Question

A CloudOps engineer manages a fleet of Amazon Linux 2 EC2 instances using AWS Systems Manager Patch Manager. Company policy requires that security patches classified as 'Critical' and 'Important' be automatically approved only after a 7-day soak period following their release, while all other patches remain unapproved. The engineer must ensure the fleet uses these rules instead of the AWS default behavior. What should the engineer configure?

Accepted Answer

Create a custom patch baseline with approval rules that auto-approve Critical and Important patches after a 7-day auto-approval delay, and associate it with the instances via a patch group.

Answer

Use Run Command with the AWS-RunPatchBaseline document and specify the 7-day delay as a parameter at execution time.

Answer

Modify the AWS-provided default patch baseline directly to add a 7-day approval delay for Critical and Important patches.

Answer

Store the approval delay value in Parameter Store and reference it from a State Manager association that runs patching daily.