DOP-C02 SDLC Automation Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add an IAM policy that grants the CodeBuild service role access to the RDS instance.

  Why it's wrong here

  IAM policies govern control-plane API actions (e.g., rds:Connect, rds:DescribeDBInstances), not data-plane network access. The CodeBuild service role could have full RDS API permissions, but the database still rejects TCP connections unless the RDS security group explicitly permits inbound traffic on the database port from the CodeBuild project's security group. Security groups act as a stateful firewall at the instance level, so IAM alone cannot establish connectivity.

• ✓

  Configure the security group for the RDS instance to allow inbound traffic from the security group associated with the CodeBuild project.

  Why this is correct

  The RDS instance's security group must have an inbound rule that allows TCP traffic on the database port (e.g., 3306, 5432) from the security group ID attached to the CodeBuild project's elastic network interface. This is the standard way to permit traffic between AWS resources within a VPC, because security group rules reference other security groups as sources. The CodeBuild project must also be configured with VPC settings (VPC ID, subnets, and security groups) so its ENI is placed in the same network context as the RDS instance, enabling the security group-to-security group allow.

• ✗

  Create a VPC endpoint for Amazon RDS.

  Why it's wrong here

  A VPC endpoint for Amazon RDS is used to privately access the RDS control-plane API (e.g., CreateDBInstance, DescribeDBInstances) without going over the internet, not for database client connections to the instance's data-plane port. The actual database connection traffic travels to the instance endpoint (such as the RDS DNS name) and is governed by security group rules, network ACLs, and routing. Creating a VPC endpoint does not alter the database security group, so connectivity to the DB instance remains blocked.

• ✗

  Attach a NAT gateway to the private subnet.

  Why it's wrong here

  A NAT gateway provides outbound-only internet access for resources in private subnets; it does not create any inbound path to an RDS database. Because both CodeBuild and the RDS instance reside within the same VPC, traffic between them stays on the VPC's internal network and never needs internet connectivity. Adding a NAT gateway would not modify the security group rules that are denying the connection, so the integration test still cannot reach the database.

Go deeper

Related to this question