Question

A financial services company runs a fleet of 400 EC2 instances across three AWS accounts for a legacy trading support application. A recent security audit found that critical OS patches were applied inconsistently, some instances were missing patches for weeks, and the operations team currently patches manually via SSH during maintenance windows. Leadership wants an automated, auditable solution that enforces a defined patch baseline, schedules patching during approved windows per environment, and provides centralized reporting on compliance status across all accounts with minimal ongoing operational effort. Which approach best meets these requirements?

Accepted Answer

Use AWS Systems Manager Patch Manager with custom patch baselines and patch groups, define Maintenance Windows per environment, and aggregate compliance data across accounts using a Systems Manager delegated administrator with Explorer/compliance dashboards.

Answer

Deploy a cron-based shell script via user data on each instance to run yum/apt update nightly, and push patch logs to a centralized S3 bucket for auditors to query with Athena.

Answer

Create an EventBridge scheduled rule per account that triggers a Lambda function to open SSH sessions to each instance, run patch commands, and record results in DynamoDB for reporting.

Answer

Bake fully patched AMIs monthly with EC2 Image Builder and replace all 400 instances via an Auto Scaling instance refresh, eliminating the need for any runtime patch compliance tracking.