SSM Command AWS-RunPatchBaseline fails on MacOS version 14.3

Question

We're running a Mac instance in EC2. It is running the SSM Agent version 3.3.859.0. Whenever I try to scan for patches (which runs the AWS-RunPatchBaseline command), it fails. The first warning is:
```
root [WARNING]: error reading default profile creds from ssm identity config: '[Errno 2] No such file or directory: '/var/lib/amazon/ssm/runtimeconfig/identity_config.json''
```
This file's location has changed to `opt/aws/ssm/runtimeconfig` I gather. Does the payload need to be updated?

Following that, an actual error appears:
```
root [ERROR]: An error occurred (UnsupportedOperatingSystem) when calling the GetDeployablePatchSnapshotForInstance operation: 
...
botocore.errorfactory.UnsupportedOperatingSystem: An error occurred (UnsupportedOperatingSystem) when calling the GetDeployablePatchSnapshotForInstance operation: 
...
raise PatchManagerError("Unsupported Operating System", ExitCodes.SNAPSHOT_UNSUPPORTED_OS, e)
```

The instance is using IMDSv2 and we have enabled Default Host Management Configuration, so it should not be a permissions issue. Further, there is no permissions error in the stack trace. It looks to me like there is a bug in the "baseline operations" script for handling MacOS vs Linux.

Riku_Kobayashi · Answer

Hello.

I'm sorry that this is not a direct solution, but I think it would be better to register it as an issue in the SSM Agent Github repository.  
https://github.com/aws/amazon-ssm-agent/issues

As SSM Agent should be usable on EC2 MacOS, as you anticipate, there's a possibility that the issue lies with the SSM Agent itself.  
https://docs.aws.amazon.com/systems-manager/latest/userguide/operating-systems-and-machine-types.html#prereqs-os-mac

As @Malini Agrawal suggests, there's a possibility that copying or moving files might improve the situation. However, please be cautious, as according to the documentation mentioned below, making changes to the installation directory could potentially cause the SSM Agent to stop working.  
https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent-technical-details.html#installation-directory  
> SSM Agent is installed at /var/lib/amazon/ssm/ (Linux and macOS) and %PROGRAMFILES%\Amazon\SSM\ (Windows Server). These installation directories contain critical files and folders used by SSM Agent, such as a credentials file, resources for inter-process communication (IPC), and orchestration folders. Nothing within the installation directory should be modified, moved, or deleted. Otherwise, SSM Agent might cease to function properly.

Malini Agrawal · Answer

1. Typical location SSM gent look for (/etc/aws/ssm/agent.conf) for Linux/MacOS. But you mentioned is changed to  opt/aws/ssm/runtimeconfig->Not default location. 
2. to resolve this issue-> move SSM Agent  configuration file to  (/etc/aws/ssm/agent.conf) also check credentials file at /var/lib/amazon/ssm/runtimeconfig.
3. restart SSM agent.

SSM Command AWS-RunPatchBaseline fails on MacOS version 14.3

Add your answer

Relevant content