Configuring SSM to include broader patching policies in AWS Patch Manager

Project Discussion Ubuntu on AWS
1

By default, AWS Systems Manager patches Ubuntu with its built-in baseline, which applies only security updates. Bug fixes and other regular updates are left out. This guide shows how to create a baseline that applies every update, or change one you already have, and how to put it into use.

What changes

To patch Ubuntu with every available update, create a custom patch baseline with Include non-security updates turned on, then point your instances at it.

The AWS default baseline for Ubuntu (AWS-UbuntuDefaultPatchBaseline) only installs updates from the release’s security pocket, such as jammy-security or noble-security. Bug fixes published only in -updates are skipped. AWS-provided baselines can’t be edited, so you need your own.

With non-security updates included, Patch Manager considers every repository enabled on the instance. That means -security, -updates, and also -backports, PPAs, third-party repositories and ESM (when the machine is attached to Ubuntu Pro).

We are going to cover how to create the full-updates Patch Baseline using AWS console and AWS CLI.

1. Using the AWS console

  1. Open Systems Manager, then Patch Manager, then the Patch baselines tab.
  2. Choose Create patch baseline.
  3. Give it a clear name, for example Ubuntu-AllUpdates, and set the Operating system to Ubuntu. Here you can also select if you want to set this baseline as default for Ubuntu instances.
  4. Under Approval rules, leave Products, Section and Priority set to All.
  5. Tick Include non-security updates. This is the setting that makes the difference.
  6. Pick a Compliance reporting level if you want missing patches to count as, say, High. Otherwise leave it unspecified.
  7. Choose Create patch baseline, and note its ID (it starts with pb-).

Leave Patch sources blank. A patch source replaces the instance’s own repositories for the patching run rather than adding to them. This is only needed if you have your own mirrors.

2. Using AWS CLI

Start writing the following approval rule in a file called rules.json. It mirrors the default baseline, except that EnableNonSecurity is true:

{
  "PatchRules": [
    {
      "PatchFilterGroup": {
        "PatchFilters": [
          { "Key": "PRIORITY", "Values": ["Required", "Important", "Standard", "Optional", "Extra"] }
        ]
      },
      "ComplianceLevel": "UNSPECIFIED",
      "ApproveAfterDays": 0,
      "EnableNonSecurity": true
    }
  ]
}

Then create the baseline. The command prints the new baseline ID:

aws ssm create-patch-baseline \
  --name "Ubuntu-AllUpdates" \
  --operating-system UBUNTU \
  --description "Ubuntu: security and non-security updates" \
  --global-filters 'PatchFilters=[{Key=PRODUCT,Values=[*]}]' \
  --approval-rules file://rules.json

Create or update a patch policy to use the new patch baseline

If you didn’t set the patch baseline as the default baseline for Ubuntu instances, you will need to associate it by updating or creating a new patch policy in the console and define the patching rules as usual. Then you will be able to associate your Patching Group to this policy or patch instances directly with the new or updated policy.

Other considerations

While normally a full upgrade will always work, keep in mind that SSM will use every repository enabled in the machine, including -backports and third party PPAs already installed. Always start with a smaller group to test and scale later.

Conclusion

Keeping instances up to date is one of the simplest ways to reduce risk. Security updates close known vulnerabilities, and regular updates bring bug fixes and stability improvements that security-only patching leaves out. Switching to a baseline that includes every update, tested on a small group and run in a maintenance window, keeps your Ubuntu fleet current without adding manual work.

Ubuntu Pro adds more security streams to your instances by adding security patches for important CVEs for thousands of packages installed from the Universe repository. It is free up to 5 machines, and its price on AWS depends on the infrastructure size.

Learn more about SSM:

1 Like