Question

A team's CI pipeline uses CodeBuild to run integration tests that must connect to an Amazon RDS database and an internal Amazon ElastiCache cluster, both located in private subnets with no internet route. The CodeBuild project also needs to pull dependencies from Amazon S3 and push test reports to Amazon CloudWatch Logs. Currently the build fails during the integration test phase because it cannot reach the RDS database, though dependency downloads succeed. What is the MOST appropriate configuration to make the integration tests pass while keeping the build's traffic private?

Accepted Answer

Configure the CodeBuild project to run inside the VPC by specifying the private subnets and a security group that allows access to the RDS and ElastiCache security groups, and add VPC endpoints for S3 and CloudWatch Logs.

Answer

Attach an internet gateway to the private subnets and assign a public IP to the CodeBuild build so it can reach the RDS database directly.

Answer

Keep CodeBuild outside the VPC and add the RDS and ElastiCache security groups to the default CodeBuild security group so it can reach the resources.

Answer

Enable RDS Data API and configure CodeBuild to use IAM authentication over the public endpoint, bypassing the need for VPC connectivity to ElastiCache.