How do I see the patches that Patch Manager will install on my Amazon EC2 instance?

Short description

With Patch Manager, you can scan EC2 instances to only view a report of missing patches, or scan and automatically install all missing patches. Patch Manager uses patch baselines that include rules to auto-approve patches within days of their release. Patch baselines also include a list of approved and rejected patches.

To see the patches the Patch Manager will install on your instances, check the patch compliance state that's based on the patch baseline. Patch Manager checks the compliance state during Scan operations.

Resolution

Prerequisite: Make sure that that you adhere to the Patch Manager prerequisites.

Review or create the patch baseline

Check the predefined patch baseline for each operating system (OS) that you use.

If the default baseline doesn't meet your requirements, then create a custom patch baseline to define a standard set of patches for an instance type. Then, set the custom baseline as the default patch baseline.

(Optional) Organize instances into patch groups

You can use tags to organize your instances into patch groups. With patch groups, the AWS-RunPatchBaseline automation runs based on the patch group's patch baselines.

Note: If you don't specify a patch group, then the AWS-RunPatchBaseline automation uses the specified patch baseline as the default for the OS type.

Check the patch compliance states report

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

First, run a Scan operation to identify the planned patches for your instances. For Patching operation, choose Scan. To generate the patch compliance states report, AWS-RunPatchBaseline must run at least once on the instance. If you experience issues when you run AWS-RunPatchBaseline, then see Troubleshooting Patch Manager.

Then, complete the following steps to use the AWS Systems Manager console to check the patch compliance states report:

1. Open the Systems Manager console.
2. In the navigation pane, choose Patch Manager.
3. Choose the Reporting tab, and then choose the instance that you want to see missing patches for.
4. Choose Missing patches count to see the list of missing patches.
5. (Optional) To generate patch compliance reports, generate a .csv patch report for a single managed node or for all managed nodes.
6. Or, run the following describe-instance-patch-states AWS CLI command to get the count of patch compliance states:

   aws ssm describe-instance-patch-states --instance-ids "InstanceID"

   Note: Replace InstanceID with your instance ID. The command output includes the count for missing patches. If you encounter issues when you run the command, then make sure that your AWS Identity and Access Management (IAM) policy allows the DescribeInstancePatches action.

To identify the patches that are approved in the baseline but that aren't installed on the instance, run the following describe-instance-patches command:

aws ssm describe-instance-patches --instance-id "InstanceID" --filters Key=State,Values=Missing --region RegionID

Note: Replace InstanceID with your instance ID and RegionID with your AWS Region.

Related information

Issue: PatchBaselineOperations PowerShell module is not downloadable

How security patches are selected

How patches are installed

Updating or deleting a custom patch baseline

How do I troubleshoot a failed Patch Manager (Linux) operation?