I'll answer for Nessus and AWS.
Nessus has several options for performing port scans (e.g. netstat (WMI), SYN scan, TCP scan, and UDP scan). Some scans have specific requirements. For example:
- TCP scanning requires Nessus to be installed on Linux (otherwise this scan falls back onto a SYN scan)
- netstat (WMI) requires the target to be Windows
- Netstat 'scanner' requires the targets credentials and the target has netstat available
Assuming that you're meeting these requirements for proper scanning, then I believe you likely have a networking issue and would recommend some low-level testing of a specific example. For example, if you're performing a TCP scan and, using nmap, see port 22 open on your target, then attempt to telnet to that port at the target from your Nessus host to verify that it's accessible.
Best practice is to run port scans on both the internal and external networks to identify what's open both internally and externally. Running the scans on internal addresses within your VPC should be done from within the internal network. To protect against an attacker who has access to resources within your VPC, run the scan from within the VPC. To protect against an attacker positioned within your internal corporate network (e.g. with a direct connect to AWS), run the scan from within the corporate network (assuming this is outside of the VPC). Defense in depth would dictate performing each of these approaches and ensuring results meet your expectations.
One technique I've used to perform periodic scans: configure an AWS Lambda function to run periodically and perform the scan. It will take some scripting but is easy to configure and you have flexibility in where to send results.