feat(sagemaker): add containerStartupHealthCheckTimeoutInSeconds support for EndpointConfig

[amandladev]

Implements container startup health check timeout configuration for SageMaker endpoint production variants as available in CloudFormation but missing in CDK constructs.

Issue #35566

• Add containerStartupHealthCheckTimeout property to InstanceProductionVariantProps interface
• Add comprehensive validation for timeout range (60-3600 seconds)
• Add CloudFormation template generation for ContainerStartupHealthCheckTimeoutInSeconds property
• Include test coverage for validation scenarios and edge cases
• Update README documentation with usage examples and constraints

Reason for this change

AWS SageMaker EndpointConfig supports ContainerStartupHealthCheckTimeoutInSeconds in CloudFormation to configure health check timeout for inference containers, but this property is not exposed in the CDK SageMaker L2 constructs. Users with models that require longer initialization time cannot configure appropriate health check timeouts, leading to premature health check failures.

Description of changes

Implements AWS SageMaker container startup health check timeout support in CDK SageMaker L2 constructs, enabling users to configure appropriate health check timeouts for inference containers:

• New containerStartupHealthCheckTimeout property in InstanceProductionVariantProps interface with AWS-compliant validation:
  Range: 60-3600 seconds (1 minute to 1 hour)
  Type: cdk.Duration for intuitive time specification
  Optional property maintaining backward compatibility
• Enhanced addInstanceProductionVariant() method with comprehensive input validation
• Automatic conversion from cdk.Duration to seconds for CloudFormation compatibility
• Synthesis-time validation with clear, actionable error messages
• CloudFormation integration mapping to ContainerStartupHealthCheckTimeoutInSeconds property

Usage Example:

import * as cdk from 'aws-cdk-lib';
import * as sagemaker from '@aws-cdk/aws-sagemaker-alpha';

declare const model: sagemaker.IModel;

// Create endpoint configuration with health check timeout
const endpointConfig = new sagemaker.EndpointConfig(this, 'EndpointConfig', {
  instanceProductionVariants: [{
    variantName: 'my-variant',
    model: model,
    containerStartupHealthCheckTimeout: cdk.Duration.minutes(5), // 5 minutes timeout
  }],
});

Describe any new or updated permissions being added

N/A - No new IAM permissions required. Leverages existing SageMaker endpoint configuration permissions.

Description of how you validated changes

Unit tests: Added 5 comprehensive container startup health check timeout tests covering all validation scenarios:

• Property inclusion in CloudFormation template when provided
• Property absence in CloudFormation template when not provided
• Range validation for minimum value (60 seconds)
• Range validation for maximum value (3600 seconds)
• Acceptance of valid timeout values at boundaries
• Duration to seconds conversion verification

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[abidhasan-aws]

Hi @amandladev,
Thanks for your contribution. I have added a few comments.

You might also need to resolve conflict.
:)

[abidhasan-aws]

We should remove containerStartupHealthCheckTimeout from ProductionVariantProps and keep it only in InstanceProductionVariantProps.

ContainerStartupHealthCheckTimeoutInSeconds is an instance-only property, it's not supported for serverless endpoints.

[amandladev]

Done!

Pull request has been modified.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	24 ran	24 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	24 ran	24 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[amandladev]

Hello @abidhasan-aws !

Thanks a lot for the feedback! I’ve applied the suggested changes and I’m around if there’s anything else to tweak.
Have a great week 😄

[abidhasan-aws]

LGTM , Thanks :)

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

✅ The pull request has been merged at 2ec085e

This pull request spent 5 hours 25 minutes 55 seconds in the queue, including 32 minutes 41 seconds running CI.
The checks were run in-place.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • feat(sagemaker): add containerStartupHealthCheckTimeoutInSeconds support for EndpointConfig #35626
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • feat(sagemaker): add containerStartupHealthCheckTimeoutInSeconds support for EndpointConfig #35626
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.