Set Up Scheduled EC2 Instance Patching

A configuration guide for setting up the necessary configuration for AWS Systems Manager Patch Manager to automatically scan and/or apply patches to EC2 instances in an AWS environment.

Scheduling and Automation

AWS Systems Manager Maintenance Windows let you define a schedule for when to perform potentially disruptive actions on your instances such as patching an operating system, updating drivers, or installing software or patches.

The main configuratin items for a Maintenance Window: 

  • Schedule: Define the recurring schedule, start time, duration, and cutoff time for the window. 
  • Targets: Define the target EC2 instances associated with this window (Based on Tags).
  • Tasks: Define the tasks that are run during the window.

Maintenance Window Schedule

Define Targets

Define Task Settings

Enable Logging (Optional)

Enable Notifications (Optional)

Patch Baseline

A patch baseline defines which patches are approved for installation on your instances. You can specify approved or rejected patches one by one. You can also create auto-approval rules to specify that certain types of updates (for example, critical updates) should be automatically approved.

Predefined Patch Baselines

Custom Patch Baseline (Optional)