VPCs should be configured with an interface endpoint for Systems Manager

How to fix it

• Can break clients: With Enable DNS name on, the VPC's existing calls to this service go through the endpoint, so any caller its security groups do not admit on port 443 loses access.

In the console

VPC → Endpoints → Create endpoint

Type

AWS services

Service name

com.amazonaws.<region>.ssm

VPC

This VPC

Enable DNS name

Selected (the default), so software uses it unchanged; the VPC needs DNS hostnames and DNS resolution on

Subnets

One in each Availability Zone the instances run in

Security groups

One allowing inbound HTTPS (443) from the instances, or no call reaches the endpoint

With the AWS CLI

aws ec2 create-vpc-endpoint --vpc-id <vpc-id> --vpc-endpoint-type Interface --service-name com.amazonaws.<region>.ssm --subnet-ids <subnet-id> --security-group-ids <security-group-id> --private-dns-enabled --region <region>

With Terraform

resource "aws_vpc_endpoint" "this" {
  vpc_id              = var.vpc_id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = var.subnet_ids
  security_group_ids  = var.security_group_ids
  private_dns_enabled = true
}