Deployment and Automation · Topic 5 of 7
Patching and Maintenance Windows
Patch fleets with Patch Manager, baselines and patch groups, schedule work in maintenance windows, and compare in place patching with replacing images.
- 4 min
- Patch Manager works through patch baselines, and AWS provides a default per operating system.
- The tag key
Patch Grouplinks instances to a baseline. AWS-RunPatchBaselineruns with Scan (report only) or Install.
What it is
Patching keeps operating systems and software free of known flaws. At scale you need a process that decides which patches are approved, which servers get them, and when they are installed.
AWS Systems Manager Patch Manager does the first two jobs, and maintenance windows do the third. Together they replace hand patching.
How it works
Patch baselines
A patch baseline defines which patches are approved for a node. AWS supplies a default baseline for each supported operating system, and you can create custom baselines.
A custom baseline can use rules based on classification (such as security) and severity, with an auto approval delay in days. It can also list patches that are always approved or always rejected. Linux baselines can also point to alternate repositories.
Patch groups
A patch group connects nodes to a baseline. You tag the instances with the key Patch Group and a value, such as web, and then register that value with a baseline. A node with no group uses the default baseline for its operating system.
Using separate groups lets you patch test servers first, then production after a delay, with different baselines.
Scan or install
The document AWS-RunPatchBaseline takes an Operation parameter.
| Operation | Effect |
|---|---|
| Scan | Checks which patches are missing and reports compliance, changes nothing |
| Install | Installs missing approved patches and may reboot the node |
# AWS CLI: install approved patches on a patch group
aws ssm send-command \
--document-name "AWS-RunPatchBaseline" \
--targets "Key=tag:Patch Group,Values=web" \
--parameters "Operation=Install"A reboot option controls whether the node restarts when needed. Patch compliance data appears in Systems Manager and can be sent to an S3 bucket for reports.
Maintenance windows
A maintenance window is a recurring time slot in which you allow disruptive work. It has these parts:
- Schedule: a cron or rate expression, with a duration and a cutoff (a point before the end after which no new tasks start).
- Targets: instances chosen by ID or tag.
- Tasks: what runs, such as Run Command, Automation, Lambda or Step Functions.
For example, a window can run AWS-RunPatchBaseline on Sunday at 02:00 for all nodes tagged for a production group.
If you do not need a controlled window, a State Manager association can run a scan on a regular schedule, or Patch Manager policies set up scanning and installing across accounts and Regions.
Patching other services
- RDS: a maintenance window setting decides when AWS applies required updates, and minor version upgrades can be automatic.
- Managed services such as Lambda and DynamoDB: AWS handles patching of the platform for you.
- Containers and AMIs: rebuild the image with updated packages instead of patching in place.
In place patching or replacement
| Approach | How | Fits |
|---|---|---|
| Patch in place | Patch Manager updates running servers | Long lived servers, pets |
| Replace with new image | Build a patched AMI, roll it out with an instance refresh | Auto Scaling groups, immutable design |
Replacement gives consistent, tested servers and makes rollback easy, but it needs an image pipeline.
A scenario with servers in several groups that need different patch timing points to patch groups (tags) plus separate maintenance windows.
What to remember for the exam
- Patch Manager works through patch baselines, and AWS provides a default per operating system.
- The tag key
Patch Grouplinks instances to a baseline. AWS-RunPatchBaselineruns with Scan (report only) or Install.- Auto approval delay approves a patch some days after release.
- Maintenance windows have schedule, duration, cutoff, targets and tasks.
- Task types include Run Command, Automation, Lambda and Step Functions.
- The nodes must be managed nodes, with the agent and role in place.
- Replacing instances with a new AMI is an alternative to patching in place.
- Compliance data shows which nodes are missing patches.
Common mistakes
Running Install in business hours. The node may reboot. Use a maintenance window.
Tagging errors. The key must be Patch Group with that exact spelling, or the node falls back to the default baseline.
Expecting Scan to fix anything. Scan only reports.
Patching instances inside an Auto Scaling group by hand. New instances launch from the old AMI and are unpatched again. Update the image.
Ignoring the cutoff. A task that has not started by the cutoff does not run in that window.
Patching production and test at the same time removes your safety net. Stagger the groups so a bad patch is found before it reaches production.
Check yourself
Answer these three.
How do you tell Patch Manager which baseline a server uses?
Tag the instance with a
Patch Groupvalue and register that patch group with the baseline.Which operation reports missing patches without installing them?
The Scan operation of
AWS-RunPatchBaseline.Why replace instances instead of patching an Auto Scaling group in place?
New instances start from the AMI, so an updated AMI keeps all instances consistent and patched.
Topic 5 of 7 in Deployment and Automation
Test yourself on Deployment and Automation
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.