AWS inspector: Update EC2 scanning VPC endpoints to ssmmessages
Summary
Removes the `com.amazonaws.<region>.ec2messages` VPC endpoint from the required list and adds a note that SSM Agent 3.3.40.0+ uses the `ssmmessages` endpoint when available, with `ec2messages` only for older agents and Regions launched before 2024.
Security assessment
Same as the CIS scanning page: private VPC endpoint list for Enhanced EC2 Scanning is updated to reflect SSM Agent's use of `ssmmessages` vs `ec2messages`. Network connectivity guidance for a private scanning path, not a vulnerability fix or new security control documentation.
Evidence
+Beginning with SSM Agent version 3.3.40.0, SSM Agent uses the `ssmmessages` endpoint instead of the `ec2messages` endpoint whenever it's available. Earlier versions of SSM Agent use the `ec2messages` endpoint. This endpoint is supported only in AWS Regions launched before 2024. For more information, see [Reference: ec2messages, ssmmessages, and other API operations](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html) in the _AWS Systems Manager User Guide_.
Diff
diff --git a/inspector/latest/user/scanning-ec2.md b/inspector/latest/user/scanning-ec2.md index 773cb98..4f08e20 100644 --- a//inspector/latest/user/scanning-ec2.md +++ b//inspector/latest/user/scanning-ec2.md @@ -59,2 +58,0 @@ You can run Enhanced EC2 Scanning on Amazon EC2 instances over an Amazon network - * `com.amazonaws.`region`.ec2messages` - @@ -77,0 +76,4 @@ For more information, see [Improve the security of Amazon EC2 instances by using +Beginning with SSM Agent version 3.3.40.0, SSM Agent uses the `ssmmessages` endpoint instead of the `ec2messages` endpoint whenever it's available. Earlier versions of SSM Agent use the `ec2messages` endpoint. This endpoint is supported only in AWS Regions launched before 2024. For more information, see [Reference: ec2messages, ssmmessages, and other API operations](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html) in the _AWS Systems Manager User Guide_. + +###### Note +