AWS SSM Patch Manager

From the document, I'm trying to make it clearer:

AWS-RunPatchBaseline is to apply patches for both operating systems and applications. (On Windows Server, application support is limited to updates for applications released by Microsoft.). This document supports Linux, macOS, and Windows Server managed nodes. The document will perform the appropriate actions for each platform. This SSM document performs patching operations on managed nodes for both security related and other types of updates. When the document is run, it uses the patch baseline specified as the "default" for an operating system type if no patch group is specified.

AWS-AmazonLinuxDefaultPatchBaseline approves all operating system patches that are classified as "Security" and that have a severity level of "Critical" or "Important". Also auto-approves all patches with a classification of "Bugfix". Patches are auto-approved 7 days after they are released or updated. It is only for Amazon Linux Operating system.

Conclusion: AWS-RunPatchBaseline works on Linux/Windows/Macos and perform patching operations for both security related and other types as well. If operating system is Amazon Linux, "Security" and OS patches that have a severity level of "Critical" or "Important", AWS-AmazonLinuxDefaultPatchBaseline will apply.

References:

AWS-RunPatchBaseline

AWS-AmazonLinuxDefaultPatchBaseline