By using AWS re:Post, you agree to the Terms of Use

Is it possible to connect CodeBuild to CodeCommit over PrivateLink ?


I am able to connect CodeBuild with CodeCommit via NAT gateway in public subnet -> Internet Gateway. As both CodeCommit & CodeBuild are on AWS, I am trying to avoid using Internet Gateway.

Here's what I have done so far

  • Created endpoint for CodeCommit
  • Attached it to private subnet
  • Configured CodeBuild to use the same subnet

I am curious on what can be done here to avoid using Internet Gateway.

2 Answers
Accepted Answer

So long as CodeBuild has network connectivity to your CodeCommit endpoint, and the DNS resolution that CodeBuild sees for the CodeCommit service is overridden to point to that endpoint, then CodeCommit will be accessed without using the IGW. DNS resolution is overridden via a Private Hosted Zone (PHZ). The way it works within a single VPC is that you set PrivateDnsEnabled=true for the VPC Endpoint when you create it, which sets up an AWS-managed PHZ associated with the VPC.

See for more info.

answered 2 months ago
    • Created PHZ for
    • Added DNS "A" record for * and pointed it to the endpoint - in my case
    • On CodeBuild now I get "CLIENT_ERROR: Get "https://": dial tcp: lookup on no such host for primary source and source version refs/heads/master"

    I must have misconfigured something here.

  • If you're not sharing across VPCs, it's easiest to set PrivateDnsEnabled=true and let AWS manage the PHZ for you. Though of course you can set "false" instead and do your own as it sounds like you're doing. The PHZ would normally contain an Alias record mapping the service DNS name to the VPC Endpoint name rather than a regular A record mapping to an IP address. For example an SMS PHZ of ours has:

    Record name =

    Value =

    Alias = Yes

    You don't need "*." on the front of the record name.

  • VPC has "DNS hostnames" & "DNS resolution" enabled. Can I set "PrivateDnsEnabled=true" using console?

    So far I have tried following:

    • Created Private Hosted Zone in Route 53 for

    • Added A record using alias to point to the endpoint

    • Getting "CLIENT_ERROR: Get "https://": x509: certificate is valid for, *, not for primary source and source version refs/heads/master"

    • Deleted old private hosted Zone

    • Created new private hosted Zone for

    • Added A record using alias to point to the endpoint

    • Getting "CLIENT_ERROR: Get "https://": dial tcp i/o timeout for primary source and source version refs/heads/master"


I chose wrong endpoint CodeCommit. After choosing "git-codecommit" in Endpoint.

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions