Patching your systems regularly is crucial to maintain security and compliance while preventing vulnerabilities. AWS Systems Manager Patch Manager provides an efficient, automated way to patch your instances. This blog will walk you through:

• Creating a Patch Baseline
• Setting Up Patching with Quick Setup
• Using the "Patch Now" Feature for On-Demand Patching

Let's dive into the details!

What is Patching in AWS Systems Manager?

AWS Systems Manager Patch Manager automates patching for Amazon EC2 instances and on-premises servers. It helps you apply critical updates to operating systems and software while adhering to compliance standards.

1. Creating a Patch Baseline

A patch baseline defines the rules for patch approval. Follow these steps to create your own:

Steps to Create a Patch Baseline:

• Navigate to Patch Manager:
• Open the AWS Management Console.
• Go to Systems Manager > Patch Manager.
• Create Your Baseline:
• Click Patch baselines > Create patch baseline.
• Configure the baseline:
• Name: Give it a meaningful name, like My-Prod-Patch-Baseline.
• OS: Choose the operating system (e.g., Amazon Linux, Windows, Ubuntu).
• Approval Rules: Set criteria for:
• Patch classifications (e.g., Security, Critical).
• Auto-approval delay (e.g., 7 days after release).
• Rejected Patches: Optionally, exclude specific patches.
• Save the Baseline:



• Optionally set it as the default baseline for the chosen OS.
• Save your baseline.

2. Setting Up Patching with Quick Setup

Quick Setup simplifies the configuration of patching across multiple instances.

Steps to Configure Quick Setup:

• Access Quick Setup:
• In Systems Manager, go to Quick Setup.
• Create a Patch Configuration:
• Use an AWS-Managed Patch Baseline or your custom baseline.
• Define a compliance scan schedule.
• Assign target instances using tags or resource groups.
• Deploy the Configuration:



• Review and click Create to deploy.

3. On-Demand Patching with "Patch Now"

The "Patch Now" feature allows you to patch instances immediately.

Steps to Use Patch Now:

• Launch Patch Now:
• Go to Patch Manager > Patch Now.
• Select Instances:
• Choose target instances by tags or manually select them.
• Select Patch Baseline:
• Use your default or custom patch baseline.
• Run or Schedule:
• Choose Run Now to initiate patching immediately.
• Monitor progress in the Automation Executions section.

4. Monitoring Patch Compliance

Once patching is complete, verify compliance using these tools:

• Compliance Dashboard: Go to Systems Manager > Compliance for detailed reports.
• Automation Executions: Monitor patching tasks in Automation Executions.

Best Practices for AWS Patching

• Tag Your Instances: Group resources using tags for easy management.
• Test Patches in Non-Prod: Apply patches in a non-production environment first.
• Schedule Downtime: Perform patching during off-peak hours.
• Enable Notifications: Set up Amazon SNS for patching updates.

Conclusion

AWS Systems Manager simplifies and automates patching, reducing the administrative burden. By creating custom baselines, setting up configurations with Quick Setup, and using Patch Now for on-demand patching, you can ensure your infrastructure is always secure and compliant.

Start patching smarter with AWS Systems Manager today! 🚀