A software update is a change released to fix a vulnerability. Security updates may affect the kernel, libraries such as OpenSSL, environments such as Java, Apache, and PHP, or applications such as WordPress. Install them quickly because attackers may already know how to exploit the flaw. section 5.0 section 5.2
Manage updates as an ongoing operational process:
- Create a working plan for updating every running virtual machine quickly after releases. section 5.2
- Use Amazon Linux 2 startup automation for critical or important security updates, and add yum -y update to user data for all updates. section 5.2
- Use yum -y --security update when startup automation should install only security updates. section 5.2
- Treat startup installation as insufficient: some updates require a reboot, and systems need continuous patching. section 5.2
Automate EC2 updates
Add a user-data command to an EC2 instance: yum -y update. For security-only installation, use yum -y --security update. For a more robust approach, configure AWS Systems Manager Patch Manager with a patch baseline, maintenance window, and the AWS-RunPatchBaseline task. section 5.2
MaintenanceWindow:
Type: 'AWS::SSM::MaintenanceWindow'
Properties:
AllowUnassociatedTargets: false
Duration: 2 #1
Cutoff: 1 #2
Name: !Ref 'AWS::StackName'
Schedule: 'cron(0 5 ? * SUN *)' #3
ScheduleTimezone: UTC
MaintenanceWindowTarget: #4
Type: 'AWS::SSM::MaintenanceWindowTarget'
Properties:
ResourceType: INSTANCE
Targets:
- Key: InstanceIds
Values:
- !Ref Instance
WindowId: !Ref MaintenanceWindow
MaintenanceWindowTask:
Type: 'AWS::SSM::MaintenanceWindowTask'
Properties:
MaxConcurrency: '1'
MaxErrors: '1'
Priority: 0
Targets:
- Key: WindowTargetIds
Values:
- !Ref MaintenanceWindowTarget
TaskArn: 'AWS-RunPatchBaseline' #5
TaskInvocationParameters:
MaintenanceWindowRunCommandParameters:
Parameters: #6
Operation:
- Install
TaskType: 'RUN_COMMAND'
WindowId: !Ref MaintenanceWindow
AssociationRunPatchBaselineInstall:
Type: 'AWS::SSM::Association' #7
Properties:
Name: 'AWS-RunPatchBaseline'
Parameters:
Operation:
- Install
Targets:
- Key: InstanceIds
Values:
- !Ref Instance
Shows a CloudFormation maintenance window targeting an instance and running AWS-RunPatchBaseline with concurrency and error limits. section 5.2
