Automating patch updates for Windows instances through AWS System Manager

Aws System Manager have patch manger that automates the process of patching managed instances with security related and other type of updates.

1. we can use patch manager to apply patches for both OS amd Apps.
2. Patch Manager uses patch baselines which includes rules for auto approving patches,
3. SSM Agent must be installed on the instances that which you want to manage with patch Manager.

To do Patch updates we need instances to be Running .Lets Launch two windows instances.

Figure :Two instances in Running State

We need a Role for Accessing AWS System Manager.

Lets create a Role with the following Permision and attach it to the running instance.

Figure2 : Role for EC2

Patching can be done in 2 ways .

Using Default Patch baseLine:

Procedure:

step1:

Go to Patch Manager — — — — -> Patch BaseLine

step2:

Figure 3 : select instances to be patched

Figure 4:Schedule Patches

Figure :5 Select Patching Operation

Figure 6:instance scheduled for patching

On Demand patching:

The second way of doing patching is on Demand patching.

> Amazon system Manager uses Run command in Background.

> It creates Snapshots in BackGround which has all the patches installed on it

if we need to patch instances instantly we can click on PATCHNOW

in our case we are patching 2 instances .

Figure 7: patching onDemand instances.

Figure 10: successful Patching of both instances.

Figure 12 :Scheduled patching And on demand patching

Configuring our Own Patch BaseLines:

step1:

Go to AWS system Manager — → Patch Manager — → Create Patch BAseLine

Figure 13: Creating own BaseLine

Figure 14:creating own patch BaswLine

Figure 15: Setting Rules for Patch BaseLine

Figure 16:selecting specific instances based on Tags.

Figure 17: Baseline ID for new Patch baseLine

Figure :18 Final view for patch baseline

Conclusion:

Aws System Manager with the help of Path Manager Automation helps us to Create our own patch BaseLine and also for creating Default Patch BaseLines and on Demand Patch BaseLines.