# Run interactive IDEs on Amazon EKS with SageMaker AI to power up your AI workflows

> Source: <https://aws.amazon.com/blogs/machine-learning/run-interactive-ides-on-amazon-eks-with-sagemaker-ai-to-power-up-your-ai-workflows/>
> Published: 2026-08-10 16:34:37+00:00

[Artificial Intelligence](/blogs/machine-learning/)

# Run interactive IDEs on Amazon EKS with SageMaker AI to power up your AI workflows

To power up AI workflows on [Amazon Elastic Kubernetes Service (Amazon EKS)](/eks/), data scientists need interactive IDEs like JupyterLab and Code Editor. Yet running those IDEs usually means leaving the cluster that hosts their pipelines, moving to a standalone JupyterHub deployment or a local laptop. That switch leaves them without the GPU nodes, shared storage, and [AWS Identity and Access Management (IAM)](/iam/) roles their pipelines depend on. The [Amazon SageMaker AI](/sagemaker/) Spaces add-on for Amazon EKS closes that gap. It runs managed JupyterLab and Code Editor environments on the cluster that you already operate. Standing up a standalone JupyterHub environment with GPU access, storage, and authentication typically takes a platform team 3–5 days. With the add-on, a data scientist launches a fully configured Space in about 5 minutes.

In this post, you install the SageMaker AI Spaces add-on on an Amazon EKS cluster. You set up the supporting add-ons and IAM roles, deploy the [AWS Load Balancer Controller](https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html), request a TLS certificate, and create an AWS Key Management System (AWS KMS) encryption key. You then create your first Space and reach it through a presigned URL in the browser and from VS Code over SSH-over-SSM. Finally, you review how to move your team to OpenID Connect (OIDC) sign-in with Amazon Cognito.

## Solution overview

The solution runs on a single EKS cluster in three layers:

**Network and access.**[Amazon Route 53](/route53/)resolves a wildcard domain to an internet-facing Application Load Balancer (ALB) with TLS from[AWS Certificate Manager (ACM)](/certificate-manager/). For VS Code,[AWS Systems Manager](/systems-manager/)tunnels directly to the Space pod.**Cluster routing.** The[AWS Load Balancer Controller](https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html)provisions the ALB. Traefik routes by hostname. Auth middleware validates tokens using[AWS Key Management Service (AWS KMS)](/kms/)for JSON Web Token (JWT) encryption.**Compute and storage.** Space pods run on private-subnet workers. The[Amazon Elastic Block Store (Amazon EBS)](/ebs/)CSI driver provides persistent volumes, and[Amazon Elastic File System (Amazon EFS)](/efs/)or[Amazon FSx](/fsx/)handle shared or high-throughput storage.[EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html)grants pods scoped IAM roles.

Consolidating interactive and training workloads on one cluster keeps GPU nodes busy between jobs. This can lift GPU utilization by up to 30 percent compared with a dedicated notebook fleet. It also avoids the cost of an always-on GPU environment, which can run into thousands of dollars a month.

## Prerequisites

To follow along, you need an AWS account with the [AWS Command Line Interface (AWS CLI)](/cli/) 2.x or later configured for your target AWS Region, plus [kubectl](https://kubernetes.io/docs/tasks/tools/) 1.30 or later and [Helm v3](https://helm.sh/docs/intro/install/). You also need a Route 53 public hosted zone for a domain you own, referenced as `<YOUR_DOMAIN>`

throughout this post, and IAM permissions to create roles, policies, EKS add-ons, access entries, Pod Identity associations, ACM certificates, and KMS keys. The Spaces add-on must be version 0.1.4 or later, because earlier versions supported Amazon SageMaker HyperPod only.

Set these variables once. The rest of the post reuses them.

Every IAM role in this post is assumed by a Kubernetes service account through EKS Pod Identity, so they all share one trust policy. Save it once and reuse it:

**Note:** This walkthrough creates resources that incur AWS charges: an internet-facing ALB, EBS volumes, and an EKS cluster. SSM advanced-instances tier adds about $0.00695/hr per Space pod. Follow the [Cleanup](#cleanup) section when you finish.

## Create the EKS cluster

Cluster creation itself follows the standard [EKS getting started guide](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html). What matters here is meeting four Spaces-specific requirements. Keep **EKS Auto Mode** disabled, because the add-on requires classic EC2-backed nodes on Kubernetes 1.30 or later. Use a virtual private cloud (VPC) with public and private subnets across at least two Availability Zones, with a NAT gateway serving the private subnets, and set cluster endpoint access to **Public and private**. During creation, add the **EKS Pod Identity Agent**, **Amazon EBS CSI Driver**, **Cert manager**, and **External DNS** add-ons, but hold off on Amazon SageMaker Spaces and the AWS Load Balancer Controller. You install those later. Finally, create a managed node group on your private subnets with Amazon Linux 2023, `m5.xlarge`

or larger, and 2 nodes. Skip ahead if you already run a cluster that fits.

One step is often overlooked. Tag every subnet in the VPC so the AWS Load Balancer Controller can discover them, and tag them *before* you install the Spaces add-on. Otherwise, the controller can place the ALB on private subnets, making Spaces unreachable.

## Set up the foundation

With the cluster running, you point kubectl at it, confirm the add-on pods are healthy, and give External DNS the Route 53 permissions that it needs to manage DNS records.

- Configure kubectl:
Both workers report

`Ready`

:

```
NAME                        STATUS   ROLES    AGE   VERSION
ip-10-0-1-42.ec2.internal   Ready    <none>   38m   v1.34.6-eks-bbe087e
ip-10-0-2-96.ec2.internal   Ready    <none>   38m   v1.34.6-eks-bbe087e
```

- Confirm the system pods are healthy across the add-on namespaces with
`kubectl get pods -A`

. Every pod in`kube-system`

,`cert-manager`

, and`external-dns`

should be`Running`

before you continue. - External DNS needs Route 53 permissions to manage records. Create the role, attach a least-privilege policy, and bind it through Pod Identity:

Security note:Scope each Pod Identity role to minimum actions and resources. Prefer explicit resource ARNs over wildcards, and confirm only the intended service account can assume the role.

## Install the AWS Load Balancer Controller

The AWS Load Balancer Controller provisions the ALB that fronts your Spaces UI. Install it with Helm.

- Define the controller’s IAM policy, role, and Pod Identity association:
- Install the Helm chart. Pass
`vpcId`

and`region`

explicitly. On chart v3.2+, the controller fails if it auto-detects the VPC through EC2 metadata, which EKS blocks for pods.Both controller replicas come up:

```
NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
aws-load-balancer-controller   2/2     2            2           174m
```

## Create the certificate, key, and SSM configuration

The Spaces add-on needs a TLS certificate, a KMS key for JWT encryption, and SSM service settings for remote access.

- Request an ACM certificate covering your domain and a wildcard, using DNS validation, then read back the CNAME records ACM expects:
Wait for the certificate status to reach

**Issued**, then copy the ARN.** Security note:**DNS validation verifies domain ownership and triggers ACM automatic renewal. Keep the validation CNAMEs in Route 53. Removing them breaks renewal. - Create a KMS encryption key. The auth middleware calls
`kms:GenerateDataKey`

per JWT, so the key must be symmetric`ENCRYPT_DECRYPT`

, which is the CLI default: - Turn on the SSM advanced-instances tier. Session Manager tunnels to hybrid managed instances, which is what VS Code remote uses, require this tier (about $0.00695/hr per Space pod):

## Install the Spaces add-on

You create IAM roles for the Spaces controller and auth middleware, then install the add-on.

- Start with the SSM managed-instance role that each Space pod uses in the SSM fleet:
- Next, create the Spaces controller role. It needs SSM, PassRole, and KMS permissions. Save the following policy as
`spaces-controller-policy.json`

, replacing`<REGION>`

,`<ACCOUNT_ID>`

, and`<KMS_KEY_ARN>`

with your own values:Create the role and attach the policy:

- Bind controller and auth middleware service accounts to this role through Pod Identity:
**Security note:** For tighter separation of duties, split this into two roles: one with SSM actions for the controller, and one with KMS encrypt and decrypt for the auth middleware. - Define
`addon-config.yaml`

with your domain, certificate ARN, key ARN, and managed-node role name: - Install the add-on:
- Poll until the add-on reaches
`ACTIVE`

(about three minutes):The add-on reports

`ACTIVE`

with an empty`issues`

list: - Confirm all Spaces pods are
`Running`

:The controller, two auth middleware replicas, and two Traefik routers should all be

`Running`

:

```
NAME                                          READY   STATUS    RESTARTS   AGE
jupyter-k8s-controller-manager-65fcd4d67f-*   1/1     Running   0          3h13m
workspace-auth-middleware-c7f7fbb6d-*         1/1     Running   0          3h13m
workspace-auth-middleware-c7f7fbb6d-*         1/1     Running   0          3h13m
workspace-traefik-router-755d494fbf-*         1/1     Running   0          3h13m
workspace-traefik-router-755d494fbf-*         1/1     Running   0          3h13m
```

## Grant user access and create a Space

With the add-on healthy, you grant a user access to the cluster and create the first JupyterLab Space. Access relies on an EKS access entry scoped to a single namespace, so users can’t reach resources outside it.

- Grant access through an EKS access entry. In the
[EKS console](https://console.aws.amazon.com/eks/), navigate to your cluster’s**Access** tab and choose**Create access entry**. Choose your IAM user or role, then add`AmazonSagemakerHyperpodSpacePolicy`

for the`default`

namespace.**Security note:** Prefer namespace-scoped access over cluster-wide policies so users can’t modify resources outside their namespace. - List the pre-installed Workspace templates and access strategies:
You see

`sagemaker-jupyter-template`

,`sagemaker-code-editor-template`

, and`hyperpod-access-strategy`

in`jupyter-k8s-system`

. Reference these in your Workspace rather than repeating configuration inline. - Define
`workspace.yaml`

for a JupyterLab Space:`accessType: OwnerOnly`

restricts browser access to the IAM principal that created the Space. Use`Public`

for any namespace-authorized user. - Apply and wait for the Space to become Available:

```
workspace.workspace.jupyter.org/my-space created
```

First-time startup takes about five minutes. The cluster pulls the 4 GB SageMaker Distribution image and registers the pod with SSM.

## Connect in the browser

The Spaces controller issues a short-lived, presigned URL that carries the user’s encrypted token. You generate one, then navigate to it in your browser.

- Generate a short-lived presigned URL:
Find

`status.workspaceConnectionUrl`

in the response and navigate to the URL in your browser:**Security note:** Presigned URLs carry the user’s KMS-encrypted JWT with a 5-minute expiry enforced by the`exp`

claim. This value isn’t configurable in the current add-on version. Don’t log or share presigned URLs over unencrypted channels. For durable access, use VS Code remote.

## Connect from VS Code

For a local IDE experience, VS Code connects to the Space pod through an SSM tunnel, with no browser, domain, or ALB required.

- Install
[VS Code](https://code.visualstudio.com/), the[AWS Toolkit extension](https://marketplace.visualstudio.com/items?itemName=AmazonWebServices.aws-toolkit-vscode), and the[Session Manager plugin](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin.html)locally. - Generate a VS Code connection URL by creating the same WorkspaceConnection resource as before, with
`workspaceConnectionType: vscode-remote`

instead of`web-ui`

. This time the response carries a`vscode://`

deep link instead of an HTTPS URL: - Paste the
`vscode://`

URL into your browser. The browser prompts you to open the link in VS Code. - Accept the prompt. AWS Toolkit establishes an SSH-over-SSM tunnel to the Space, and VS Code attaches to the remote filesystem.

For private-subnet configurations and SDK alternatives, see [Remote access to SageMaker AI Spaces](https://docs.aws.amazon.com/sagemaker/latest/dg/vscode-access.html).

## Sign in with corporate credentials using OIDC

Access so far relies on IAM users and roles. To let your team sign in with corporate credentials instead, register an OIDC provider with the cluster and bind Kubernetes role-based access control (RBAC) to identity provider groups. Kubernetes then authorizes people by group membership, with no IAM principal per user.

The open source [jupyter-deploy](https://jupyter-deploy.readthedocs.io/en/latest/templates/aws-eks-oidc-template/index.html) project ships an `aws-eks-oidc`

template that sets this up for you. [Dex](https://dexidp.io/) runs in the cluster as the OIDC provider, Amazon EKS trusts it as an identity provider, and a web console gives your team self-service workspace management. The template provisions its own VPC and cluster, so run it alongside the cluster from this post.

The template ships a Dex connector for GitHub. Amazon Cognito works through the generic `oidc`

connector in Dex instead, and needs two claim mappings that GitHub never requires. Amazon EKS reads the username from the `preferred_username`

claim, which Cognito doesn’t issue, so map it from `email`

. Cognito also publishes group membership as `cognito:groups`

rather than `groups`

. Miss the username mapping and requests reach the API server with no resolvable user, and the console reports an expired session rather than an authorization error. The template binds its RBAC role to a group named `<org>:<team>`

, so create a Cognito group with that exact name and add your users to it.

Your team then signs in at the Cognito managed login page. With a single connector configured, Dex skips the provider chooser.

The console lists and creates workspaces under that identity.

Opening one launches JupyterLab, authorized as the Cognito user.

## Cleanup

To avoid ongoing charges, delete resources in reverse order.

- Delete the Space and the add-on:
- Uninstall the Load Balancer Controller and remaining add-ons:
- Delete the IAM roles, policies, and Pod Identity associations you created (
`ExternalDNSRole`

,`AWSLoadBalancerControllerRole`

,`AWSLoadBalancerControllerIAMPolicy`

,`SageMakerSpacesControllerRole`

,`SageMakerSpacesSSMManagedNodeRole`

). - Delete the certificate, schedule the KMS key for deletion (7-day minimum), and remove the Route 53 records.
- Revert the SSM advanced-instances tier to stop per-instance charges across the account:
- Delete the node group and EKS cluster, and delete the VPC if you created it for this walkthrough.

**Note:** Skipping these steps continues to incur charges for the EKS cluster, node group, EBS volumes, ALB, and each registered hybrid instance on advanced tier.

## Conclusion

In this post, you installed the SageMaker AI Spaces add-on on an Amazon EKS cluster and configured browser and VS Code access. You also saw how to move your team to OIDC sign-in with Amazon Cognito. By consolidating interactive IDEs onto the cluster you already run, you manage one environment instead of two and cut time-to-first-notebook from days to minutes.

To go further, attach AWS WAF, federate additional providers, split controller and auth middleware IAM roles, or set namespace-level resource quotas.

For related approaches, see:

[Power up your ML workflows with interactive IDEs on SageMaker HyperPod](/blogs/machine-learning/power-up-your-ml-workflows-with-interactive-ides-on-sagemaker-hyperpod/).[Accelerate foundation model training and inference with Amazon SageMaker HyperPod and Amazon SageMaker Studio](/blogs/machine-learning/accelerate-foundation-model-training-and-inference-with-amazon-sagemaker-hyperpod-and-amazon-sagemaker-studio/).