Calling SageMaker from API Gateway Without Lambda

Configure an API Gateway AWS service integration to invoke a SageMaker inference endpoint without a Lambda proxy.

Takahiro Iwasa

2023-07-13

3 min read

API Gateway’s integration request feature can call a SageMaker inference endpoint directly, eliminating the need for a Lambda function in between.

Diagram Overview

Finding the SageMaker Inference Endpoint

In the SageMaker console, open the endpoint and locate Endpoint summary > URL.

Endpoint Example

The endpoint format is as follows:

1
https://runtime.sagemaker.<ENDPOINT_REGION>.amazonaws.com/endpoints/<ENDPOINT_NAME>/invocations

ℹ️ Note

Direct calls to the SageMaker Runtime endpoint must include valid AWS Signature Version 4 authorization. See the official documentation.

Endpoints are scoped to an individual account, and are not public. The URL does not contain the account ID, but Amazon SageMaker determines the account ID from the authentication token that is supplied by the caller.

Building a REST API Integration for the SageMaker Endpoint

Select REST API in the API Gateway console.

Enter a name for the API.

API Name Setup

Select Actions -> Create Method.

Choose the HTTP method type (POST is used in this example).

Method Type

Configure the integration request as follows:

Integration type: AWS Service
AWS Service: SageMaker Runtime (NOT SageMaker)
HTTP method: POST
Action Type: Use path override
Path override: endpoints/<ENDPOINT_NAME>/invocations
Execution role: IAM role assumed by API Gateway (must allow sagemaker:InvokeEndpoint)
Content Handling: Passthrough

Integration Request Configuration

If the model accepts binary input, such as an image, add its MIME type—for example, image/*—to Binary Media Types.

Binary Media Configuration

Without this configuration, you may encounter the following error:

1
{
2
  "ErrorCode": "CLIENT_ERROR_FROM_MODEL",
3
  "LogStreamArn": "arn:aws:logs:ap-northeast-1:xxxxxxxxxxxx:log-group:/aws/sagemaker/Endpoints/<ENDPOINT_NAME>",
4
  "Message": "Received client error (400) from primary with message \"unable to evaluate payload provided\". See https://ap-northeast-1.console.aws.amazon.com/cloudwatch/home?region=ap-northeast-1#logEventViewer:group=/aws/sagemaker/Endpoints/<ENDPOINT_NAME> in account xxxxxxxxxxxx for more information.",
5
  "OriginalMessage": "unable to evaluate payload provided",
6
  "OriginalStatusCode": 400
7
}

Select Deploy API in the API Gateway console.

Select or create a deployment stage.

Deployment Steps

After deployment, the API endpoint is ready for testing.

API Endpoint Example

Testing

The deployed API can be tested with curl:

curl --location '<API_ENDPOINT>' \
  --header 'Content-Type: image/jpeg' \
  --header 'Accept: application/json' \
  --data-binary '@/path/to/image.jpg'

Conclusion

An API Gateway AWS service integration can invoke a SageMaker inference endpoint directly when the path override and execution role are configured correctly.

If a Lambda function would only forward the request body, this integration removes a network hop and one resource to maintain.

The direct integration does not provide application code for validating or transforming requests. Configure Binary Media Types and Content Handling to match the model input, and test with the exact content type expected by the endpoint. Use Lambda or another processing layer if the request must be validated or reshaped.