTER_NAME --region $REGION 
  --query 'cluster.resourcesVpcConfig.vpcId' --output textual content)

ALL_SUBNETS=$(aws ec2 describe-subnets --region $REGION 
  --filters "Title=vpc-id,Values=${VPC_ID}" 
  --query 'Subnets[*].SubnetId' --output textual content)
aws ec2 create-tags --region $REGION --resources ${ALL_SUBNETS} 
  --tags Key=kubernetes.io/cluster/$CLUSTER_NAME,Worth=shared

PUBLIC_SUBNETS=$(aws ec2 describe-subnets --region $REGION 
  --filters "Title=vpc-id,Values=${VPC_ID}" "Title=map-public-ip-on-launch,Values=true" 
  --query 'Subnets[*].SubnetId' --output textual content)
aws ec2 create-tags --region $REGION --resources ${PUBLIC_SUBNETS} 
  --tags Key=kubernetes.io/position/elb,Worth=1

PRIVATE_SUBNETS=$(aws ec2 describe-subnets --region $REGION 
  --filters "Title=vpc-id,Values=${VPC_ID}" "Title=map-public-ip-on-launch,Values=false" 
  --query 'Subnets[*].SubnetId' --output textual content)
aws ec2 create-tags --region $REGION --resources ${PRIVATE_SUBNETS} 
  --tags Key=kubernetes.io/position/internal-elb,Worth=1

Arrange the inspiration

With the cluster operating, you level kubectl at it, verify the add-on pods are wholesome, and provides Exterior DNS the Route 53 permissions that it must handle DNS information.

1. Configure kubectl:

   aws eks update-kubeconfig --name $CLUSTER_NAME --region $REGION
   kubectl get nodes

   Each staff report Prepared:

   NAME                        STATUS   ROLES    AGE   VERSION
   ip-10-0-1-42.ec2.inside   Prepared       38m   v1.34.6-eks-bbe087e
   ip-10-0-2-96.ec2.inside   Prepared       38m   v1.34.6-eks-bbe087e

2. Affirm the system pods are wholesome throughout the add-on namespaces with kubectl get pods -A. Each pod in kube-system, cert-manager, and external-dns ought to be Working earlier than you proceed.
3. Exterior DNS wants Route 53 permissions to handle information. Create the position, connect a least-privilege coverage, and bind it via Pod Id:

   aws iam create-role --role-name ExternalDNSRole 
     --assume-role-policy-document file://pod-identity-trust.json
   
   aws iam put-role-policy --role-name ExternalDNSRole 
     --policy-name ExternalDNSRoute53Policy 
     --policy-document '{
     "Model":"2012-10-17",
     "Assertion":[
       {"Effect":"Allow","Action":["route53:ChangeResourceRecordSets"],
        "Useful resource":"arn:aws:route53:::hostedzone/*"},
       {"Impact":"Enable","Motion":["route53:ListHostedZones","route53:ListResourceRecordSets","route53:ListTagsForResource"],
        "Useful resource":"*"}
     ]}'
   
   aws eks create-pod-identity-association 
     --cluster-name $CLUSTER_NAME --region $REGION 
     --namespace external-dns --service-account external-dns 
     --role-arn arn:aws:iam::${ACCOUNT_ID}:position/ExternalDNSRole
   
   kubectl rollout restart deployment -n external-dns external-dns

Safety notice: Scope every Pod Id position to minimal actions and assets. Favor express useful resource ARNs over wildcards, and make sure solely the supposed service account can assume the position.

Set up the AWS Load Balancer Controller

The AWS Load Balancer Controller provisions the ALB that fronts your Areas UI. Set up it with Helm.

1. Outline the controller’s IAM coverage, position, and Pod Id affiliation:

   curl -sS -o /tmp/lbc-iam-policy.json 
     https://uncooked.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/principal/docs/set up/iam_policy.json
   
   aws iam create-policy --policy-name AWSLoadBalancerControllerIAMPolicy 
     --policy-document file:///tmp/lbc-iam-policy.json
   
   aws iam create-role --role-name AWSLoadBalancerControllerRole 
     --assume-role-policy-document file://pod-identity-trust.json
   
   aws iam attach-role-policy --role-name AWSLoadBalancerControllerRole 
     --policy-arn arn:aws:iam::${ACCOUNT_ID}:coverage/AWSLoadBalancerControllerIAMPolicy
   
   aws eks create-pod-identity-association 
     --cluster-name $CLUSTER_NAME --region $REGION 
     --namespace kube-system --service-account aws-load-balancer-controller 
     --role-arn arn:aws:iam::${ACCOUNT_ID}:position/AWSLoadBalancerControllerRole

2. Set up the Helm chart. Go vpcId and area explicitly. On chart v3.2+, the controller fails if it auto-detects the VPC via EC2 metadata, which EKS blocks for pods.

   helm repo add eks https://aws.github.io/eks-charts
   helm repo replace eks
   
   helm set up aws-load-balancer-controller eks/aws-load-balancer-controller 
     -n kube-system 
     --set clusterName=$CLUSTER_NAME 
     --set serviceAccount.create=true 
     --set serviceAccount.title=aws-load-balancer-controller 
     --set area=$REGION 
     --set vpcId=$VPC_ID
   
   kubectl rollout standing deployment -n kube-system aws-load-balancer-controller --timeout=180s

   Each controller replicas come up:

   NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
   aws-load-balancer-controller   2/2     2            2           174m

Create the certificates, key, and SSM configuration

The Areas add-on wants a TLS certificates, a KMS key for JWT encryption, and SSM service settings for distant entry.

1. Request an ACM certificates masking your area and a wildcard, utilizing DNS validation, then learn again the CNAME information ACM expects:

   CERT_ARN=$(aws acm request-certificate 
     --domain-name "" 
     --subject-alternative-names "*." 
     --validation-method DNS 
     --region $REGION 
     --query CertificateArn --output textual content)
   
   # Learn the CNAME information ACM expects, then add them to your Route 53
   # hosted zone. The console's 'Create information in Route 53' button
   # does this for you.
   aws acm describe-certificate --certificate-arn "$CERT_ARN" 
     --region $REGION 
     --query 'Certificates.DomainValidationOptions[].ResourceRecord'

   Look ahead to the certificates standing to succeed in Issued, then copy the ARN.

   

   Determine 3: Certificates issued for the area

   Safety notice: DNS validation verifies area possession and triggers ACM computerized renewal. Maintain the validation CNAMEs in Route 53. Eradicating them breaks renewal.

2. Create a KMS encryption key. The auth middleware calls kms:GenerateDataKey per JWT, so the important thing should be symmetric ENCRYPT_DECRYPT, which is the CLI default:

   KMS_KEY_ARN=$(aws kms create-key --region $REGION 
     --description "SageMaker Areas JWT encryption" 
     --query 'KeyMetadata.Arn' --output textual content)
   
   aws kms create-alias --region $REGION 
     --alias-name alias/sagemaker-spaces-jwt 
     --target-key-id "$KMS_KEY_ARN"

3. Activate the SSM advanced-instances tier. Session Supervisor tunnels to hybrid managed situations, which is what VS Code distant makes use of, require this tier (about $0.00695/hr per Area pod):

   aws ssm update-service-setting --region $REGION 
     --setting-id arn:aws:ssm:$REGION:${ACCOUNT_ID}:servicesetting/ssm/managed-instance/activation-tier 
     --setting-value superior

Set up the Areas add-on

You create IAM roles for the Areas controller and auth middleware, then set up the add-on.

1. Begin with the SSM managed-instance position that every Area pod makes use of within the SSM fleet:

   aws iam create-role --role-name SageMakerSpacesSSMManagedNodeRole 
     --assume-role-policy-document '{
     "Model":"2012-10-17",
     "Assertion":[{"Effect":"Allow","Principal":{"Service":"ssm.amazonaws.com"},"Action":"sts:AssumeRole"}]
   }'
   
   aws iam attach-role-policy --role-name SageMakerSpacesSSMManagedNodeRole 
     --policy-arn arn:aws:iam::aws:coverage/AmazonSSMManagedInstanceCore

2. Subsequent, create the Areas controller position. It wants SSM, PassRole, and KMS permissions. Save the next coverage as spaces-controller-policy.json, changing , , and with your personal values:

   {
     "Model": "2012-10-17",
     "Assertion": [
       {
         "Sid": "SSMAccountLevel",
         "Effect": "Allow",
         "Action": [
           "ssm:CreateActivation",
           "ssm:DeleteActivation",
           "ssm:DescribeActivations",
           "ssm:DescribeInstanceInformation",
           "ssm:DeregisterManagedInstance",
           "ssm:ListTagsForResource",
           "ssm:AddTagsToResource",
           "ssm:ListDocuments",
           "ssm:DescribeSessions"
         ],
         "Useful resource": "*"
       },
       {
         "Sid": "SSMDocumentMgmt",
         "Impact": "Enable",
         "Motion": [
           "ssm:CreateDocument",
           "ssm:DescribeDocument",
           "ssm:GetDocument",
           "ssm:UpdateDocument",
           "ssm:UpdateDocumentDefaultVersion",
           "ssm:DeleteDocument"
         ],
         "Useful resource": "arn:aws:ssm:::doc/SageMaker-Area*"
       },
       {
         "Sid": "SSMSessionMgmt",
         "Impact": "Enable",
         "Motion": [
           "ssm:StartSession",
           "ssm:TerminateSession",
           "ssm:ResumeSession",
           "ssm:GetConnectionStatus"
         ],
         "Useful resource": [
           "arn:aws:ssm:::document/SageMaker-Space*",
           "arn:aws:ssm:::managed-instance/*",
           "arn:aws:ssm:::document/AWS-StartSSHSession"
         ]
       },
       {
         "Sid": "PassSSMManagedNodeRole",
         "Impact": "Enable",
         "Motion": "iam:PassRole",
         "Useful resource": "arn:aws:iam:::position/SageMakerSpacesSSMManagedNodeRole",
         "Situation": {
           "StringEquals": {
             "iam:PassedToService": "ssm.amazonaws.com"
           }
         }
       },
       {
         "Sid": "KMSForJWT",
         "Impact": "Enable",
         "Motion": [
           "kms:GenerateDataKey",
           "kms:Decrypt",
           "kms:Encrypt",
           "kms:DescribeKey"
         ],
         "Useful resource": ""
       }
     ]
   }

   Create the position and connect the coverage:

   aws iam create-role --role-name SageMakerSpacesControllerRole 
     --assume-role-policy-document file://pod-identity-trust.json
   
   aws iam put-role-policy --role-name SageMakerSpacesControllerRole 
     --policy-name SageMakerSpacesControllerPolicy 
     --policy-document file://spaces-controller-policy.json

3. Bind controller and auth middleware service accounts to this position via Pod Id:

   for SA in jupyter-k8s-controller-manager jupyter-k8s-authmiddleware; do
     aws eks create-pod-identity-association 
       --cluster-name $CLUSTER_NAME --region $REGION 
       --namespace jupyter-k8s-system --service-account $SA 
       --role-arn arn:aws:iam::${ACCOUNT_ID}:position/SageMakerSpacesControllerRole
   finished

   Safety notice: For tighter separation of duties, cut up this into two roles: one with SSM actions for the controller, and one with KMS encrypt and decrypt for the auth middleware.

4. Outline addon-config.yaml along with your area, certificates ARN, key ARN, and managed-node position title:

   jupyter-k8s:
     # 'allow' (not 'enabled') is appropriate right here, per the official AWS docs:
     # https://docs.aws.amazon.com/sagemaker/newest/dg/operator-install.html
     # The jupyter-k8s and jupyter-k8s-aws-hyperpod subcharts use completely different
     # schemas, so clusterWebUI under accurately makes use of 'enabled'. Not a typo.
     workspacePodWatching:
       allow: true
   jupyter-k8s-aws-hyperpod:
     clusterWebUI:
       enabled: true
       area: ""
       awsCertificateArn: ""
     traefik:
       shouldInstall: true
     auth:
       kmsKeyId: ""
     remoteAccess:
       enabled: true
       ssmManagedNodeRole: SageMakerSpacesSSMManagedNodeRole

5. Set up the add-on:

   aws eks create-addon 
     --cluster-name $CLUSTER_NAME --region $REGION 
     --addon-name amazon-sagemaker-spaces 
     --configuration-values file://addon-config.yaml 
     --resolve-conflicts OVERWRITE

6. Ballot till the add-on reaches ACTIVE (about three minutes):

   aws eks describe-addon 
     --cluster-name $CLUSTER_NAME --region $REGION 
     --addon-name amazon-sagemaker-spaces 
     --query 'addon.{standing:standing,model:addonVersion,points:well being.points}'

   The add-on stories ACTIVE with an empty points listing:

   {
     "standing": "ACTIVE",
     "model": "v0.1.4-eksbuild.1",
     "points": []
   }

7. Affirm all Areas pods are Working:

   kubectl get pods -n jupyter-k8s-system

   The controller, two auth middleware replicas, and two Traefik routers ought to all be Working:

   NAME                                          READY   STATUS    RESTARTS   AGE
   jupyter-k8s-controller-manager-65fcd4d67f-*   1/1     Working   0          3h13m
   workspace-auth-middleware-c7f7fbb6d-*         1/1     Working   0          3h13m
   workspace-auth-middleware-c7f7fbb6d-*         1/1     Working   0          3h13m
   workspace-traefik-router-755d494fbf-*         1/1     Working   0          3h13m
   workspace-traefik-router-755d494fbf-*         1/1     Working   0          3h13m

Grant person entry and create a Area

With the add-on wholesome, you grant a person entry to the cluster and create the primary JupyterLab Area. Entry depends on an EKS entry entry scoped to a single namespace, so customers can’t attain assets outdoors it.

1. Grant entry via an EKS entry entry. Within the EKS console, navigate to your cluster’s Entry tab and select Create entry entry. Select your IAM person or position, then add AmazonSagemakerHyperpodSpacePolicy for the default namespace.
   

   Determine 4: Entry entry for namespace

   Safety notice: Favor namespace-scoped entry over cluster-wide insurance policies so customers can’t modify assets outdoors their namespace.

2. Checklist the pre-installed Workspace templates and entry methods:

   kubectl get workspacetemplate -A
   kubectl get workspaceaccessstrategies -A

   You see sagemaker-jupyter-template, sagemaker-code-editor-template, and hyperpod-access-strategy in jupyter-k8s-system. Reference these in your Workspace reasonably than repeating configuration inline.

3. Outline workspace.yaml for a JupyterLab Area:

   apiVersion: workspace.jupyter.org/v1alpha1
   type: Workspace
   metadata:
     title: my-space
     namespace: default
   spec:
     templateRef:
       title: sagemaker-jupyter-template
       namespace: jupyter-k8s-system
     appType: jupyterlab
     accessType: OwnerOnly
     accessStrategy:
       title: hyperpod-access-strategy
       namespace: jupyter-k8s-system
     picture: public.ecr.aws/sagemaker/sagemaker-distribution:latest-cpu

   accessType: OwnerOnly restricts browser entry to the IAM principal that created the Area. Use Public for any namespace-authorized person.

4. Apply and look ahead to the Area to grow to be Accessible:

   kubectl apply -f workspace.yaml
   kubectl get workspace -n default -w

   workspace.workspace.jupyter.org/my-space created

   First-time startup takes about 5 minutes. The cluster pulls the 4 GB SageMaker Distribution picture and registers the pod with SSM.

   

   Determine 5: Area operating

Join within the browser

The Areas controller points a short-lived, presigned URL that carries the person’s encrypted token. You generate one, then navigate to it in your browser.

1. Generate a short-lived presigned URL:

   kubectl create -f - -o yaml <

   Discover standing.workspaceConnectionUrl within the response and navigate to the URL in your browser:

   standing:
     workspaceConnectionType: web-ui
     workspaceConnectionUrl: https://my-space-./bearer-auth?token=eyJhbGciOiJIUzM4NCIsImVkayI6...

   Safety notice: Presigned URLs carry the person’s KMS-encrypted JWT with a 5-minute expiry enforced by the exp declare. This worth isn’t configurable within the present add-on model. Don’t log or share presigned URLs over unencrypted channels. For sturdy entry, use VS Code distant.

   

   Determine 6: JupyterLab on the customized area

Join from VS Code

For a neighborhood IDE expertise, VS Code connects to the Area pod via an SSM tunnel, with no browser, area, or ALB required.

1. Set up VS Code, the AWS Toolkit extension, and the Session Supervisor plugin regionally.
2. Generate a VS Code connection URL by creating the identical WorkspaceConnection useful resource as earlier than, with workspaceConnectionType: vscode-remote as a substitute of web-ui. This time the response carries a vscode:// deep hyperlink as a substitute of an HTTPS URL:

   standing:
     workspaceConnectionType: vscode-remote
     workspaceConnectionUrl: vscode://amazonwebservices.aws-toolkit-vscode/join/workspace?sessionId=eks-Sagemaker--jupyter-k8s-...&sessionToken=...&streamUrl=wss://ssmmessages..amazonaws.com/v1/data-channel/...&workspaceName=my-space&namespace=default&eksClusterArn=arn:aws:eks:::cluster/

3. Paste the vscode:// URL into your browser. The browser prompts you to open the hyperlink in VS Code.
   

   Determine 7: Browser opens VS Code

4. Settle for the immediate. AWS Toolkit establishes an SSH-over-SSM tunnel to the Area, and VS Code attaches to the distant filesystem.
   

   Determine 8: VS Code with distant kernel

For personal-subnet configurations and SDK alternate options, see Distant entry to SageMaker AI Areas.

Register with company credentials utilizing OIDC

Entry to date depends on IAM customers and roles. To let your group register with company credentials as a substitute, register an OIDC supplier with the cluster and bind Kubernetes role-based entry management (RBAC) to id supplier teams. Kubernetes then authorizes individuals by group membership, with no IAM principal per person.

The open supply jupyter-deploy mission ships an aws-eks-oidc template that units this up for you. Dex runs within the cluster because the OIDC supplier, Amazon EKS trusts it as an id supplier, and an online console provides your group self-service workspace administration. The template provisions its personal VPC and cluster, so run it alongside the cluster from this publish.

Determine 9: Self-managed OIDC with Amazon Cognito

The template ships a Dex connector for GitHub. Amazon Cognito works via the generic oidc connector in Dex as a substitute, and wishes two declare mappings that GitHub by no means requires. Amazon EKS reads the username from the preferred_username declare, which Cognito doesn’t situation, so map it from e-mail. Cognito additionally publishes group membership as cognito:teams reasonably than teams. Miss the username mapping and requests attain the API server with no resolvable person, and the console stories an expired session reasonably than an authorization error. The template binds its RBAC position to a bunch named :, so create a Cognito group with that actual title and add your customers to it.

Your group then indicators in on the Cognito managed login web page. With a single connector configured, Dex skips the supplier chooser.

Determine 10: Cognito managed login

The console lists and creates workspaces beneath that id.

Determine 11: Self-service workspace administration

Opening one launches JupyterLab, licensed because the Cognito person.

Determine 12: JupyterLab for the Cognito person

Cleanup

To keep away from ongoing prices, delete assets in reverse order.

1. Delete the Area and the add-on:

   kubectl delete workspace my-space -n default
   
   aws eks delete-addon --cluster-name $CLUSTER_NAME --region $REGION 
     --addon-name amazon-sagemaker-spaces

2. Uninstall the Load Balancer Controller and remaining add-ons:

   helm uninstall aws-load-balancer-controller -n kube-system
   
   for a in aws-ebs-csi-driver external-dns cert-manager eks-pod-identity-agent kube-proxy; do
     aws eks delete-addon --cluster-name $CLUSTER_NAME --region $REGION --addon-name $a
   finished

3. Delete the IAM roles, insurance policies, and Pod Id associations you created (ExternalDNSRole, AWSLoadBalancerControllerRole, AWSLoadBalancerControllerIAMPolicy, SageMakerSpacesControllerRole, SageMakerSpacesSSMManagedNodeRole).
4. Delete the certificates, schedule the KMS key for deletion (7-day minimal), and take away the Route 53 information.
5. Revert the SSM advanced-instances tier to cease per-instance prices throughout the account:

   aws ssm update-service-setting --region $REGION 
     --setting-id arn:aws:ssm:$REGION:${ACCOUNT_ID}:servicesetting/ssm/managed-instance/activation-tier 
     --setting-value commonplace

6. Delete the node group and EKS cluster, and delete the VPC in case you created it for this walkthrough.

Notice: Skipping these steps continues to incur prices for the EKS cluster, node group, EBS volumes, ALB, and every registered hybrid occasion on superior tier.

Conclusion

On this publish, you put in the SageMaker AI Areas add-on on an Amazon EKS cluster and configured browser and VS Code entry. You additionally noticed find out how to transfer your group to OIDC sign-in with Amazon Cognito. By consolidating interactive IDEs onto the cluster you already run, you handle one surroundings as a substitute of two and lower time-to-first-notebook from days to minutes.

To go additional, connect AWS WAF, federate further suppliers, cut up controller and auth middleware IAM roles, or set namespace-level useful resource quotas.

For associated approaches, see:

In regards to the authors