CodeBuild VPC Security Group for RDS Access
A company is using AWS CodeBuild to run integration tests. The tests require access to an Amazon RDS instance in a private subnet. The CodeBuild project is configured with a VPC ID, subnet IDs, and security group IDs. However, the tests fail with a connection timeout. What is the MOST likely cause?
Quick Answer
The answer is that the security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group. This is the most likely cause because when CodeBuild is configured with a VPC, subnet IDs, and security group IDs, it runs inside your VPC and must communicate with RDS via private IP addresses; the RDS security group must explicitly permit inbound traffic on the database port from the CodeBuild project’s security group as the source. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of VPC security group configuration for cross-service access, often appearing as a trap where candidates mistakenly assume a NAT gateway or internet gateway is needed. The key insight is that both resources are within the same VPC, so no internet access is required—only proper security group rules. Memory tip: think “SG to SG” — always check that the target resource’s security group references the source resource’s security group ID, not a CIDR block.
⚠ Common exam trap
Many exam-takers assume a NAT gateway or internet access is required for VPC-based resources, but the core issue is security group ingress rules, not network connectivity to the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.
The most likely cause is that the security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group. CodeBuild runs inside the VPC using the specified security group, so it sends traffic to the RDS instance on port 3306 (or the appropriate database port). If the RDS security group's inbound rules do not explicitly permit traffic from the CodeBuild security group (or its CIDR), the connection is dropped, resulting in a timeout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group attached to the RDS instance does not allow inbound traffic from the CodeBuild security group.
Why this is correct
CodeBuild placed in the VPC uses its own security group as the traffic source. If the RDS security group lacks an inbound rule permitting that CodeBuild security group on the database port, connections time out, matching the stem's VPC-configured constraint.
- ✗
The CodeBuild project does not have internet access to download packages.
Why it's wrong here
VPC-attached CodeBuild projects reach private RDS through the ENIs in the specified subnets and security groups, so package downloads are irrelevant to the timeout. Internet access is required only when a build must fetch dependencies from public repositories, which is a separate concern from private subnet connectivity.
- ✗
The CodeBuild project is not associated with a VPC.
Why it's wrong here
The stem already states the project is configured with VPC ID and subnets, so VPC association is present; the timeout instead points to routing or security-group egress. It is tempting because a missing VPC association is a common CodeBuild cause, and it would be correct if no VPC configuration were specified at all.
- ✗
The RDS instance is not publicly accessible and requires a NAT gateway.
Why it's wrong here
A NAT gateway provides outbound internet access, not inbound reachability to a private RDS instance, so it cannot resolve the timeout. It is tempting because NAT gateways are frequently needed for private-subnet resources, and one would be correct if CodeBuild needed outbound internet access rather than database connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CodeBuild to run integration tests. The tests require access to an RDS database in a private subnet. CodeBuild runs in a VPC but the build times out waiting for the database connection. What is the MOST likely cause?
hard- A.CodeBuild cannot access resources in a private subnet unless it uses a NAT gateway.
- B.The CodeBuild service role does not have rds:Connect permission.
- ✓ C.The CodeBuild project's security group outbound rules do not allow traffic to the RDS security group on port 3306 (or appropriate port).
- D.The RDS instance is in a different subnet CIDR than CodeBuild's subnet.
Why C: CodeBuild's security group outbound rules must explicitly allow traffic to the RDS security group on the database port (e.g., 3306 for MySQL). Even though CodeBuild runs in a VPC, if the outbound rules are too restrictive, the build agent cannot establish a TCP connection to the RDS instance, causing a timeout. The security group acts as a virtual firewall for the CodeBuild ENI, and without a matching outbound rule, packets are dropped.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.