Patch Manager prerequisites
Make sure that you have met the required prerequisites before using Patch Manager, a capability of AWS Systems Manager.
SSM Agent version
Version 2.0.834.0 or later of SSM Agent is running on the managed node you want to manage with Patch Manager.
An updated version of SSM Agent is released whenever new capabilities are added to Systems Manager or
updates are made to existing capabilities. If an older version of the agent is running on a managed node, some SSM Agent processes can fail. For that reason, we recommend that you automate
the process of keeping SSM Agent up-to-date on your machines. For information, see Automating updates to SSM Agent. Subscribe to the SSM Agent
Release Notes
Connectivity to the patch source
If your managed nodes don't have a direct connection to the Internet and you're using an Amazon Virtual Private Cloud (Amazon VPC) with a VPC endpoint, you must ensure that the nodes have access to the source patch repositories (repos). On Linux nodes, patch updates are typically downloaded from the remote repos configured on the node. Therefore, the node must be able to connect to the repos so the patching can be performed. For more information, see How security patches are selected.
Windows Server managed nodes must be able to connect to the Windows Update Catalog or
Windows Server Update Services (WSUS). Confirm that your nodes have connectivity to the
Microsoft Update
Catalog
S3 endpoint access
Whether your managed nodes operate in a private or public network, without access to the required AWS managed Amazon Simple Storage Service (Amazon S3) buckets, patching operations fail. For information about the S3 buckets your managed nodes must be able to access, see SSM Agent communications with AWS managed S3 buckets and Step 6: (Optional) Create a Virtual Private Cloud endpoint.
Supported operating systems
The Patch Manager capability doesn't support all the same operating systems versions that are supported by other Systems Manager capabilities. For example, Patch Manager doesn't support CentOS 6.3 or Raspberry Pi OS 8 (Jessie). (For the full list of Systems Manager-supported operating systems, see Systems Manager prerequisites.) Therefore, ensure that the managed nodes you want to use with Patch Manager are running one of the operating systems listed in the following table.
| Operating system | Details |
|---|---|
|
Linux |
Managed nodes created from an Amazon Linux AMI that use a proxy must run a current
version of the Python
|
| macOS |
macOS 10.14.x (Mojave), 10.15.x (Catalina), and 11.3.1 & 11.4 (Big Sur) SSM Agent for AWS IoT Greengrass core devices is not supported on macOS. You can't use Patch Manager to patch macOS edge devices. |
|
Windows |
Windows Server 2008 through Windows Server 2019, including R2 versions. As of January 14, 2020, Windows Server 2008 is no longer supported for feature or security updates from Microsoft. Legacy Amazon Machine Images (AMIs) for Windows Server 2008 and 2008 R2 still include version 2 of SSM Agent preinstalled, but Systems Manager no longer officially supports 2008 versions and no longer updates the agent for these versions of Windows Server. In addition, SSM Agent version 3.0 might not be compatible with all operations on Windows Server 2008 and 2008 R2. The final officially supported version of SSM Agent for Windows Server 2008 versions is 2.3.1644.0. SSM Agent for AWS IoT Greengrass core devices is not supported on Windows 10. You can't use Patch Manager to patch Windows 10 edge devices. |
