AWS inspector: Update required SSM endpoints for Inspector VM scanning
Summary
Removes the `com.amazonaws.<region>.ec2messages` endpoint from the list of endpoints required for Enhanced EC2 Scanning and adds a note that SSM Agent 3.3.40.0+ uses the `ssmmessages` endpoint instead, with `ec2messages` only supported in Regions launched before 2024.
Security assessment
The change corrects the network endpoint requirements (VPC endpoint / egress allow-list) needed for the SSM Agent used by Inspector VM scanning. It is configuration guidance with security impact on network exposure and connectivity, but it does not describe or fix a specific vulnerability, so it is not security_issue_related.
Evidence
- * `com.amazonaws.`region`.ec2messages`
Diff
diff --git a/inspector/latest/user/inspector-vm-scanner-enabling.md b/inspector/latest/user/inspector-vm-scanner-enabling.md index 17ddb52..bc7f865 100644 --- a//inspector/latest/user/inspector-vm-scanner-enabling.md +++ b//inspector/latest/user/inspector-vm-scanner-enabling.md @@ -51,2 +50,0 @@ You can run Enhanced EC2 Scanning on Amazon EC2 instances over an Amazon network - * `com.amazonaws.`region`.ec2messages` - @@ -67,0 +66,4 @@ For more information, see [Improve the security of Amazon EC2 instances by using +###### Note + +Beginning with SSM Agent version 3.3.40.0, SSM Agent uses the `ssmmessages` endpoint instead of the `ec2messages` endpoint whenever it's available. Earlier versions of SSM Agent use the `ec2messages` endpoint. This endpoint is supported only in AWS Regions launched before 2024. For more information, see [Reference: ec2messages, ssmmessages, and other API operations](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html) in the _AWS Systems Manager User Guide_. +