Welcome to another episode of 'Back to Basics'.
I am Zaiba Jamadar, a solutions architect at AWS
and today we will talk about how to automate patching
of your EC2 instances using AWS Systems Manager.
Now, first, let's start by understanding
why do Enterprise customers want to automate patching of the EC2 instances.
Enterprise customers often run a large number of EC2 instances.
It could be hundred or thousand instances
which run a number of different applications on it.
Batching a large number of instances manually
takes a long time
and there is a scope for mistakes,
which is why companies want to automate the process.
Additionally, some of these applications are critical applications -
that is, that application cannot be patched randomly,
and patching needs to be done within a certain amount of time.
This is where customers can utilize the features
of Systems Manager like Systems Manager,
that is SSM Patch Manager, Maintenance Window,
and Patch Groups to automate the patching
of their EC2 instances to minimize downtime.
Now, let's look at the end-to-end architecture
of how we can leverage AWS Systems Manager Patch Manager
to automate patching of your EC2 instances.
Firstly, you can create patch groups for different environments.
That is your tagged instances
such as development, testing, and production.
When you log on to the console,
under SSM Patch Manager,
go to "Configure Patching" option.
You can select a Patch Group
and you can also select a Maintenance Window.
SSM Patch Manager has a predefined patch baseline
that approves all patches classified as critical,
critical updates or security updates
with a severity of critical or important.
A patch baseline defines which patches should
or shouldn't be installed on your instances.
You can specify approved or rejected patches
or use auto approval rules
to ensure that certain types of updates, like critical updates,
are automatically applied to your patches.
You can also create your own patch baseline.
You can also ensure that
by using different auto approval delays to different patch groups,
you can deploy patches at a different rate to different instances.
You can select the patch baseline that you want to use
to patch different patch groups.
You can also use AWS SSM Maintenance Windows
which lets you define a schedule
for when to perform potentially disruptive actions
like patching your operating system,
updating drivers, or installing software.
Each maintenance window has a schedule,
a duration, a set of registered targets, and a set of registered tasks.
Typically, you want to apply your patches at a time
when there is least impact to your organization.
For the Maintenance Window,
specify the Run Command document
for the task which is your AWS RunPatchBaseline.
You can also set other options like error threshold and so on.
You can view results and patch compliance details
on Manage Instance page by selecting the Inventory tab
and filtering by AWS Patch Summary
and AWS Patch Compliance.
And that is it. Your instances are patched.
In conclusion, you can create your patch baselines,
which defines which patches should or shouldn't be installed on your instances.
After you create these baselines,
you can control the deployment of these baselines
to different environments like production,
test and development environments.
To minimize the downtime to your organization,
you can also use maintenance windows.
Check out the below links for more information.
See you next time.