Patch Installation Should Be Done On Systems Manager

Using Console

Using CLI

To remediate the misconfiguration of patch installation not being done on Systems Manager for AWS EC2 instances using AWS CLI, follow these steps:

Install and configure AWS CLI:
- If you haven’t already installed the AWS CLI, you can follow the instructions here: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html
Identify the EC2 instances that need patching:
- You can list all EC2 instances in your AWS account using the following AWS CLI command:
  aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId, State.Name]' --output table
Attach an IAM role with the necessary permissions to the EC2 instances:
- Create an IAM role with the necessary permissions for Systems Manager. You can create a role with the AmazonSSMManagedInstanceCore managed policy attached.
- Attach this IAM role to the EC2 instances that need patching. You can do this by modifying the instance attributes using the AWS CLI:
  aws ec2 modify-instance-attribute --instance-id <instance-id> --iam-instance-profile Name=<role-name>

Install the SSM Agent on the EC2 instances:

The Systems Manager requires the SSM Agent to be installed on the EC2 instances. You can automate the installation process using AWS Systems Manager Run Command or manually install the agent on each instance. Here is an example of how to install the agent using AWS Systems Manager Run Command:

aws ssm send-command --document-name "AWS-InstallAWSPatchInstallUnifiedAgent" --targets "Key=InstanceIds,Values=<instance-id>" --parameters '{"sourceType":["github"],"sourceInfo":["aws-quickstart/quickstart-awspatchbaseline"],"packageName":["awspatchbaseline"],"version":["latest"]}' --timeout-seconds 600 --max-concurrency "50" --max-errors "0" --output-s3-bucket-name "<bucket-name>" --output-s3-key-prefix "<prefix>"

Configure Patch Baseline in Systems Manager:
- Create a patch baseline in AWS Systems Manager to define the patching schedule and rules for your EC2 instances. You can do this using the AWS Management Console or AWS CLI.
- Here is an example of how to create a patch baseline using AWS CLI:
  aws ssm create-patch-baseline --name "MyPatchBaseline" --approval-rules "PatchRules=[{PatchFilterGroup:{PatchFilters=[{Key=PRODUCT,Values=[WindowsServer2019]},{Key=CLASSIFICATION,Values=[Critical,SecurityUpdates]}],PatchFilterGroupType=and}],ApproveAfterDays=7,ComplianceLevel=CRITICAL}"
Schedule patching for EC2 instances:
- You can schedule patching for your EC2 instances by creating a maintenance window in AWS Systems Manager and associating it with the patch baseline you created. You can do this using the AWS Management Console or AWS CLI.
- Here is an example of how to create a maintenance window using AWS CLI:
  aws ssm create-maintenance-window --name "MyMaintenanceWindow" --schedule "CronExpression=<cron-expression>" --duration 3 --cutoff 1 --allow-unassociated-targets

By following these steps, you can remediate the misconfiguration of patch installation not being done on Systems Manager for AWS EC2 instances using AWS CLI.

Using Python

To remediate the misconfiguration of not having patch installations done on AWS EC2 instances using Systems Manager, you can use the following Python script to automate the process:

Install the necessary Python libraries:

pip install boto3

Use the following Python script to create a patch baseline and schedule patch installations for your EC2 instances:

import boto3

# Initialize the boto3 client
ssm = boto3.client('ssm')

# Define the EC2 instance IDs for which you want to schedule patch installations
instance_ids = ['INSTANCE_ID_1', 'INSTANCE_ID_2']

# Create a patch baseline
response = ssm.create_patch_baseline(
    Name='MyPatchBaseline',
    OperatingSystem='WINDOWS',  # Change this to 'AMAZON_LINUX' if using Amazon Linux
    ApprovalRules={
        'PatchRules': [
            {
                'PatchFilterGroup': {
                    'PatchFilters': [
                        {
                            'Key': 'CLASSIFICATION',
                            'Values': ['Security']
                        }
                    ]
                },
                'ApproveAfterDays': 0
            }
        ]
    }
)

# Get the patch baseline ID
baseline_id = response['BaselineId']

# Create a patch group for the EC2 instances
response = ssm.register_target_with_maintenance_window(
    WindowId='MAINTENANCE_WINDOW_ID',
    ResourceType='INSTANCE',
    Targets=[
        {
            'Key': 'InstanceIds',
            'Values': instance_ids
        }
    ],
    OwnerInformation='Patch Group'
)

# Get the patch group ID
patch_group_id = response['WindowTargetId']

# Create a maintenance window task to install patches
response = ssm.register_task_with_maintenance_window(
    WindowId='MAINTENANCE_WINDOW_ID',
    Targets=[
        {
            'Key': 'WindowTargetIds',
            'Values': [patch_group_id]
        }
    ],
    TaskArn='AWS-RunPatchBaseline',
    TaskType='RUN_COMMAND',
    Priority=1,
    ServiceRoleArn='MAINTENANCE_WINDOW_ROLE_ARN',
    TaskInvocationParameters={
        'MaintenanceWindowRunCommandParameters': {
            'DocumentHash': 'DOCUMENT_HASH',
            'DocumentHashType': 'Sha256',
            'Parameters': {
                'Operation': ['Install'],
                'BaselineOverride': [baseline_id]
            }
        }
    }
)

# Get the maintenance window task ID
task_id = response['WindowTaskId']

print(f'Patch installations scheduled for EC2 instances {instance_ids} using Systems Manager with maintenance window task ID {task_id}')

Replace the following placeholders in the script:
- INSTANCE_ID_1, INSTANCE_ID_2: Replace these with the actual EC2 instance IDs for which you want to schedule patch installations.
- MAINTENANCE_WINDOW_ID: Replace this with the ID of the maintenance window in which you want to schedule the patch installations.
- MAINTENANCE_WINDOW_ROLE_ARN: Replace this with the ARN of the IAM role that has permissions to run Systems Manager tasks in the maintenance window.
- DOCUMENT_HASH: Replace this with the hash of the AWS-RunPatchBaseline document. You can get this from the Systems Manager Documents page in the AWS Management Console.
Run the Python script to create a patch baseline, register the EC2 instances in a patch group, and schedule patch installations using Systems Manager.

This script will help you automate the process of scheduling patch installations for your EC2 instances in AWS using Systems Manager.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Patch Installation Should Be Done On Systems Manager

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation