AWS systems-manager documentation change
Summary
Added detailed notes about network configuration requirements for SSM Agent, including outbound internet access as an alternative to VPC endpoints
Security assessment
The changes clarify secure network configurations (VPC endpoints or HTTPS outbound rules) but do not address a specific security vulnerability. The documentation emphasizes proper firewall settings to ensure secure communication, which is a security best practice.
Diff
diff --git a/systems-manager/latest/userguide/troubleshooting-ssm-agent.md b/systems-manager/latest/userguide/troubleshooting-ssm-agent.md index 0209475fb..41682a6bc 100644 --- a//systems-manager/latest/userguide/troubleshooting-ssm-agent.md +++ b//systems-manager/latest/userguide/troubleshooting-ssm-agent.md @@ -113 +113,18 @@ SSM Agent won't work if it can't communicate with the preceding endpoints, as de -In order to manage EC2 instances with Systems Manager, your VPC endpoints must be configured properly for `ssm.`region`.amazonaws.com`, `ssmmessages.`region`.amazonaws.com`, and in some cases explained earlier in this topic in Unable to connect to SSM endpoints, `ec2messages.`region`.amazonaws.com`. Your network configuration must have open internet access or you must have these virtual private cloud (VPC) endpoints configured. +If you are using a virtual private cloud (VPC), in order to manage EC2 instances with Systems Manager, your VPC endpoints must be configured properly for `ssm.`region`.amazonaws.com`, `ssmmessages.`region`.amazonaws.com`, and in some cases explained earlier in this topic in Unable to connect to SSM endpoints, `ec2messages.`region`.amazonaws.com`. + +###### Note + +The alternative to using a VPC endpoint is to allow outbound internet access on your managed instances. In this case, the managed instances must also allow HTTPS (port 443) outbound traffic to the following endpoints: + + * `ssm.`region`.amazonaws.com` + + * `ssmmessages.`region`.amazonaws.com` + + * `ec2messages.`region`.amazonaws.com` + + + + +SSM Agent initiates all connections to the Systems Manager service in the cloud. For this reason, you don't need to configure your firewall to allow inbound traffic to your instances for Systems Manager. + +For more information about calls to these endpoints, see [Reference: ec2messages, ssmmessages, and other API operations](./systems-manager-setting-up-messageAPIs.html). @@ -139 +156 @@ For more information, see the following topics: -As part of verifying your VPC configuration, ensure that the attributes `enableDnsSupport` and `enableDnsHostnames` are enabled. +If you are using a virtual private cloud (VPC), as part of verifying your VPC configuration, ensure that the attributes `enableDnsSupport` and `enableDnsHostnames` are enabled. @@ -144,0 +162,17 @@ For information about enabling these attributes in the Amazon VPC Console, see [ +###### Note + +The alternative to using a VPC endpoint is to allow outbound internet access on your managed instances. In this case, the managed instances must also allow HTTPS (port 443) outbound traffic to the following endpoints: + + * `ssm.`region`.amazonaws.com` + + * `ssmmessages.`region`.amazonaws.com` + + * `ec2messages.`region`.amazonaws.com` + + + + +SSM Agent initiates all connections to the Systems Manager service in the cloud. For this reason, you don't need to configure your firewall to allow inbound traffic to your instances for Systems Manager. + +For more information about calls to these endpoints, see [Reference: ec2messages, ssmmessages, and other API operations](./systems-manager-setting-up-messageAPIs.html). +