How do I manage patch notifications for Systems Manager?

Resolution

To create customizable notifications, integrate Amazon SNS with Patch Manager, a capability of AWS Systems Manager, and use Run command when you patch. You can also use this feature when you add patching as a Run command task in a maintenance window.

Note: You can't use Amazon SNS notifications when you use Patch now (on-demand patching) or Patch policy.

Create an SNS topic for patch notifications

Create an SNS topic, and note the topic ARN. Then, use your preferred contact method to subscribe to the topic.

Note: To create customizable notifications, configure a maintenance window for patching.

Set up the required IAM policy and role

Create an AWS Identity and Access Management (IAM) policy and IAM role for Systems Manager to publish to the SNS topic. If you don't want use the maintainance window for patch notifications, then proceed to Specify the SNS topic in your Run command.

To use the role in the maintenance window, you must edit the maintenance window service role to allow it to pass the new IAM role. Under Resource, specify the ARN of the role that you created. For more information, see Control access to maintenance windows using the console. You can create a new policy, or update the inline policy of the maintenance window with the required permissions.

Example permissions:

{      "Version": "2012-10-17",  
    "Statement": [  
        {               
            "Effect": "Allow",  
            "Action": "iam:PassRole",  
            "Resource": "arn:aws:iam::ACCOUNT_ID:role/SNS-TOPIC-ROLE"             
        }  
    ]  
}

Note: Replace arn:aws:iam::ACCOUNT_ID:role/SNS-TOPIC-ROLE with your IAM role ARN.

Specify the SNS topic in your Run command

Complete the following steps:

1. Open the Systems Manager console.
2. In the navigation pane, choose Run command.
3. Choose AWS-RunPatchBaseline.
4. Configure the AWS-RunPatchBaseline parameters.
5. For SNS notifications, select Enable SNS notifications.
6. For IAM role, enter the new IAM role.
7. For SNS topic, enter the SNS topic ARN .
8. (Optional) For Event type, select the event types that you want to be notified about, such as Timed out or Failed attempts.
9. Choose Save changes.

(Optional) Specify the SNS topic in your maintenance window

If you use a maintenance window, then complete the following steps:

1. Open the Systems Manager console.
2. In the navigation pane, choose Maintenance windows.
3. Select the maintenance window that performs patches.
4. For Tasks, choose AWS-RunPatchBaseline, and then choose Edit.
5. For SNS notifications, select Enable SNS notifications.
6. For IAM role, enter the new IAM role.
7. For SNS topic, enter the SNS topic ARN .
8. (Optional) For Event type, select the event types that you want to be notified about.
9. Choose Save changes.

Example patch maintenance email notification:

{"commandId":"abcdef12-1234-1234-1234-abcdef123456",  "documentName":"AWS-RunPatchBaseline",  
"instanceId":"i-abcdefg1234567",  
"requestedDateTime":"2023-01-01T00:00:00.000Z",  
"status":"Failed",  
"detailedStatus":"Failed",  
"eventTime":"2023-01-1T00:02:00.00Z"}

Related information

Monitoring Systems Manager status changes using Amazon SNS notifications

Automate Systems Manager patching reports via email and Slack notifications in an AWS Organization