Does Image Builder support build and test an image in a private VPC subnet without internet access?

Question

Hi I tried to setup an Image Builder Pipeline with **a private subnet without internet connection** in a VPC. It failed with failure message = '**Unable to bootstrap TOE**'. I searched the AWS documentation and the TOE installation clearly needs a HTTPS connection to an internet address.

Has anyone run image builder in a private subnet without internet access successfully here? I have enabled the "VPC network interface" so the instance in my VPC can communicate with Image builder, SSM, S3 and Cloudwatch in a private connection but not with AWS TOE installation HTTP URL. Thanks.

Karthik Rengasamy · Accepted Answer

HTTP URL is essentially an S3 Bucket. So if you create an VPC Endpoint for S3 the connection to download the files should work .
Below is an article that goes through the steps of creating VPC Endpoints for S3. You can skip the bucket policy step  
[https://aws.amazon.com/premiumsupport/knowledge-center/s3-private-connection-no-authentication/]()

xianlin_hcl · Answer

After I created an S3 bucket URI for that AWS TOE repo `"arn:aws:s3:::ec2imagebuilder-toe-${AWS::Region}-prod/*"` it works like a charm and Image Builder is able to bootstrap AWS TOE and proceed with its functions.  Thanks.

Does Image Builder support build and test an image in a private VPC subnet without internet access?

Relevant content