DOP-C02 Practice Question 31: CodeBuild VPC NAT Egress

The CodeBuild documentation states the requirement directly: "You need a NAT gateway or NAT instance to use CodeBuild with your VPC so that CodeBuild can reach public endpoints... You cannot use the internet gateway instead of a NAT gateway or a NAT instance because CodeBuild does not support assigning Elastic IP addresses to the network interfaces that it creates, and auto-assigning a public IP address is not supported by Amazon EC2 for any network interfaces created outside of Amazon EC2 instance launches." Its best-practices checklist adds: "When you set up your CodeBuild projects to access your VPC, choose private subnets only." An interface without a public address in a public subnet has no working path out, which is exactly the timeout pattern described. (Interface VPC endpoints for ECR and a gateway endpoint for S3 would also fix those two, but they would not fix the public npm download.)

Option B misreads security groups. They are stateful, so responses to outbound requests are always allowed; the docs even say builds should have no inbound traffic allowed. Adding inbound rules changes nothing and weakens the build environment.

Option C describes something CodeBuild does not support. Attaching Elastic IP addresses to the network interfaces CodeBuild creates is precisely the thing the documentation says is impossible, which is why a NAT gateway is required.

Option D would produce AccessDenied errors, not timeouts, and the same role already worked before the project was moved into the VPC. Granting wildcard permissions here masks nothing and violates least privilege.

Reference: Use AWS CodeBuild with Amazon Virtual Private Cloud