Medium
EC2
Regional
VPC interface endpoints should be enabled for Systems Manager Incident Manager
NIST 800-53
Description
This control checks whether VPC interface endpoints are enabled for AWS Systems Manager Incident Manager. The control fails if there is no VPC interface endpoint for SSM Incident Manager or if the endpoint is not available. VPC interface endpoints allow you to privately connect your VPC to supported AWS services without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. This helps improve security by keeping traffic within the AWS network and reducing exposure to the public internet.
Remediation
Create a VPC interface endpoint for Systems Manager Incident Manager to enable private connectivity to AWS SSM Incident Manager.
Steps
- Open the Amazon VPC console.
- In the navigation pane, choose 'Endpoints'.
- Choose 'Create endpoint'.
- Select 'AWS services' as the service category.
- Choose 'com.amazonaws.region.ssm-incidents' as the service.
- Select your VPC and subnets.
- Choose a security group and policy.
- Choose 'Create endpoint'.
Compliance
NIST 800-53