--- title: "Connect OpenSearch to private ML endpoints" url: https://daily.dev/posts/connect-opensearch-to-private-ml-endpoints-ctqelyciv source_url: https://opensearch.org/blog/connect-opensearch-to-private-ml-endpoints type: article source: "OpenSearch" published: 2026-08-23T12:21:04.846Z updated: 2026-08-23T12:45:23.371Z tags: ["security", "machine-learning", "aws-sagemaker", "opensearch"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connect OpenSearch to private ML endpoints **[OpenSearch](https://daily.dev/sources/opensearch)** · 5 min read · 0 upvotes · 0 comments ## Summary OpenSearch's ML Commons plugin can connect to ML models hosted on private infrastructure such as VPC-hosted SageMaker endpoints or internal inference servers, avoiding public internet exposure. For self-managed OpenSearch, admins enable plugins.ml_commons.connector.private_ip_enabled via cluster settings and configure trusted endpoint regex patterns directly. For Amazon OpenSearch Service, VPC egress must be enabled and a support ticket filed to have the private IP setting applied, since it's service-managed. Both paths require creating a connector pointing to the private URL, registering and deploying the model, and redeploying the model after any settings change since ML Commons only reads settings at deploy time. Troubleshooting covers common errors like persistent private IP errors after settings changes, connection timeouts due to network rules, and endpoint regex mismatches. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does OpenSearch still say 'Remote Inference host name has private ip address' after I enabled private_ip_enabled? The model needs to be undeployed and redeployed. ML Commons reads the private_ip_enabled and trusted endpoint settings only at model deployment time, so changing cluster settings without redeploying leaves the old configuration in effect. Run a POST to the model's _undeploy endpoint followed by _deploy to apply the new settings. _daily.dev surfaces practical fixes like this for engineers debugging OpenSearch ML Commons connector errors._ ### How do I connect OpenSearch to a private SageMaker endpoint without exposing it to the public internet? Enable plugins.ml_commons.connector.private_ip_enabled and configure plugins.ml_commons.trusted_connector_endpoints_regex with patterns matching your private endpoint's hostname or CIDR range, then create a connector pointing to the private URL. For Amazon OpenSearch Service, VPC egress must also be enabled on the domain and a support ticket filed since the private IP setting is service-managed there. _engineers wiring OpenSearch to private ML infrastructure can track configuration guides like this on daily.dev._ ### Why does my OpenSearch ML connector return 'endpoint not matched' even though the connector was created successfully? The connector's URL does not match any pattern in trusted_connector_endpoints_regex. The regex must match the full URL including scheme and path; for example a pattern like ^https://10\.0\..*$ matches https://10.0.1.5/v1/predict but not the same address over plain http, since the scheme differs. _daily.dev helps developers troubleshooting endpoint allowlist mismatches in OpenSearch stay on top of these gotchas._ ## Similar posts on daily.dev - [Amazon OpenSearch Service now supports VPC egress for private connectivity to resources in your VPC](https://daily.dev/posts/amazon-opensearch-service-now-supports-vpc-egress-for-private-connectivity-to-resources-in-your-vpc-ofb1rdfva) · AWS · 0 upvotes · 0 comments - [Amazon OpenSearch Service now supports automatic semantic enrichment for VPC domains](https://daily.dev/posts/amazon-opensearch-service-now-supports-automatic-semantic-enrichment-for-vpc-domains-hbpzqnynm) · AWS · 0 upvotes · 0 comments - [Amazon OpenSearch Service now supports the Agent Toolkit for AWS with a curated skill](https://daily.dev/posts/amazon-opensearch-service-now-supports-the-agent-toolkit-for-aws-with-a-curated-skill-fmqkgdbmv) · AWS · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#machine-learning](https://daily.dev/tags/machine-learning), [#aws-sagemaker](https://daily.dev/tags/aws-sagemaker), [#opensearch](https://daily.dev/tags/opensearch) [View this post on daily.dev](https://daily.dev/posts/connect-opensearch-to-private-ml-endpoints-ctqelyciv)