# Ensure EC2 Instances Managed by Systems Manager Are Compliant with Patching Requirements - Source: https://support.icompaas.com/support/solutions/articles/62000233554-ensure-ec2-instances-managed-by-systems-manager-are-compliant-with-patching-requirements - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability** - **Level 2** #### **Description** AWS Systems Manager Patch Manager automates the process of scanning and patching managed EC2 instances. It ensures compliance with predefined patch baselines that include rules for auto-approving critical and security updates. Regular compliance checks ensure that the infrastructure remains secure and up-to-date, mitigating vulnerabilities effectively. #### **Rationale** - Enhanced Security: Prevents exploitation of vulnerabilities by applying critical patches in a timely manner. - Compliance: Ensures alignment with security best practices, governance frameworks, and regulatory requirements. - Risk Mitigation: Reduces the risk of data breaches or downtime due to known vulnerabilities. #### **Impact** **Pros:** - Keeps EC2 instances secure against vulnerabilities. - Automates patching tasks, reducing operational overhead. - Improves visibility into the compliance status of managed instances. **Cons:** - May require downtime for applying updates or reboots. - Initial configuration of patch baselines and maintenance windows can take time. #### **Default Value** By default, EC2 instances are not automatically patched or monitored for compliance. Patch compliance must be explicitly configured through AWS Systems Manager. #### **Pre-Requisite** IAM Permissions Required: - ssm:DescribeInstanceInformation - ssm:ListComplianceSummaries - ssm:CreatePatchBaseline - ssm:StartComplianceScan #### **Remediation** #### **Test Plan:** **Using AWS Console:** 1. Sign in to the AWS Management Console. 2. Navigate to Systems Manager > Compliance. 3. Under the Patch Compliance section, review non-compliant instances and identify gaps. **Using AWS CLI:** 1. List all managed instances: aws ssm describe-instance-information --query "InstanceInformationList\[\*\].{InstanceId:InstanceId,ManagedBy:PingStatus}" 2. Check compliance summaries: aws ssm list-compliance-summaries --query "ComplianceSummaryItems\[\*\].{ResourceId:ResourceId,Status:Status}" #### **Implementation Steps:** **Using AWS Console:** 1. Create a Patch Baseline: - Go to Patch Manager in Systems Manager. - Create a custom patch baseline with rules for auto-approving critical/security updates and rejection parameters for unwanted patches. 2. Assign the Baseline: - Link the patch baseline to instances using tags or instance IDs. 3. Schedule Patching: - Define maintenance windows to automate patch installations and scans. - Assign tasks for patch compliance evaluations and installations. 4. Monitor Compliance: - Navigate to Compliance to monitor the patching status of managed instances. **Using AWS CLI:** 1. Create a Custom Patch Baseline: aws ssm create-patch-baseline --name --operating-system --approval-rules file://rules.json 2. Assign the Baseline to a Patch Group: aws ssm register-patch-baseline-for-patch-group --baseline-id --patch-group 3. Trigger Compliance Scans: aws ssm start-compliance-scan --instance-ids 4. Monitor Compliance Status: bashaws ssm list-compliance-summaries #### **Backout Plan** **Using AWS Console:** 1. If patching causes issues, sign in to the AWS Management Console. Navigate to Systems Manager, go to Patch Manager, and remove the current patch baseline. 2. Revert to an earlier version of the patch baseline or modify the baseline to exclude the problematic patches. 3. Monitor the EC2 instances to ensure they return to a compliant state. Using AWS CLI: 1. To revert changes to the patch baseline, delete the current baseline: aws ssm delete-patch-baseline --baseline-id --region 2. Create a new baseline with the required patches: aws ssm create-patch-baseline --name "RevertedBaseline" --approved-patches --region #### **References** - [AWS Systems Manager Compliance Documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-compliance.html) - [Configuring AWS Systems Manager Patch Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html) - [Patch Manager Best Practices](https://aws.amazon.com/blogs/mt/patching-your-windows-ec2-instances-using-aws-systems-manager-patch-manager/) #### **CIS Controls**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	7.4	Apply Security Patches – Ensure timely application of critical and security patches.	●	●	●
v8	4.4	Log and Monitor Remedial Actions – Monitor patch compliance status and track patch application progress.	●	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.