AWS inspector: Update CIS scanning VPC endpoints to ssmmessages
Summary
Removes the `com.amazonaws.<region>.ec2messages` VPC endpoint from the required list and adds a note that SSM Agent 3.3.40.0+ uses the `ssmmessages` endpoint when available, with `ec2messages` only for older agents and Regions launched before 2024.
Security assessment
This is a network/connectivity configuration correction for private VPC endpoint setups (SSM agent message APIs), affecting whether CIS scans can reach the service without internet egress. It changes operational guidance for a private-network scanning path rather than addressing a vulnerability or documenting a new security control, so it is low-to-medium security relevance; scored low as it is primarily an endpoint/API accuracy update.
Evidence
+Beginning with SSM Agent version 3.3.40.0, SSM Agent uses the `ssmmessages` endpoint instead of the `ec2messages` endpoint whenever it's available. Earlier versions of SSM Agent use the `ec2messages` endpoint. This endpoint is supported only in AWS Regions launched before 2024. For more information, see [Reference: ec2messages, ssmmessages, and other API operations](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html) in the _AWS Systems Manager User Guide_.
Diff
diff --git a/inspector/latest/user/scanning-cis.md b/inspector/latest/user/scanning-cis.md index 5c0e328..f401817 100644 --- a//inspector/latest/user/scanning-cis.md +++ b//inspector/latest/user/scanning-cis.md @@ -67,2 +66,0 @@ You can run CIS scans on Amazon EC2 instances over an Amazon network. However, i - * `com.amazonaws.`region`.ec2messages` - @@ -83,0 +82,4 @@ For more information, see [Creating Amazon VPC endpoints for Systems Manager](ht +Beginning with SSM Agent version 3.3.40.0, SSM Agent uses the `ssmmessages` endpoint instead of the `ec2messages` endpoint whenever it's available. Earlier versions of SSM Agent use the `ec2messages` endpoint. This endpoint is supported only in AWS Regions launched before 2024. For more information, see [Reference: ec2messages, ssmmessages, and other API operations](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html) in the _AWS Systems Manager User Guide_. + +###### Note +