AWS Systems Manager
User Guide

Create a Patch Group

To help you organize your patching efforts, we recommend that you add instances to patch groups by using tags. Patch groups require use of the tag key Patch Group. You can specify any value, but the tag key must be Patch Group. For more information about patch groups, see About Patch Groups.

After you group your instances using tags, you must add the patch group value to a patch baseline. By registering the patch group with a patch baseline, you ensure that the correct patches are installed during the patching operation. For more information, see the next procedure Add a Patch Group to a Patch Baseline.

Add EC2 Instances to a Patch Group Using Tags

For EC2 instances, you can add tags by using the AWS Systems Manager console, the Amazon EC2 console, the AWS CLI command create-tags, or the API action CreateTags.

To add EC2 instances to a patch group (AWS Systems Manager console)

  1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

  2. In the navigation pane, choose Managed Instances.

  3. In the Managed instances list, choose a managed EC2 instance that you want to configure for patching.

  4. Choose View details.

  5. Select the Tags tab, then choose Edit.

  6. In the left column, type Patch Group.

  7. In the right column, enter a value that helps you understand which instances will be patched.

  8. Choose Save.

  9. Repeat this procedure to add other managed instances to the same patch group.

To add EC2 instances to a patch group (Amazon EC2 console)

  1. Open the Amazon EC2 console, and then choose Instances in the navigation pane.

  2. In the list of instances, choose an instance that you want to configure for patching.

  3. In the Actions menu, choose Instance Settings, Add/Edit Tags.

  4. If the instance already has one or more tags applied, choose Create Tag.

  5. For Key, type Patch Group.

  6. For Value, enter a value that helps you understand which instances will be patched.

  7. Choose Save.

  8. Repeat this procedure to add other instances to the same patch group.

To add EC2 instances to a patch group (AWS CLI)

  1. Install and configure the AWS CLI, if you have not already.

    For information, see Install or Upgrade and then Configure the AWS CLI.

  2. Run the following command to add the Patch Group tag to an EC2 instance.

    aws ec2 create-tags --resources "i-1234567890abcdef0" --tags "Key=Patch Group,Value=GroupValue"

Add Managed Instances to a Patch Group Using Tags

For hybrid managed instances (mi-*), you can add tags by using the AWS Systems Manager console, the AWS CLI command add-tags-to-resource, or the API action AddTagsToResource. You cannot add tags for hybrid managed instances using the Amazon EC2 console.

To add managed instances to a patch group (AWS Systems Manager console)

  1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

  2. In the navigation pane, choose Managed Instances.

  3. In the Managed instances list, choose a managed instance that you want to configure for patching.

  4. Choose View details.

  5. Select the Tags tab, then choose Edit.

  6. In the left column, type Patch Group.

  7. In the right column, enter a value that helps you understand which instances will be patched.

  8. Choose Save.

  9. Repeat this procedure to add other managed instances to the same patch group.

To add managed instances to a patch group (AWS CLI)

  1. Install and configure the AWS CLI, if you have not already.

    For information, see Install or Upgrade and then Configure the AWS CLI.

  2. Run the following command to add the Patch Group tag to a managed instance.

    aws ssm add-tags-to-resource --resource-type "ManagedInstance" --resource-id "mi-0123456789abcdefg" --tags "Key=Patch Group,Value=GroupValue"