Question

A SysOps administrator manages a fleet of Amazon Linux 2 EC2 instances using AWS Systems Manager Patch Manager. The security team requires that only patches that have been publicly available for at least 7 days are installed, to avoid deploying unstable updates. The administrator must configure this behavior without manually reviewing each patch. What is the most appropriate way to meet this requirement?

Accepted Answer

Create a custom patch baseline with an approval rule that sets an auto-approval delay of 7 days for the desired patch classifications and severities.

Answer

Use the default AWS-provided patch baseline and configure a maintenance window that runs 7 days after each patch release.

Answer

Create a State Manager association that scans instances and manually approves patches that are older than 7 days.

Answer

Add each approved patch to the custom baseline's explicitly approved patches list every week using a Run Command document.