By using AWS re:Post, you agree to the Terms of Use

Does Image Builder support build and test an image in a private VPC subnet without internet access?


Hi I tried to setup an Image Builder Pipeline with a private subnet without internet connection in a VPC. It failed with failure message = 'Unable to bootstrap TOE'. I searched the AWS documentation and the TOE installation clearly needs a HTTPS connection to an internet address.

Has anyone run image builder in a private subnet without internet access successfully here? I have enabled the "VPC network interface" so the instance in my VPC can communicate with Image builder, SSM, S3 and Cloudwatch in a private connection but not with AWS TOE installation HTTP URL. Thanks.

asked 7 months ago262 views
2 Answers
Accepted Answer

HTTP URL is essentially an S3 Bucket. So if you create an VPC Endpoint for S3 the connection to download the files should work . Below is an article that goes through the steps of creating VPC Endpoints for S3. You can skip the bucket policy step

answered 7 months ago

After I created an S3 bucket URI for that AWS TOE repo "arn:aws:s3:::ec2imagebuilder-toe-${AWS::Region}-prod/*" it works like a charm and Image Builder is able to bootstrap AWS TOE and proceed with its functions. Thanks.

answered 7 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions