diff --git a/app/_ai_gateway_entities/ai-provider.md b/app/_ai_gateway_entities/ai-provider.md
index 78cfdf74ee4..a9a84a2877c 100644
--- a/app/_ai_gateway_entities/ai-provider.md
+++ b/app/_ai_gateway_entities/ai-provider.md
@@ -94,6 +94,7 @@ When configuring an [AI Model](/ai-gateway/entities/ai-model/), you reference an
{% icon_card icon="databricks.svg" title="Databricks" cta_url="/ai-gateway/ai-providers/databricks/" %}
{% icon_card icon="vercel.svg" title="Vercel" cta_url="/ai-gateway/ai-providers/vercel/" %}
{% icon_card icon="vllm.svg" title="vLLM" cta_url="/ai-gateway/ai-providers/vllm/" %}
+{% icon_card icon="sagemaker.svg" title="AWS SageMaker" cta_url="/ai-gateway/ai-providers/sagemaker/" %}
{% endhtml_tag %}
## Outbound authentication
diff --git a/app/_data/ai-gateway/v2/providers.yaml b/app/_data/ai-gateway/v2/providers.yaml
index 7945a3e4278..bd8aa82cb66 100644
--- a/app/_data/ai-gateway/v2/providers.yaml
+++ b/app/_data/ai-gateway/v2/providers.yaml
@@ -1561,3 +1561,79 @@ providers:
limitations:
provider_specific: []
statistics_logging: []
+ - name: Amazon SageMaker
+ url_patterns:
+ - 'https://runtime.sagemaker.{region}.amazonaws.com'
+ min_version: '2.0'
+ capabilities:
+ generate:
+ supported: true
+ streaming: true
+ paths:
+ - '/chat/completions'
+ upstream_path: '`/endpoints/{endpoint_name}/invocations` (or `/endpoints/{endpoint_name}/invocations-response-stream` for streaming)'
+ model_example: 'User-defined (the name of your SageMaker endpoint)'
+ min_version: '2.0'
+ completions:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ embeddings:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ files:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ batches:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ agentic:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ audio_speech:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ audio_transcription:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ audio_translation:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ image:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ video:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ realtime:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ rerank:
+ supported: false
+ streaming: false
+ model_example: ''
+ min_version: ''
+ limitations:
+ provider_specific: []
+ statistics_logging: []
diff --git a/app/_includes/md/ai-gateway/v2/aws-auth.md b/app/_includes/md/ai-gateway/v2/aws-auth.md
new file mode 100644
index 00000000000..7dff554c642
--- /dev/null
+++ b/app/_includes/md/ai-gateway/v2/aws-auth.md
@@ -0,0 +1,11 @@
+## Authentication with AWS
+
+For {{ provider.name }}, you can also set `auth` to `aws`. Provide static IAM user credentials with `access_key_id` and `secret_access_key`, or omit them to fall back to the default AWS credentials provider chain (EC2 instance profiles, environment variables, and so on). For cross-account access, assume a role with `assume_role_arn` and `role_session_name`.
+
+See [Outbound authentication](/ai-gateway/entities/ai-model-provider/#outbound-authentication) on the AI Model Provider entity page for the full list of `auth` fields, including `sts_endpoint_url` and the Bedrock-specific `batch_role_arn`.
+
+{:.info}
+> **AWS Session tokens**
+>
+> There's no dedicated field for an AWS session token.
+> For temporary credentials, set `config.auth.assume_role_arn` and `config.auth.role_session_name` to assume a role through AWS STS, or leave `config.auth.access_key_id` and `config.auth.secret_access_key` unset to fall back to environment variables or an instance or task IAM role.
diff --git a/app/_includes/md/ai-gateway/v2/providers.md b/app/_includes/md/ai-gateway/v2/providers.md
index 2ec68a52705..ea55ebdc406 100644
--- a/app/_includes/md/ai-gateway/v2/providers.md
+++ b/app/_includes/md/ai-gateway/v2/providers.md
@@ -1,6 +1,24 @@
{%- assign provider = include.providers.providers | where: "name", include.provider_name | first -%}
{% if provider %}
+{%- assign default_generate_paths = "/chat/completions|/completions|/responses" | split: "|" -%}
+{%- assign generate_paths = provider.capabilities.generate.paths -%}
+{%- if generate_paths == nil or generate_paths == empty -%}
+ {%- assign generate_paths = default_generate_paths -%}
+{%- endif -%}
+{%- assign generate_paths_size = generate_paths.size -%}
+{%- assign generate_paths_display = "" -%}
+{%- for p in generate_paths -%}
+ {%- if forloop.first -%}
+ {%- assign generate_paths_display = "`" | append: p | append: "`" -%}
+ {%- elsif forloop.last and generate_paths_size > 2 -%}
+ {%- assign generate_paths_display = generate_paths_display | append: ", or `" | append: p | append: "`" -%}
+ {%- elsif forloop.last -%}
+ {%- assign generate_paths_display = generate_paths_display | append: " or `" | append: p | append: "`" -%}
+ {%- else -%}
+ {%- assign generate_paths_display = generate_paths_display | append: ", `" | append: p | append: "`" -%}
+ {%- endif -%}
+{%- endfor -%}
You can proxy requests to {{ provider.name }} AI models through {{site.ai_gateway}} by creating [AI Model Provider](/ai-gateway/entities/ai-model-provider/) and [AI Model](/ai-gateway/entities/ai-model/) entities. This reference documents all supported AI capabilities, configuration requirements, and provider-specific details needed for proper integration.
## Upstream paths
@@ -21,7 +39,7 @@ columns:
rows:
{% if provider.capabilities.generate.supported %}
- capability: "{% if page.output_format == 'markdown' %}Generate{% else %}[Generate](#text-generation){% endif %}"
- path_template: "`/chat/completions`, `/completions`, or `/responses`"
+ path_template: "{{ generate_paths_display }}"
description: "Text generation for chat completions and responses"
upstream_path: "{{ provider.capabilities.generate.upstream_path }}"
{% endif %}
@@ -158,7 +176,7 @@ rows:
- capability: "generate{% if generate_note_num != 0 %}{{ generate_note_num }}{% endif %}"
streaming: {{ provider.capabilities.generate.streaming }}
model_example: "{{ provider.capabilities.generate.model_example }}"
- path_template: "`/chat/completions`, `/completions`, or `/responses`"
+ path_template: "{{ generate_paths_display }}"
min_version: "{{ provider.capabilities.generate.min_version }}"
{% endif %}
{% endtable %}
diff --git a/app/_landing_pages/ai-gateway/ai-providers.yaml b/app/_landing_pages/ai-gateway/ai-providers.yaml
index 070a95eace4..5d2de881bd7 100644
--- a/app/_landing_pages/ai-gateway/ai-providers.yaml
+++ b/app/_landing_pages/ai-gateway/ai-providers.yaml
@@ -54,6 +54,13 @@ rows:
icon: /assets/icons/bedrock.svg
cta:
url: /ai-gateway/ai-providers/bedrock/
+ - blocks:
+ - type: icon_card
+ config:
+ title: Amazon SageMaker
+ icon: /assets/icons/sagemaker.svg
+ cta:
+ url: /ai-gateway/ai-providers/sagemaker/
- blocks:
- type: icon_card
config:
diff --git a/app/ai-gateway/ai-providers/bedrock.md b/app/ai-gateway/ai-providers/bedrock.md
index 5dd2ddcc5ab..1d5ff82e14a 100644
--- a/app/ai-gateway/ai-providers/bedrock.md
+++ b/app/ai-gateway/ai-providers/bedrock.md
@@ -18,6 +18,7 @@ products:
tools:
- konnect-api
- kongctl
+ - kongctl
tags:
- ai
diff --git a/app/ai-gateway/ai-providers/sagemaker.md b/app/ai-gateway/ai-providers/sagemaker.md
new file mode 100644
index 00000000000..929bd2bc146
--- /dev/null
+++ b/app/ai-gateway/ai-providers/sagemaker.md
@@ -0,0 +1,128 @@
+---
+title: "Amazon SageMaker provider"
+layout: reference
+content_type: reference
+description: Reference for supported capabilities for Amazon SageMaker provider
+breadcrumbs:
+ - /ai-gateway/
+ - /ai-gateway/ai-providers/
+
+permalink: /ai-gateway/ai-providers/sagemaker/
+
+works_on:
+ - konnect
+
+products:
+ - ai-gateway
+
+tools:
+ - konnect-api
+ - kongctl
+
+tags:
+ - ai
+
+min_version:
+ ai-gateway: '2.0'
+
+related_resources:
+ - text: "{{site.ai_gateway}}"
+ url: /ai-gateway/
+ - text: "{{site.ai_gateway}} Policies"
+ url: /ai-gateway/policies/
+ - text: AI Providers
+ url: /ai-gateway/ai-providers/
+ - text: AI Model Provider entity
+ url: /ai-gateway/entities/ai-model-provider/
+ - text: AI Model entity
+ url: /ai-gateway/entities/ai-model/
+
+---
+
+
+{% include md/ai-gateway/v2/providers.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon SageMaker" %}
+
+{% include md/ai-gateway/v2/native-routes.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon SageMaker" %}
+
+## Configure {{ provider.name }}
+
+To use {{ provider.name }} with {{site.ai_gateway}}, configure a new [AI Model Provider](/ai-gateway/entities/ai-model-provider/). You can then access supported [AI Models](/ai-gateway/entities/ai-model/) from {{ provider.name }}.
+
+Here's a minimal configuration for chat completions:
+
+{% entity_example %}
+type: model-provider
+data:
+ display_name: SageMaker Production
+ name: my-sagemaker-account
+ type: sagemaker
+ config:
+ auth:
+ type: sagemaker
+ aws:
+ access_key_id: ${key_id}
+ secret_access_key: ${access_key}
+variables:
+ key_id:
+ value: $AWS_ACCESS_KEY_ID
+ description: Your AWS access key ID.
+ access_key:
+ value: $AWS_SECRET_ACCESS_KEY
+ description: Your AWS secret access key.
+{% endentity_example %}
+
+## Authentication with AWS
+
+For {{ provider.name }}, set `auth` to `sagemaker` and provide static IAM user credentials under `aws`, or omit them to fall back to the default AWS credentials provider chain (EC2 instance profiles, environment variables, and so on):
+
+* **`access_key_id`** (optional): AWS access key ID for static IAM user credentials. Overrides the `AWS_ACCESS_KEY_ID` environment variable.
+* **`secret_access_key`** (optional): AWS secret access key paired with `access_key_id`. Overrides the `AWS_SECRET_ACCESS_KEY` environment variable.
+* **`session_token`** (optional): AWS session token for temporary credentials. Overrides the `AWS_SESSION_TOKEN` environment variable.
+
+{{ provider.name }} can also use `basic` auth instead. See [Outbound authentication](/ai-gateway/entities/ai-model-provider/#outbound-authentication) on the AI Model Provider entity page for the full list of `auth` types.
+
+## Configure a model target for {{ provider.name }}
+
+{:.info}
+> Only the `generate` capability is supported for {{ provider.name }} targets.
+
+A [target](/ai-gateway/entities/ai-model/#targets) is an entry in the `targets` array on the AI Model entity, not the AI Model Provider. The target `name` is the name of your SageMaker endpoint. Beyond the common target options (`name`, `provider`, `weight`), a target routing to {{ provider.name }} supports these `config` fields, grouped under `aws` and `target`:
+
+{% table %}
+columns:
+ - title: Field
+ key: field
+ - title: Description
+ key: description
+rows:
+ - field: "`aws.region`"
+ description: "The AWS region hosting the SageMaker endpoint. Overrides the `AWS_REGION` environment variable."
+ - field: "`aws.assume_role_arn`"
+ description: "IAM role ARN to assume for temporary credentials. Requires `aws.role_session_name`."
+ - field: "`aws.role_session_name`"
+ description: "Session name for the assumed role. Required if `aws.assume_role_arn` is set."
+ - field: "`aws.sts_endpoint_url`"
+ description: "Custom STS endpoint used when assuming a role."
+ - field: "`target.model`"
+ description: "The model artifact to invoke on a multi-model endpoint. Sets the `X-Amzn-SageMaker-Target-Model` header."
+ - field: "`target.variant`"
+ description: "The production variant to invoke on a multi-variant endpoint. Sets the `X-Amzn-SageMaker-Target-Variant` header."
+ - field: "`target.container_hostname`"
+ description: "The container hostname to invoke on a multi-container endpoint. Sets the `X-Amzn-SageMaker-Target-Container-Hostname` header."
+{% endtable %}
+
+The following target routes to a SageMaker endpoint in `us-east-1` and selects a specific model, variant, and container on a multi-model endpoint:
+
+```yaml
+targets:
+ - name: my-sagemaker-endpoint
+ provider: my-sagemaker-account
+ config:
+ type: sagemaker
+ aws:
+ region: us-east-1
+ target:
+ model: my-model.tar.gz
+ variant: production-variant-1
+ container_hostname: container-1
+```
diff --git a/app/assets/icons/sagemaker.svg b/app/assets/icons/sagemaker.svg
new file mode 100644
index 00000000000..542ea19dd3c
--- /dev/null
+++ b/app/assets/icons/sagemaker.svg
@@ -0,0 +1,18 @@
+
+
\ No newline at end of file