CodeBuild's default build container is connected to the public internet. It pulls packages from npm, pip, and Docker Hub, and pushes images to ECR. That's sufficient in most situations. But two situations break this assumption.
First: access to private resources. RDS Aurora sits in a private subnet and the build has to run a DB migration. You cannot reach a DB in a private subnet from the public internet. The build has to be inside the VPC.
Second: ARM (Graviton) workloads. If your ECS or EKS cluster uses Graviton instances, the build must also run in an ARM environment to produce arm64 images. You can build arm64 on x86 by emulating with QEMU, but it's slow and unstable.