SSM Compliance Shows Non-Compliant After Maintenance Window with AWS-RunPatchBaseline on Windows EC2

Missing Reboot

• Cause: Some Windows patches require a reboot to complete installation.
• Fix: Make sure the RebootOption parameter is set to RebootIfNeeded in the AWS-RunPatchBaseline task.

Patch Baseline Configuration

• Cause: Your patch baseline might only include limited classifications (e.g., only critical or security patches).
• Fix: Check your patch baseline settings to ensure it includes all necessary classifications and severities.

Stale Compliance Data

• Cause: SSM Compliance relies on scan data that might not be refreshed after patching.
• Fix: Ensure that patch compliance and inventory scans are triggered after patching. You can automate this using the AWS-GatherSoftwareInventory SSM document.

Maintenance Window Task Misconfiguration

• Cause: The task may be running with incorrect parameters or under the wrong targets.
• Fix: Double-check that the maintenance window task is targeting the correct instance(s) and that parameters like Operation=Install are set properly.

Pending Updates Outside Baseline

• Cause: The instance may have updates available that are not covered by the selected patch baseline.
• Fix: Review the list of missing patches in the SSM console to confirm if they are excluded by the baseline.

Agent Issues

• Cause: An outdated or malfunctioning SSM Agent can fail to report compliance correctly.
• Fix: Ensure the SSM Agent is up to date and running on the instance.