AWS sagemaker documentation change
Summary
Updated documentation to expand remote IDE support beyond VS Code to include Kiro, added explicit note that Cursor is not supported in private subnets without internet access, and added specific configuration instructions for Kiro proxy settings including MCP server configuration.
Security assessment
The changes update documentation for secure remote access configurations in isolated VPC environments. The documentation now covers additional IDEs (Kiro) and provides specific proxy configuration details for secure connectivity. The changes emphasize controlled allow-listing and proper proxy configuration for secure access to Studio spaces in private subnets without internet access, which are security best practices for network isolation.
Diff
diff --git a/sagemaker/latest/dg/remote-access-local-ide-setup-vpc-no-internet.md b/sagemaker/latest/dg/remote-access-local-ide-setup-vpc-no-internet.md index 4dc669d52..2ee1509bc 100644 --- a//sagemaker/latest/dg/remote-access-local-ide-setup-vpc-no-internet.md +++ b//sagemaker/latest/dg/remote-access-local-ide-setup-vpc-no-internet.md @@ -5 +5 @@ -HTTP Proxy with controlled allow-listingPre-packaged VS Code remote server and extensions +HTTP Proxy with controlled allow-listingPre-packaged remote server and extensions (VS Code only) @@ -9 +9 @@ HTTP Proxy with controlled allow-listingPre-packaged VS Code remote server and e -Before connecting Visual Studio Code to Studio spaces in private subnets without internet access, ensure your administrator has [Set up Studio to run with subnets without internet access within a VPC](./remote-access-remote-setup-vpc-subnets-without-internet-access.html). +Before connecting your Remote IDE to Studio spaces in private subnets without internet access, ensure your administrator has [Set up Studio to run with subnets without internet access within a VPC](./remote-access-remote-setup-vpc-subnets-without-internet-access.html). @@ -11 +11 @@ Before connecting Visual Studio Code to Studio spaces in private subnets without -You have two options to connect your local Visual Studio Code to Studio spaces in private subnets: +You have the following options to connect your Remote IDE to Studio spaces in private subnets: @@ -13 +13 @@ You have two options to connect your local Visual Studio Code to Studio spaces i - * Set up HTTP Proxy + * Set up HTTP Proxy (supported for VS Code and Kiro) @@ -15 +15 @@ You have two options to connect your local Visual Studio Code to Studio spaces i - * Pre-packaged VS Code remote server and extensions + * Pre-packaged remote server and extensions (VS Code only) @@ -19,0 +20,4 @@ You have two options to connect your local Visual Studio Code to Studio spaces i +###### Important + +Cursor is not supported for connecting to Studio spaces in private subnets without outbound internet access. + @@ -24 +28 @@ You have two options to connect your local Visual Studio Code to Studio spaces i - * Pre-packaged VS Code remote server and extensions + * Pre-packaged remote server and extensions (VS Code only) @@ -31 +35,4 @@ You have two options to connect your local Visual Studio Code to Studio spaces i -When your Studio space is behind a firewall or proxy, ask your administrator to allow access to VS Code server and extension-related CDNs and endpoints. For more information, see [Set up HTTP Proxy with controlled allow-listing](./remote-access-remote-setup-vpc-subnets-without-internet-access.html#remote-access-remote-setup-vpc-subnets-without-internet-access-setup-http-proxy-with-controlled-allow-listing). +When your Studio space is behind a firewall or proxy, ask your administrator to allow access to your IDE server and extension-related CDNs and endpoints. For more information, see [Set up HTTP Proxy with controlled allow-listing](./remote-access-remote-setup-vpc-subnets-without-internet-access.html#remote-access-remote-setup-vpc-subnets-without-internet-access-setup-http-proxy-with-controlled-allow-listing). + +VS Code + @@ -33 +40 @@ When your Studio space is behind a firewall or proxy, ask your administrator to -Once set up, you can configure the HTTP proxy for VS Code remote development by providing the proxy URL with the `remote.SSH.httpProxy` or `remote.SSH.httpsProxy` setting. +Configure the HTTP proxy for VS Code remote development by providing the proxy URL with the `remote.SSH.httpProxy` or `remote.SSH.httpsProxy` setting. @@ -37 +44,14 @@ Once set up, you can configure the HTTP proxy for VS Code remote development by -Consider enabling “Remote.SSH: Use Curl And Wget Configuration Files” to use the configuration from the remote environment’s `curlrc` and `wgetrc` files. This is so that the `curlrc` and `wgetrc` files, placed in their respective default locations in the SageMaker space, can be used for enabling certain cases. +Consider enabling "Remote.SSH: Use Curl And Wget Configuration Files" to use the configuration from the remote environment’s `curlrc` and `wgetrc` files. This is so that the `curlrc` and `wgetrc` files, placed in their respective default locations in the SageMaker space, can be used for enabling certain cases. + +Kiro + + +Configure the HTTP proxy for Kiro remote development by setting the `aws.sagemaker.ssh.kiro.httpsProxy` setting to your HTTP or HTTPS proxy endpoint. + +If you use MCP (Model Context Protocol) servers in Kiro, you also need to add the proxy environment variables to your MCP server configuration: + + + "env": { + "http_proxy": "${http_proxy}", + "https_proxy": "${https_proxy}" + } @@ -41 +61,5 @@ This option works when you are allowed to set up HTTP proxy and lets you install -## Pre-packaged VS Code remote server and extensions +## Pre-packaged remote server and extensions (VS Code only) + +###### Note + +This option is only available for Visual Studio Code. Kiro and Cursor do not support pre-packaged remote server setup. @@ -43 +67 @@ This option works when you are allowed to set up HTTP proxy and lets you install -When your Studio spaces can’t access external endpoints to download VS Code remote server and extensions, you can pre-package them. With this approach, your administrator can export a tarball containing the `.VS Code-server` directory for a specific version of VS Code. Then, the administrator uses a SageMaker AI Lifecycle Configuration (LCC) script to copy and extract the tarball into your home directory (`/home/sagemaker-user`). For more information, see [Set up Pre-packaged Visual Studio Code remote server and extensions](./remote-access-remote-setup-vpc-subnets-without-internet-access.html#remote-access-remote-setup-vpc-subnets-without-internet-access-setup-pre-packaged-vs-code-remote-server-and-extensions). +When your Studio spaces can’t access external endpoints to download VS Code remote server and extensions, you can pre-package them. With this approach, your administrator can export a tarball containing the `.VS Code-server` directory for a specific version of VS Code. Then, the administrator uses a SageMaker AI Lifecycle Configuration (LCC) script to copy and extract the tarball into your home directory (`/home/sagemaker-user`). For more information, see [Set up Pre-packaged remote server and extensions (VS Code only)](./remote-access-remote-setup-vpc-subnets-without-internet-access.html#remote-access-remote-setup-vpc-subnets-without-internet-access-setup-pre-packaged-vs-code-remote-server-and-extensions). @@ -176 +200 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Set up local Visual Studio Code +Set up Remote IDE