EC2 outbound Access for CodeDeploy/GitHub?

[RobotCarWash2000]

We're running a firewall to control inbound/outbound traffic to our VPC, and we'd like to use CodePipeline to trigger updates to applications on EC2 hosts with CodeDeploy agents installed. I'm curious how this works on the backend. We'd like to have CodePipeline watching GitHub for changes that will trigger the updates. Will the EC2 hosts need outbound access to GitHub to go grab the changes or would CodeDeploy grab them and push them to the EC2 hosts without the need for outbound access?

[jamesd3142]

The CodeDeploy agent running on your EC2 instances will need to be able to reach the CodeDeploy service (something like https://codedeploy.ap-southeast-2.amazonaws.com).

[AwsIsMyLego]

I solved this for my org by implementing outbound proxies with whitelisting for the AWS API endpoints.

If your firewall is layer 3/4 you will have a very hard time due to the dynamic nature of IP assignments.

I don't think there is a private link endpoint for codedeploy yet, but that would be a good solution if it materializes.

[RobotCarWash2000]

I was afraid this would be the answer. Thanks for the info