AWS Inspector - CWE-319 - Insecure connection using unencrypted protocol

[reecebenson]

I'm doing a review of my AWS Inspector stack and was stumped when reviewing the following vulnerability:

• CWE-319 - Insecure connection using unencrypted protocol
  • https://docs.aws.amazon.com/codeguru/detector-library/javascript/insecure-connection

When trying to determine where this vulnerability was showing from, it seems as though it comes from the following dependency tree:

serverless→ @serverless/dashboard-plugin → @aws-sdk/client-cloudformation → @aws-sdk/credential-provider-node → @smithy/credential-provider-imds

This leads me to the only occurrence of a static string that begins with http:// which resulted in the following file:

• https://github.com/smithy-lang/smithy-typescript/blob/main/packages/credential-provider-imds/src/config/Endpoint.ts#L4

/**
 * @internal
 */
export enum Endpoint {
  IPv4 = "http://169.254.169.254",
  IPv6 = "http://[fd00:ec2::254]",
}

Is there any way to remediate this as being a constant string so that it isn't picked up by AWS Inspector?