How can AWS CodeBuild access Docker images or run yum commands without a NAT Gateway when running inside a VPC?

Your understanding of the situation is correct. When AWS CodeBuild runs inside a VPC without a NAT Gateway, it cannot access the public internet, which means it cannot pull images from public repositories like DockerHub or public ECR, nor can it run commands like yum install that require internet access.

To address this limitation, your proposed approach is on the right track:

1. Yes, CodeBuild cannot pull images from public ECR when running inside a VPC without a NAT Gateway, as it requires internet access.

2. Using a custom image in your private ECR repository is indeed the recommended approach for NAT-less VPC environments. This allows CodeBuild to access the image through VPC endpoints rather than requiring internet access.

3. For accessing AWS services without internet access, AWS PrivateLink is the solution. By creating interface VPC endpoints, you can establish private connections between your VPC and supported AWS services. For your specific case, you correctly identified the need for ECR API and ECR DKR endpoints to allow CodeBuild to pull from your private ECR repository.

4. For best practices when creating custom CodeBuild images:

• Pre-install all required tools and dependencies in your custom image
• Keep the image size optimized by cleaning up after installations (as you did with yum clean all)
• Include version verification commands for debugging (as you did with the MySQL version checks)
• Consider using multi-stage builds if appropriate to reduce final image size
• Document the contents and purpose of your custom image

Your solution of creating a custom Docker image with pre-installed MySQL tools, pushing it to a private ECR repository, and configuring the necessary VPC endpoints is the correct approach for running CodeBuild in a VPC without a NAT Gateway.

Remember that when configuring VPC access for CodeBuild, you should only include private subnets. CodeBuild will fail if you provide public subnets because public subnets have a default route to an Internet Gateway.
Sources
Image Builder and AWS PrivateLink interface VPC endpoints - EC2 Image Builder
CodeBuild provisioning custom Amazon VPC support - AWS Proton
Connecting to AWS services from inside your VPC - Amazon Elastic Container Service

Hello, I'd like to provide additional clarification on your questions.

Question 2: Is using a custom image in my own private ECR repository the recommended approach for NAT-less VPC environments?

Yes, this is the recommended approach. While the original answer mentioned ECR API and ECR DKR endpoints, there's an important additional requirement: ECR image layers are actually stored in S3, so an S3 Gateway endpoint is mandatory. This endpoint is a Gateway type and incurs no additional cost.

Required VPC endpoints are:

• com.amazonaws.<region>.ecr.api (for ECR API calls)
• com.amazonaws.<region>.ecr.dkr (for Docker registry API)
• com.amazonaws.<region>.s3 (for image layer storage, Gateway endpoint, free)

Optionally, you can add com.amazonaws.<region>.logs endpoint for CloudWatch Logs transmission. Additional Considerations: Beyond the original answer's mention of using private subnets only for VPC configuration, security group inbound rules must allow port 443 for VPC endpoint access. Additionally, since CodeBuild creates ENIs across multiple AZs, you need to ensure sufficient IP addresses are available. IAM Permission Setup: The CodeBuild service role requires the following permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "*"
    }
  ]
}

Question 3: Are there any AWS-supported methods to pull public images into CodeBuild without adding a NAT Gateway?

There is no direct method, but Pull Through Cache offers an alternative. An important alternative not mentioned in the original answer is using ECR Pull Through Cache rules. This approach automatically syncs public images to your private repository, making them accessible through VPC endpoints.

Creating a Pull Through Cache rule requires internet access only for the first image pull, and subsequent pulls can retrieve cached images from private ECR through VPC endpoints. However, initial setup still requires internet access, so it's not a complete solution, as VPC endpoints currently do not support Amazon ECR Public repositories.

Question 4: Is there a best practice for baking tools (like MySQL client) into a custom CodeBuild image for offline builds?

While the best practices mentioned in the original answer are accurate, here's a specific Dockerfile example with additional recommendations:

Dockerfile Example with Security and Optimization:

FROM amazonlinux:2

# Apply security updates first
RUN yum update -y

# Install MySQL client and required tools
RUN yum install -y mariadb mysql gzip tar && \
    yum clean all && \
    rm -rf /var/cache/yum

# Version verification (for debugging)
RUN mysql --version && mysqldump --version

# Create non-root user (security enhancement)
RUN useradd -m -s /bin/bash builduser
USER builduser

CMD ["/bin/bash"]

Additional Recommendations:

• Regular vulnerability scanning using ECR image scanning
• Minimize final image size through multi-stage builds
• Establish image tagging strategy for clear version management
• Enhance security by running as non-root user

Implementation Steps

Build and Push Custom Image

* Build image with MySQL tools locally
* Push to private ECR repository

Create VPC Endpoints

* Create ECR API, ECR DKR, and S3 Gateway endpoints
* Allow port 443 inbound in security groups

Configure CodeBuild Project

* Specify private subnets
* Set private ECR image URI
* Grant appropriate IAM permissions

Please let me know if you need clarification on any of these steps or if you have any additional questions.

Best regards, Dayeon Yang

References

• VPC endpoints currently don't support Amazon ECR Public repositories - https://repost.aws/questions/QUplWxu3IrQcenYeN9PruTMQ/how-to-pull-docker-image-from-ecr-public-gallery-in-a-private-vpc-without-nat
• AWS CodeBuild - Traffic privacy and VPC endpoints - https://docs.aws.amazon.com/codebuild/latest/userguide/security-traffic-privacy.html
• Amazon ECR - Creating a pull through cache rule - https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache-creating-rule.html
• AWS CodeBuild - Allow Amazon VPC access in your projects - https://docs.aws.amazon.com/codebuild/latest/userguide/enabling-vpc-access-in-projects.html