Examkin

Question

Difficulty: MediumAWS CodeBuild

A software development team configures an AWS CodeBuild project to run within a private subnet of a VPC to perform integration testing against an Amazon RDS DB instance. The integration tests connect to the database successfully, but the build project fails during the install phase when running commands to retrieve packages from a public software registry. Which of the following actions will resolve this build failure?

  1. Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route outbound internet traffic through the NAT gateway.Answer
  2. B
    Attach a VPC endpoint for AWS Systems Manager to the VPC, and reference the external dependency parameters under the secrets-manager block of the buildspec file.
  3. C
    Update the trust policy of the AWS CodeBuild service role to allow the VPC's route table to assume the role during the build execution.
  4. D
    Place the buildspec.yml file in the subdirectory that contains the integration test suites to align execution scopes.

Answer

Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route outbound internet traffic through the NAT gateway.
The correct answer is to configure a NAT gateway in a public subnet of the VPC and update the private subnet's route table. When AWS CodeBuild projects are configured to run inside a VPC, they do not have direct internet access. If the build needs to access both private resources (such as Amazon RDS) and public registries to pull dependencies, you must place the CodeBuild project in private subnets, configure a NAT gateway in a public subnet, and route outbound internet traffic (0.0.0.0/0) through that NAT gateway.

Step-by-Step Solution

1
Analyze the network path requirements.
The CodeBuild project successfully connects to Amazon RDS (inside the private VPC) but fails to reach the public internet (external package registry).
This indicates that internal VPC routing works, but there is no outbound path to the public internet.
2
Identify the standard VPC component needed for outbound-only internet access.
A NAT gateway is required to translate private IP addresses to a public IP address for internet communication.
Resources in a private VPC subnet require a NAT gateway located in a public subnet with a route to an Internet Gateway to access external endpoints.
3
Configure routing for the private subnet.
Update the private subnet route table to target the NAT gateway for destination '0.0.0.0/0'.
This ensures all internet-bound traffic from the CodeBuild container in the private subnet is forwarded through the NAT gateway.

Key Concept

AWS CodeBuild VPC connectivity and internet access requirements
Estimated Time:1m 30s
Rate this question

Topics

AWS CodeBuild

More questions from this topic