How do I configure maintenance windows for patching Amazon EC2 and hybrid nodes in multiple environments in Systems Manager?

Short description

Use Patch Manager, a capability of AWS Systems Manager to configure patch baselines and maintenance windows for Amazon Elastic Compute Cloud (Amazon EC2) and hybrid instances.

Resolution

Complete the following checks, and then configure patch baselines and maintenance windows for your managed nodes.

• Check that Patch Manager supports your operating system (OS).
• Make sure that you installed the latest version of AWS Systems Manager Agent (SSM Agent).
  Note: You can automatically update SSM Agent or manually update SSM Agent with Run Command, a capability of AWS Systems Manager.
• Check that the instance appears under Managed instances, and that SSM Agent is online. If your instance doesn't appear as managed or the SSM Agent ping status is Offline, then troubleshoot your unmanaged instance.
• Make sure that the instance can reach Windows Server Update Services (WSUS), Microsoft Update servers, or Linux repositories.
• Check that the instance can reach the required "ssm", "ssmmessages", and "ec2messages" endpoints. For instructions on how to create the endpoints, see Creating VPC endpoints for Systems Manager.
• To patch applications released by Microsoft on virtual machines (VMs) and on-premises instances, activate the advanced-instances tier.

Important: It's a best practice to monitor patching to verify the patch compliance information of your nodes and troubleshoot Patch Manager errors.

Configure patch baselines for your managed nodes

Verify that the AWS predefined patch baseline for each OS type that you use meets your requirements. If the predefined patch baseline doesn't meet your requirements, then create a custom patch baseline.

Configure maintenance windows for your managed nodes

To configure your maintenance window, complete the following steps in the Systems Manager console:

1. Create a maintenance window.
2. Assign targets to the maintenance window that you created.
3. Assign a task to the maintenance window that you created. Choose Run Command for Task Type, and then in the Command document list, choose the AWS-RunPatchBaseline Systems Manager Command document.

Related information

Why does my Amazon EC2 instance appear as non-compliant in the Compliance dashboard?

Patching your Windows EC2 instances using AWS Systems Manager Patch Manager