feat(ai-gateway): Sagemaker support

app/_ai_gateway_entities/ai-provider.md

@@ -94,6 +94,7 @@ When configuring an [AI Model](/ai-gateway/entities/ai-model/), you reference an
 {% icon_card icon="databricks.svg" title="Databricks" cta_url="/ai-gateway/ai-providers/databricks/" %}
 {% icon_card icon="vercel.svg" title="Vercel" cta_url="/ai-gateway/ai-providers/vercel/" %}
 {% icon_card icon="vllm.svg" title="vLLM" cta_url="/ai-gateway/ai-providers/vllm/" %}
+{% icon_card icon="sagemaker.svg" title="AWS SageMaker" cta_url="/ai-gateway/ai-providers/sagemaker/" %}
 {% endhtml_tag %}
 
 ## Outbound authentication

app/_data/ai-gateway/v2/providers.yaml

@@ -1561,3 +1561,79 @@ providers:
     limitations:
       provider_specific: []
       statistics_logging: []
+  - name: Amazon SageMaker
+    url_patterns:
+      - 'https://runtime.sagemaker.{region}.amazonaws.com'
+    min_version: '2.0'
+    capabilities:
+      generate:
+        supported: true
+        streaming: true
+        paths:
+          - '/chat/completions'
+        upstream_path: '`/endpoints/{endpoint_name}/invocations` (or `/endpoints/{endpoint_name}/invocations-response-stream` for streaming)'
+        model_example: 'User-defined (the name of your SageMaker endpoint)'
+        min_version: '2.0'
+      completions:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      embeddings:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      files:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      batches:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      agentic:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      audio_speech:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      audio_transcription:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      audio_translation:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      image:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      video:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      realtime:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+      rerank:
+        supported: false
+        streaming: false
+        model_example: ''
+        min_version: ''
+    limitations:
+      provider_specific: []
+      statistics_logging: []

app/_includes/md/ai-gateway/v2/aws-auth.md

@@ -0,0 +1,11 @@
+## Authentication with AWS
+
+For {{ provider.name }}, you can also set `auth` to `aws`. Provide static IAM user credentials with `access_key_id` and `secret_access_key`, or omit them to fall back to the default AWS credentials provider chain (EC2 instance profiles, environment variables, and so on). For cross-account access, assume a role with `assume_role_arn` and `role_session_name`.
+
+See [Outbound authentication](/ai-gateway/entities/ai-model-provider/#outbound-authentication) on the AI Model Provider entity page for the full list of `auth` fields, including `sts_endpoint_url` and the Bedrock-specific `batch_role_arn`.
+
+{:.info}
+> **AWS Session tokens**
+>
+> There's no dedicated field for an AWS session token.
+> For temporary credentials, set `config.auth.assume_role_arn` and `config.auth.role_session_name` to assume a role through AWS STS, or leave `config.auth.access_key_id` and `config.auth.secret_access_key` unset to fall back to environment variables or an instance or task IAM role.

app/_includes/md/ai-gateway/v2/providers.md

@@ -1,6 +1,24 @@
 <!--vale off-->
 {%- assign provider = include.providers.providers | where: "name", include.provider_name | first -%}
 {% if provider %}
+{%- assign default_generate_paths = "/chat/completions|/completions|/responses" | split: "|" -%}
+{%- assign generate_paths = provider.capabilities.generate.paths -%}
+{%- if generate_paths == nil or generate_paths == empty -%}
+  {%- assign generate_paths = default_generate_paths -%}
+{%- endif -%}
+{%- assign generate_paths_size = generate_paths.size -%}
+{%- assign generate_paths_display = "" -%}
+{%- for p in generate_paths -%}
+  {%- if forloop.first -%}
+    {%- assign generate_paths_display = "`" | append: p | append: "`" -%}
+  {%- elsif forloop.last and generate_paths_size > 2 -%}
+    {%- assign generate_paths_display = generate_paths_display | append: ", or `" | append: p | append: "`" -%}
+  {%- elsif forloop.last -%}
+    {%- assign generate_paths_display = generate_paths_display | append: " or `" | append: p | append: "`" -%}
+  {%- else -%}
+    {%- assign generate_paths_display = generate_paths_display | append: ", `" | append: p | append: "`" -%}
+  {%- endif -%}
+{%- endfor -%}
 You can proxy requests to {{ provider.name }} AI models through {{site.ai_gateway}} by creating [AI Model Provider](/ai-gateway/entities/ai-model-provider/) and [AI Model](/ai-gateway/entities/ai-model/) entities. This reference documents all supported AI capabilities, configuration requirements, and provider-specific details needed for proper integration.
 
 ## Upstream paths
@@ -21,7 +39,7 @@ columns:
 rows:
 {% if provider.capabilities.generate.supported %}
   - capability: "{% if page.output_format == 'markdown' %}Generate{% else %}[Generate](#text-generation){% endif %}"
-    path_template: "`/chat/completions`, `/completions`, or `/responses`"
+    path_template: "{{ generate_paths_display }}"
     description: "Text generation for chat completions and responses"
     upstream_path: "{{ provider.capabilities.generate.upstream_path }}"
 {% endif %}
@@ -158,7 +176,7 @@ rows:
   - capability: "generate{% if generate_note_num != 0 %}<sup>{{ generate_note_num }}</sup>{% endif %}"
     streaming: {{ provider.capabilities.generate.streaming  }}
     model_example: "{{ provider.capabilities.generate.model_example }}"
-    path_template: "`/chat/completions`, `/completions`, or `/responses`"
+    path_template: "{{ generate_paths_display }}"
     min_version: "{{ provider.capabilities.generate.min_version }}"
 {% endif %}
 {% endtable %}

app/_landing_pages/ai-gateway/ai-providers.yaml

@@ -54,6 +54,13 @@ rows:
             icon: /assets/icons/bedrock.svg
             cta:
               url: /ai-gateway/ai-providers/bedrock/
+      - blocks:
+        - type: icon_card
+          config:
+            title: Amazon SageMaker
+            icon: /assets/icons/sagemaker.svg
+            cta:
+              url: /ai-gateway/ai-providers/sagemaker/
       - blocks:
         - type: icon_card
           config:

app/ai-gateway/ai-providers/bedrock.md

@@ -18,6 +18,7 @@ products:
 tools:
   - konnect-api
   - kongctl
+  - kongctl
 
 tags:
   - ai

app/ai-gateway/ai-providers/sagemaker.md

@@ -0,0 +1,127 @@
+---
+title: "Amazon SageMaker provider"
+layout: reference
+content_type: reference
+description: Reference for supported capabilities for Amazon SageMaker provider
+breadcrumbs:
+  - /ai-gateway/
+  - /ai-gateway/ai-providers/
+
+permalink: /ai-gateway/ai-providers/sagemaker/
+
+works_on:
+ - konnect
+
+products:
+  - ai-gateway
+
+tools:
+  - konnect-api
+  - kongctl
+
+tags:
+  - ai
+
+min_version:
+  ai-gateway: '2.0'
+
+related_resources:
+  - text: "{{site.ai_gateway}}"
+    url: /ai-gateway/
+  - text: "{{site.ai_gateway}} Policies"
+    url: /ai-gateway/policies/
+  - text: AI Providers
+    url: /ai-gateway/ai-providers/
+  - text: AI Model Provider entity
+    url: /ai-gateway/entities/ai-model-provider/
+  - text: AI Model entity
+    url: /ai-gateway/entities/ai-model/
+
+---
+
+
+{% include md/ai-gateway/v2/providers.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon SageMaker" %}
+
+{% include md/ai-gateway/v2/native-routes.md providers=site.data.ai-gateway.v2.providers provider_name="Amazon SageMaker" %}
+
+## Configure {{ provider.name }}
+
+To use {{ provider.name }} with {{site.ai_gateway}}, configure a new [AI Model Provider](/ai-gateway/entities/ai-model-provider/). You can then access supported [AI Models](/ai-gateway/entities/ai-model/) from {{ provider.name }}.
+
+Here's a minimal configuration for chat completions:
+
+{% entity_example %}
+type: model-provider
+data:
+  display_name: SageMaker Production
+  name: my-sagemaker-account
+  type: sagemaker
+  config:
+    auth:
+      type: sagemaker
+      aws:
+        access_key_id: ${key_id}
+        secret_access_key: ${access_key}
+variables:
+  key_id:
+    value: $AWS_ACCESS_KEY_ID
+    description: Your AWS access key ID.
+  access_key:
+    value: $AWS_SECRET_ACCESS_KEY
+    description: Your AWS secret access key.
+{% endentity_example %}
+
+## Authentication with AWS
+
+For {{ provider.name }}, set `auth` to `sagemaker` and provide static IAM user credentials under `aws`, or omit them to fall back to the default AWS credentials provider chain (EC2 instance profiles, environment variables, and so on):
+
+* **`access_key_id`** (optional): AWS access key ID for static IAM user credentials. Overrides the `AWS_ACCESS_KEY_ID` environment variable.
+* **`secret_access_key`** (optional): AWS secret access key paired with `access_key_id`. Overrides the `AWS_SECRET_ACCESS_KEY` environment variable.
+* **`session_token`** (optional): AWS session token for temporary credentials. Overrides the `AWS_SESSION_TOKEN` environment variable.
+
+{{ provider.name }} can also use `basic` auth instead. See [Outbound authentication](/ai-gateway/entities/ai-model-provider/#outbound-authentication) on the AI Model Provider entity page for the full list of `auth` types.
+
+## Configure a model target for {{ provider.name }}
+
+Only the `generate` capability is supported for {{ provider.name }} targets.
+
+A [target](/ai-gateway/entities/ai-model/#targets) is an entry in the `targets` array on the AI Model entity, not the AI Model Provider. The target `name` is the name of your SageMaker endpoint. Beyond the common target options (`name`, `provider`, `weight`), a target routing to {{ provider.name }} supports these `config` fields, grouped under `aws` and `target`:
+
+{% table %}
+columns:
+  - title: Field
+    key: field
+  - title: Description
+    key: description
+rows:
+  - field: "`aws.region`"
+    description: "The AWS region hosting the SageMaker endpoint. Overrides the `AWS_REGION` environment variable."
+  - field: "`aws.assume_role_arn`"
+    description: "IAM role ARN to assume for temporary credentials. Requires `aws.role_session_name`."
+  - field: "`aws.role_session_name`"
+    description: "Session name for the assumed role. Required if `aws.assume_role_arn` is set."
+  - field: "`aws.sts_endpoint_url`"
+    description: "Custom STS endpoint used when assuming a role."
+  - field: "`target.model`"
+    description: "The model artifact to invoke on a multi-model endpoint. Sets the `X-Amzn-SageMaker-Target-Model` header."
+  - field: "`target.variant`"
+    description: "The production variant to invoke on a multi-variant endpoint. Sets the `X-Amzn-SageMaker-Target-Variant` header."
+  - field: "`target.container_hostname`"
+    description: "The container hostname to invoke on a multi-container endpoint. Sets the `X-Amzn-SageMaker-Target-Container-Hostname` header."
+{% endtable %}
+
+All fields in this table are optional.
+
+```yaml
+targets:
+  - name: my-sagemaker-endpoint
+    provider: my-sagemaker-account
+    config:
+      type: sagemaker
+      aws:
+        region: us-east-1
+      target:
+        model: my-model.tar.gz
+        variant: production-variant-1
+        container_hostname: container-1
+```