Question

A SysOps administrator manages 200 EC2 instances tagged Environment=Production. Security requires that all critical and important OS patches be applied automatically on the second Sunday of each month between 02:00 and 05:00 UTC, with a report of compliance afterward. The administrator has already created a patch baseline that approves the required patch classifications. What is the most appropriate way to schedule and enforce this recurring patching?

Accepted Answer

Create a Systems Manager Maintenance Window with a cron schedule, register the instances as targets using the tag, and register the AWS-RunPatchBaseline task with Operation=Install.

Answer

Create an EventBridge rule with a cron expression that invokes a Lambda function which calls SSM SendCommand for AWS-RunPatchBaseline on each instance individually.

Answer

Use State Manager to associate AWS-RunPatchBaseline with the tagged instances on a rate-based schedule of every 30 days with Operation=Scan.

Answer

Configure Patch Manager to run AWS-RunPatchBaseline as a one-time Run Command with Operation=Install and rely on Patch Manager to repeat it monthly automatically.