How do I resolve the error "Connect timeout on endpoint URL" on a SageMaker AI notebook instance?

Resolution

To connect to AWS services, your notebook instance's subnet must have an Amazon Virtual Private Cloud (Amazon VPC) endpoint for the service that you connect to. Or, the subnet must have access to the internet. You can also turn on direct internet access for your notebook instance.

If your notebook instance already has internet access through a private subnet or a VPC endpoint, then review your security group and network access control list (ACL) rules.

Add a VPC endpoint for an AWS service to the notebook instance's subnet

Many AWS services offer either an interface endpoint or gateway endpoint. If the AWS service that you're connecting to doesn't offer an endpoint, then you must create a new notebook instance to add a VPC endpoint.

Create a new notebook instance

With direct internet access

The default option is to create a new notebook instance with direct internet access, even when you create the notebook instance in a VPC.

SageMaker AI provides a network interface that allows the notebook to communicate with the internet through a SageMaker AI managed VPC. For more information, see Understanding Amazon SageMaker AI notebook instance networking configurations and advanced routing options.

Without direct internet access

Add a NAT gateway to the subnet. The NAT gateway allows traffic to reach the public endpoint for the service that you're connecting to.

Related information

Connect a notebook instance in a VPC to external resources

AWS PrivateLink concepts