All checks
High
EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation
Checks that Systems Manager Patch Manager reports no missing patches for the EC2 instance and none that failed to install in its last patching operation, so known fixes are not left off the instance. Patches are judged against the default baseline for its operating system, or its patch group's baseline.
- service
- SSM
- severity
- High
- scope
- evaluated in every region
How to fix it
- Interrupts service: With the default RebootOption, RebootIfNeeded, the instance restarts after Patch Manager installs any patch, so run it when a restart is acceptable.
In the console
Systems Manager → Run Command → AWS-RunPatchBaseline, with Operation set to Install
- Command document
- AWS-RunPatchBaseline
- Operation
- Install
- Targets
- This instance, selected manually rather than by tags or a resource group
With the AWS CLI
aws ssm send-command --document-name AWS-RunPatchBaseline --instance-ids <instance-id> --parameters Operation=Install --region <region>See which of your accounts this check is failing on.
Book a live scan