What does "AWS-AmazonLinux2023DefaultPatchBaseline" actually do?

The "AWS-AmazonLinux2023DefaultPatchBaseline" is a predefined patch baseline in AWS Systems Manager's Patch Manager that specifically targets Amazon Linux 2023 managed nodes. This baseline approves all operating system patches that are classified as "Security" with severity levels of "Critical" or "Important". It also approves all patches with a classification of "Bugfix". Both security and bugfix patches are auto-approved seven days after their release.

When Patch Manager runs the "AWS-RunPatchBaseline" document with this baseline, it uses the DNF update API on Amazon Linux 2023 instances. The equivalent command that's executed would be:

sudo dnf upgrade-minimal --sec-severity=Critical --sec-severity=Important --bugfix -y

If the "Include nonsecurity updates" option is selected in your patch baseline configuration, then both security patches (those in updateinfo.xml) and nonsecurity updates would be applied.

The patching process follows a specific workflow where the system evaluates the patches against the baseline rules (GlobalFilters, ApprovalRules, ApprovedPatches, and RejectedPatches), applies the approved patches using the DNF update API, and then reboots the managed node if necessary based on your reboot option settings.
Sources
How patches are installed - AWS Systems Manager
Predefined and custom patch baselines - AWS Systems Manager

When you run "Patch Now" with the AWS-RunPatchBaseline document, it doesn't simply execute dnf upgrade. Instead, it follows a more controlled process:

First, it downloads a Patch Baseline Snapshot: The document invokes a Python module that downloads a snapshot of your patch baseline (in this case, AWS-AmazonLinux2023DefaultPatchBaseline). Then it uses the Baseline Rules: This snapshot contains the defined rules and lists of approved and blocked patches from your baseline. Last, it drives DNF Selectively: The Python module then uses these rules to drive DNF (the package manager for AL2023) to install only the approved patches that match your baseline criteria

So while it ultimately uses DNF under the hood, it's a much more controlled and policy-driven approach than simply running dnf upgrade directly