Patch groups

Important

Patch groups are not used in patching operations that are based on patch policies. For information about working with patch policies, see Patch policy configurations in Quick Setup.

You can use a patch group to associate managed nodes with a specific patch baseline in Patch Manager, a capability of AWS Systems Manager. Patch groups help ensure that you're deploying the appropriate patches, based on the associated patch baseline rules, to the correct set of nodes. Patch groups can also help you avoid deploying patches before they have been adequately tested. For example, you can create patch groups for different environments (such as Development, Test, and Production) and register each patch group to an appropriate patch baseline.

When you run AWS-RunPatchBaseline, you can target managed nodes using their ID or tags. SSM Agent and Patch Manager then evaluate which patch baseline to use based on the patch group value that you added to the managed node.

You create a patch group by using Amazon Elastic Compute Cloud (Amazon EC2) tags. Unlike other tagging scenarios across Systems Manager, a patch group must be defined with the either the tag key Patch Group or PatchGroup. The key is case-sensitive. You can specify any value to help you identify and target the resources in that group, for example "web servers" or "US-EAST-PROD", but the key must be Patch Group or PatchGroup.

After you create a patch group and tag managed nodes, you can register the patch group with a patch baseline. Registering the patch group with a patch baseline ensures that the nodes within the patch group use the rules defined in the associated patch baseline.

For more information about how to create a patch group and associate the patch group to a patch baseline, see Creating and managing patch groups and Add a patch group to a patch baseline.

To view an example of creating a patch baseline and patch groups by using the AWS Command Line Interface (AWS CLI), see Tutorial: Patch a server environment using the AWS CLI. For more information about Amazon EC2 tags, see Tag your Amazon EC2 resources in the Amazon EC2 User Guide.

How it works

When the system runs the task to apply a patch baseline to a managed node, SSM Agent verifies that a patch group value is defined for the node. If the node is assigned to a patch group, Patch Manager then verifies which patch baseline is registered to that group. If a patch baseline is found for that group, Patch Manager notifies SSM Agent to use the associated patch baseline. If a node isn't configured for a patch group, Patch Manager automatically notifies SSM Agent to use the currently configured default patch baseline.

Important

A managed node can only be in one patch group.

A patch group can be registered with only one patch baseline for each operating system type.

You can't apply the Patch Group tag (with a space) to an Amazon EC2 instance if the Allow tags in instance metadata option is enabled on the instance. Allowing tags in instance metadata prevents tag key names from containing spaces. If you have allowed tags in EC2 instance metadata, you must use the tag key PatchGroup (without a space).

Diagram 1: General example of patching operations process flow

The following illustration shows a general example of the processes that Systems Manager performs when sending a Run Command task to your fleet of servers to patch using Patch Manager. These processes determine which patch baselines to use in patching operations. (A similar process is used when a maintenance window is configured to send a command to patch using Patch Manager.)

The full process is explained below the illustration.

In this example, we have three groups of EC2 instances for Windows Server with the following tags applied:

EC2 instances group	Tags
Group 1	key=OS,value=Windows key=PatchGroup,value=DEV
Group 2	key=OS,value=Windows
Group 3	key=OS,value=Windows key=PatchGroup,value=QA

For this example, we also have these two Windows Server patch baselines:

Patch baseline ID	Default	Associated patch group
pb-0123456789abcdef0	Yes	Default
pb-9876543210abcdef0	No	DEV

The general process to scan or install patches using Run Command, a capability of AWS Systems Manager, and Patch Manager is as follows:

1. Send a command to patch: Use the Systems Manager console, SDK, AWS Command Line Interface (AWS CLI), or AWS Tools for Windows PowerShell to send a Run Command task using the document AWS-RunPatchBaseline. The diagram shows a Run Command task to patch managed instances by targeting the tag key=OS,value=Windows.

2. Patch baseline determination: SSM Agent verifies the patch group tags applied to the EC2 instance and queries Patch Manager for the corresponding patch baseline.

   • Matching patch group value associated with patch baseline:

     1. SSM Agent, which is installed on EC2 instances in group one, receives the command issued in Step 1 to begin a patching operation. SSM Agent validates that the EC2 instances have the patch group tag-value DEV applied and queries Patch Manager for an associated patch baseline.

     2. Patch Manager verifies that patch baseline pb-9876543210abcdef0 has the patch group DEV associated and notifies SSM Agent.

     3. SSM Agent retrieves a patch baseline snapshot from Patch Manager based on the approval rules and exceptions configured in pb-9876543210abcdef0 and proceeds to the next step.

   • No patch group tag added to instance:

     1. SSM Agent, which is installed on EC2 instances in group two, receives the command issued in Step 1 to begin a patching operation. SSM Agent validates that the EC2 instances don't have a Patch Group or PatchGroup tag applied and as a result, SSM Agent queries Patch Manager for the default Windows patch baseline.

     2. Patch Manager verifies that the default Windows Server patch baseline is pb-0123456789abcdef0 and notifies SSM Agent.

     3. SSM Agent retrieves a patch baseline snapshot from Patch Manager based on the approval rules and exceptions configured in the default patch baseline pb-0123456789abcdef0 and proceeds to the next step.

   • No matching patch group value associated with a patch baseline:

     1. SSM Agent, which is installed on EC2 instances in group three, receives the command issued in Step 1 to begin a patching operation. SSM Agent validates that the EC2 instances have the patch group tag-value QA applied and queries Patch Manager for an associated patch baseline.

     2. Patch Manager doesn't find a patch baseline that has the patch group QA associated.

     3. Patch Manager notifies SSM Agent to use the default Windows patch baseline pb-0123456789abcdef0.

     4. SSM Agent retrieves a patch baseline snapshot from Patch Manager based on the approval rules and exceptions configured in the default patch baseline pb-0123456789abcdef0 and proceeds to the next step.

3. Patch scan or install: After determining the appropriate patch baseline to use, SSM Agent begins either scanning for or installing patches based on the operation value specified in Step 1. The patches that are scanned for or installed are determined by the approval rules and patch exceptions defined in the patch baseline snapshot provided by Patch Manager.

More info

• Patch compliance state values