Question

A CloudOps engineer manages a fleet of 200 Linux EC2 instances tagged Environment=Production. Security policy requires that operating system patches be applied only during a defined window every Saturday between 2:00 AM and 4:00 AM UTC to minimize business impact. Patching must be automated, target instances by tag, and produce compliance reports without any manual intervention. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create an AWS Systems Manager patch baseline, define a patch group by tag, and configure a Maintenance Window with a registered target and the AWS-RunPatchBaseline task scheduled for Saturday 2:00-4:00 AM UTC.

Answer

Write a shell script that runs 'yum update' via cron on each instance and email the output to the security team every Saturday.

Answer

Use AWS Systems Manager Run Command to manually execute AWS-RunPatchBaseline against the tagged instances each Saturday morning.

Answer

Create an EventBridge scheduled rule that triggers a Lambda function to stop and start all instances every Saturday, forcing them to pull the latest patched AMI.