AWS Systems Manager (SSM) is a management toolbox for EC2 instances. Its Patch Manager capability applies operating-system updates more reliably than updating packages only during instance startup, including updates that may require reboots. section 5.2
Patch Manager combines several SSM components:
- The SSM Agent runs on the instance and also supports Session Manager. section 5.2
- Documents provide reusable scripts, such as AWS-RunPatchBaseline. section 5.2
- Run Command executes a document on an EC2 instance. section 5.2
- Associations run commands on a schedule or during a maintenance window. section 5.2
Scheduled patch scanning
A CloudFormation association can invoke AWS-RunPatchBaseline with the Scan operation every hour and target a particular EC2 instance. A maintenance window can instead run the patch baseline on Sunday, with limits such as one concurrent invocation and one tolerated error. section 5.2
MaintenanceWindow:
Type: 'AWS::SSM::MaintenanceWindow'
Properties:
AllowUnassociatedTargets: false
Duration: 2 #1
Cutoff: 1 #2
Name: !Ref 'AWS::StackName'
Schedule: 'cron(0 5 ? * SUN *)' #3
ScheduleTimezone: UTC
MaintenanceWindowTarget: #4
Type: 'AWS::SSM::MaintenanceWindowTarget'
Properties:
ResourceType: INSTANCE
Targets:
- Key: InstanceIds
Values:
- !Ref Instance
WindowId: !Ref MaintenanceWindow
MaintenanceWindowTask:
Type: 'AWS::SSM::MaintenanceWindowTask'
Properties:
MaxConcurrency: '1'
MaxErrors: '1'
Priority: 0
Targets:
- Key: WindowTargetIds
Values:
- !Ref MaintenanceWindowTarget
TaskArn: 'AWS-RunPatchBaseline' #5
TaskInvocationParameters:
MaintenanceWindowRunCommandParameters:
Parameters: #6
Operation:
- Install
TaskType: 'RUN_COMMAND'
WindowId: !Ref MaintenanceWindow
AssociationRunPatchBaselineInstall:
Type: 'AWS::SSM::Association' #7
Properties:
Name: 'AWS-RunPatchBaseline'
Parameters:
Operation:
- Install
Targets:
- Key: InstanceIds
Values:
- !Ref Instance
Browse a maintenance-window definition that targets an instance and invokes AWS-RunPatchBaseline. section 5.2
An EC2 instance needs an IAM role with AmazonSSMManagedInstanceCore so its SSM Agent can work. This role enables Systems Manager access without relying on an incoming firewall connection. section 3.1.1
