Create an SSM maintenance window for patching - AMS Accelerate Operations Plan

Create an SSM maintenance window for patching

In AMS Accelerate patching, you have access to your SSM console where you configure your patching maintenance window.

Using the SSM Maintenance Window console, you configure the schedule for patching the instances. During patching, the system takes a snapshot of the root volume, which AMS Operations engineers use to restore the instance's root volume, if required. Additionally, an SSM OpsItem is created to track the failure.

To set up patching using a maintenance window, follow these steps:

  1. In the SSM console, select Maintenance Windows under the Change Management vs Actions & Change pane on the left side and then choose Create Maintenance Window on the top right of the screen. Configure the window:

    • Name: Provide a meaningful name for the maintenance window.

    • Schedule: Provide the rate of execution or cron expression for the maintenance windows. If Cron is selected, you can provide the offset in the Schedule offset section. For example, if you want to apply patching every Sunday after every patch Tuesday, the cron expression would be cron(0 30 23 ? * TUE#2 *) and the Schedule offset would be 5.

    • Cutoff: The maximum number of hours before the end of the scheduled patch window before starting a new patching command. This helps ensure that patching commands complete before the patch window ends. A new patching command can start running only within the patch window and before the specified cutoff. After the cutoff is reached, no new patching commands can be started.

    • Duration: The duration of the patch window in hours. The patch maintenance window should have at least two hours duration plus an additional hour per every 50 instances.

    • MaxConcurrency: The maximum number or rate (%) of instances allowed to patch in parallel.

    • MaxErrors: The maximum number or rate (%) of errors allowed before the patching stops being scheduled.

  2. Click Create maintenance window. This takes you back to the maintenance window home page. Select the newly created maintenance window.

  3. Go to the Targets tab, choose Register target.

    • (Optional) Provide a meaningful target name. This helps you identify this target. For example: application1-qa.

    • Patching windows can support either targeting from tags or choosing the instances manually

      • For a tag target under the Targets section, choose Specify instance tags.

      • Provide the tag key and value for the instance the patching maintenance window will target then choose Add (for example, ApplicationId (tag key), App1 (tag value)).

      • For instance target, under the Targets section, select Choose instances manually.

      • Select the instances you want to target.

    • Choose Register target.

  4. Go to the Tasks tab of the maintenance window and choose Register Task, then choose Register Automation Task.

    1. (Optional) Provide a meaningful task name. For example: AmsPatch.

    2. Under the Automation document, for the search box, choose Owner, then Shared documents.

    3. Choose in the search box, choose Document name prefix, Equals and type: AWSManagedServices-PatchInstance.

    4. Choose the document with the name identical to AWSManagedServices-PatchInstance.

    5. Under document version, choose Default version at runtime.

    6. Under the Targets section, select the target matching the name or the target registered previously.

    7. In the Rate control section, enter the concurrency and error threshold. AMS Accelerate recommends: concurrency-50%, error threshold-50%.

    8. In the IAM service role section, choose Use a custom service role, then choose the customer_ssm_automation_role. For the Input parameters:

      • InstanceId: {{TARGET_ID}}

      • StartInactiveInstance: True to start the instances if they are stopped

    9. Choose Register Automation task.

The patching maintenance window is created. Under the Description tab, you can see the Next execution time.