Configure domain-level VPC networking in Amazon SageMaker Unified Studio

# Why set VPC networking at the domain level Configuring VPC networking per project leads to inconsistent subnet choices, missing endpoints, connectivity failures that are hard to troubleshoot, and an environment that's difficult to audit. Domain-level VPC networking centralizes network settings so new projects get the right private networking automatically.

# What this approach gives you

• Configure once, apply consistently to new projects. New projects inherit subnets, security groups, and endpoints without network-team intervention.
• Simpler auditing: one VPC to review with VPC Flow Logs and CloudTrail events.
• Reduced operational overhead: project teams can start work without individual networking requests.

# Core requirements and recommended minimums

• VPC in the same AWS Region as the SageMaker Unified Studio domain.
• At least two private subnets in different Availability Zones for multi-AZ resilience.
• DNS hostnames and DNS support enabled for the VPC.

• VPC endpoints for AWS services your projects access (for example, S3, AWS Glue, SageMaker AI) and Private DNS enabled on interface endpoints so service DNS resolves to private IPs.

• The domain administrator must have the SageMakerStudioAdminIAMConsolePolicy managed policy or equivalent permissions (including ec2:Describe, ec2:CreateSecurityGroup, and datazone: where applicable).

# How the solution is organized (high level)

1. 1Configure the domain-level VPC in the SageMaker Unified Studio domain settings, selecting the VPC, private subnets across AZs, and a security group.
2. 2Ensure VPC endpoints and Private DNS are in place so compute in private subnets can reach required AWS services without internet access.

# Validation and auditing

• Turn on VPC Flow Logs and review CloudTrail events to audit network activity and configuration changes.

# Practical next steps for administrators

• Confirm the VPC meets the subnet, DNS, and IP capacity guidance for your expected users and compute footprint.
• Create or verify required VPC endpoints and enable Private DNS on interface endpoints.
• Attach the SageMakerStudioAdminIAMConsolePolicy to the domain administrator role or ensure equivalent permissions.
• Configure domain-level VPC networking in the SageMaker Unified Studio domain settings and then test a new project to verify inheritance and connectivity.

# When to update vs. recreate existing projects