In this video, you’ll see how to enable Amazon Virtual Private Cloud (Amazon VPC) access
for AWS CodeBuild projects.
With this solution, you can increase the security of your build process, invoke CodeBuild privately,
and draw upon any resource hosted in your VPC for CodeBuild projects.
AWS CodeBuild is a fully managed build service in the cloud.
Ordinarily, CodeBuild cannot access resources in a VPC.
However, it’s possible to enable access through your VPC specifications and CodeBuild project configuration.
To get started, let’s head to CloudFormation to deploy a stack that bootstraps a VPC for use with CodeBuild.
The first step is to specify a template.
We’ll use a special CloudFormation YAML template that deploys a VPC accessible by CodeBuild.
This template can be found in the AWS documentation.
The template deploys the VPC as well as its necessary private and public subnets and security groups.
Let’s return to CloudFormation to deploy the stack.
Upload the template and proceed through the rest of the stack creation process.
Let’s retain the default values for the subnet IP ranges.
Review the settings and create the stack.
While the CloudFormation stack deploys, let’s review some configurations that are necessary
to ensure CodeBuild can access the VPC.
You must have an AWS Identity and Access Management (IAM) role with a policy
that allows CodeBuild to read and write to the same Amazon Simple Storage Service (Amazon S3) bucket.
For the purposes of this example, we already have an IAM role with the appropriate read
and write permissions.
Let’s look at the policy.
As you can see, this policy allows CodeBuild to retrieve source files and write output
build zip folders to an S3 bucket that was previously created for this purpose.
Let’s return to CloudFormation.
The CloudFormation template has finished deploying.
It has created the VPC as well as its subnets and security groups.
Here, you can see the full list of resources produced by the deployment.
Next, let’s review the Outputs.
As you can see, the stack produced two public and private subnets within a generated VPC,
as well as a security group.
Take note of the values for each of the outputs for future use.
Next, let’s set up an environment within the VPC where we can use CodeBuild to build an application.
In this case, we’ll create a Cloud9 environment.
Proceed through the steps of creating a new environment.
Create the Cloud9 environment within the VPC we just created.
Select the VPC ID shown in the CloudFormation stack output we saw earlier.
Select a public subnet of the VPC we created.
Proceed to the next step and create the environment.
We now have a Cloud9 environment on a new EC2 instance.
Next, we need to attach the IAM role with the CodeBuild policy to this instance.
Before we can do so, we must turn off AWS managed temporary credentials,
which is an AWS setting that’s enabled by default.
Now let’s navigate to EC2 to attach the IAM role to this instance.
Select the role and apply the setting.
The Cloud9 environment is now set up with the IAM role, and we have an S3 bucket that
will serve as the read and write folder for CodeBuild.
Let’s navigate to CodeBuild and create a build project with the necessary settings
to build from the Cloud9 environment in the VPC.
Specify a name for the project.
Next, specify the source location.
You can specify a Git repository or a zipped file in S3.
In this case, we’ll be saving the source files to our S3 bucket, so we’ll choose S3.
Choose the S3 bucket that has been created for this project.
Next, provide the name of the source file.
Notice that the bucket does not contain this file yet.
We’ll specify Amazon Linux 2 as the operating system, and CodeBuild Standard 3.0 as the build runtime.
Under Additional configuration, specify the network details CodeBuild needs in order to build the project.
First, we’ll select the VPC we created earlier.
Next, select private subnets from the VPC to be used by CodeBuild.
We’ll select both of our private subnets to ensure high availability.
Next, select a security group.
We’ll choose the "no-ingress" security group, which prevents inbound traffic.
CodeBuild needs a build specification file to know which steps to take in the build process.
If a file name is not provided, CodeBuild will look for the buildspec.yml file in the source code root directory.
For our purposes, let’s leave this blank and use the default file.
Next, specify where to store the output artifacts from the build process.
We’ll choose S3 as the output location.
Once again, choose the CodeBuild bucket created for this purpose.
Specify the path within the bucket to the file or folder where CodeBuild should write the build output artifact.
Logs and metrics regarding the build process can optionally be uploaded to CloudWatch or S3.
For our purposes, let’s retain the default selection and create the build project.
The build project has been created.
Next, let’s navigate to the AWS VPC Management Console to create interface endpoints within
the newly created VPC.
Interface VPC endpoints improve the security of your builds
and are needed for CodeBuild to access the resources it needs.
First, let’s create an endpoint for our S3 bucket.
Again, select the created VPC.
Let’s select the routing tables associated with each of our subnets.
Now create the endpoint.
Now let’s create a VPC interface endpoint for CodeBuild.
Select each private subnet in both Availability Zones.
The CodeBuild VPC interface must also be associated with a security group.
Let’s retain the default security group in the VPC.
Now that both VPC endpoints have been created, let’s navigate to EC2
and assign the default security group we just assigned to the CodeBuild VPC interface to the EC2 instance.
This assignment will allow communication between the CodeBuild VPC interface and the EC2 instance
containing the Cloud9 environment.
Next, let’s return to the Cloud9 environment.
We are finally ready to prepare and build a project from our VPC-contained Cloud9 environment.
Let’s start by cloning a sample web app Java project.
Let’s add a build specification file with the default filename of buildspec.yml
in the root directory of the project.
Let’s create a build specification that simply installs the project’s Maven dependencies
before generating the output artifact file.
Now let’s zip the project folder and write it to the S3 bucket so it can be read by CodeBuild.
We’ll zip our project folder into samplewebapp.zip,
the name we specified for our build source within our S3 bucket.
Next, let’s copy this zip folder to the S3 bucket.
We are now ready to begin the build in CodeBuild.
Now that the build has started successfully, let's head to CodeBuild to look at the build process.
The build has completed successfully.
Let’s take a look at the build details.
Here you can see the build logs.
Let’s look at the build details tab.
We can see that our build is properly configured to receive build commands from an environment
contained within a VPC.
Next, let’s head to S3 to ensure that the build artifact was created.
As expected, we can see the build artifact.
You’ve just seen how to enable Amazon VPC access for AWS CodeBuild projects.
Thanks for watching.
Now it’s your turn to try.