How to provide internet access to a code build project deployed in a private subnet using bastion host deployed in a public subnet in the same VPC?

Your approach of using a bastion host with a squid proxy in a public subnet to provide internet access to CodeBuild in a private subnet is a valid low-cost alternative to using a NAT Gateway. However, there are a few things to consider and potential issues to address:

1. Proxy Configuration: For CodeBuild to use an explicit proxy, you need to configure the appropriate environment variables in your CodeBuild project. Specifically, you should set the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables. These variables should point to your bastion host's private IP address and the port on which the squid proxy is running.

2. Security Group Configuration: While you've opened all inbound and outbound traffic on the bastion host's security group, it's generally recommended to restrict this to only necessary traffic. Ensure that the CodeBuild security group allows outbound traffic to the bastion host on the squid proxy port.

3. Route Table: Confirm that the route table for the private subnet where CodeBuild is running has a route that directs internet-bound traffic (0.0.0.0/0) to the ENI of your bastion host.

4. Squid Proxy Configuration: Make sure your squid proxy is properly configured to allow the necessary outbound connections. You may need to adjust its configuration to allow access to GitHub and other required services.

5. DNS Resolution: Ensure that DNS resolution is working correctly in your VPC. CodeBuild may need to resolve domain names, so check that your VPC DHCP options are set correctly.

6. Bastion Host Capacity: Consider whether your bastion host has sufficient capacity to handle the traffic from CodeBuild. If you're seeing timeouts, it could be due to resource constraints on the bastion host.

7. GitHub Access: The error message suggests a problem connecting to GitHub. Verify that your bastion host can reach GitHub and that there are no firewall rules or other network restrictions preventing this access.

While this setup can work, using a NAT Gateway is often preferred for its simplicity and managed nature. If you continue to face issues, you might want to consider using a NAT Gateway or exploring AWS PrivateLink for GitHub connections as alternative solutions.

To troubleshoot further, you can try:

• Testing the connection from the bastion host to GitHub directly
• Checking the squid proxy logs for any error messages
• Temporarily allowing direct internet access from CodeBuild to isolate whether the issue is with the proxy setup or something else

Remember to monitor the performance and adjust your setup as needed, especially if you plan to scale your CodeBuild usage.

Sources
Use AWS CodeBuild with a proxy server - AWS CodeBuild
Enable private resources to communicate outside the VPC - Amazon Virtual Private Cloud
Example: Launching an Elastic Beanstalk application in a VPC with bastion hosts - AWS Elastic Beanstalk

Unless you have configured IP Forwarding on the bastion EC2, then it wont forward traffic even if you have Squid installed. You need to point codebuild via a proxy.