AWS Systems Manager - Automate Patching for Amazon EC2 Instances | Concept | Demo

Video will help us to understand how we can automate the patching of EC2 instances using AWS systems manager.
Amazon Link:- docs.aws.amazon.com/systems-m...
Prerequisites:- docs.aws.amazon.com/systems-m...
If you like the video please like , comment , share and subscribe the channel to get more updates on technical videos.
Channel Link:- / @cloud4devops
Happy Learning !!!

[@mpadma3450]

Hi Shashank, I watched your videos, well explained the topics. thank you.

[@nithin4457]

You made it look simple and clear. Thanks.

[@Cloud4DevOps]

Glad it helped

[@naveenm6642]

Big Thanks Shashank for your content and explanation .

[@Cloud4DevOps]

Welcome!

[@amarnathnachimuthu]

Wow!! explained in detail and thank you!

[@Cloud4DevOps]

glad you like it !!

[@David-jf4ee]

Man your videos are awesome.. thanks

[@Cloud4DevOps]

Thanks for feedback !!!

[@itzfarooq]

You are awesome!

[@Cloud4DevOps]

You too!! Thanks..

[@amitmitra8907]

Great lession keep it the gud work

[@Cloud4DevOps]

Thanks... Appreciate the feedback..

[@randanaCR]

Thanks a lot!!!

[@Cloud4DevOps]

Great !!!

[@namangarg86]

very nice video for begineer.

[@Cloud4DevOps]

Glad you think so!

[@utkarshpatel7839]

hi can you please help in my aws console i am not getting the "configure patching option" in patch manager just having the create policy and patch option .

[@KajaFax]

Hi Shashank. Does the run command task within the maintenance window need to be changed to use the same role you created at the start of the video? And does this need to be the same role as attached to the ec2 instance? Thanks!

[@Cloud4DevOps]

When it comes to role attachment to EC2 you just have to give SSM permission to make use of any SSM related command. For run command you have multiple ways , either you directly choose run command from Maint window or select explicit and use..

[@Joy-vo4ne]

A great video indeed! Very informative. What's the added procedure in order to patch ec2s across two or more multiple AWS accounts?

[@Cloud4DevOps]

there us multi account multi region option within SSM.. Select that and it will help u to manage..

[@devenpanchal9108]

Hi Shashank I have seen your few sessions. They are crisp and meaningful. Thanks. Is it possible to put PPT slides into Run Mode so it can be more legible. Thanks.

[@Cloud4DevOps]

sure will try to implement your suggestion. Thanks for feedback..

[@3197310173]

How to do this in terraform? I want to do the same using terraform. Any suggestions or similar video in terraform?

[@deepika346]

Hi, could you explain this using terraform. Needful that for urgency.

[@ibmuser13]

thanks for the video Shashank and the detailed explanation. One thing I failed to understand was the snapshot. What is that being used for? The updates are being installed on the ec2 instance itself correct?

[@Cloud4DevOps]

Updates are being installed on EC2 instance only , its just the mechanism of SSM which deals with the latest snapshot in background for updates from microsoft.

[@leemarositamil8477]

Can you please explain how to do, my instances are in stop action, I need to start my instance and do patching and again stop my instances?

[@Cloud4DevOps]

Its already been discussed on Linkedin..

[@ravikantchoudhry6740]

Awesome Explanation Shashank !! Will SSM work for immutable servers ? and its applicable for OS level patching only ? Can we use SSM for application level patching as well ?

[@Cloud4DevOps]

Yes we can

[@manojgariya0366]

Hi bro how to rollback AWS patch baseline in case update are not working

[@JosephDTV]

Can you use system manager to on prem server so i can eliminate sccm

[@Cloud4DevOps]

You can do that using SSM agent install on DC servers.. Then you can manage patching from SSM as well

[@vaibhavaggarwal3724]

Like you have created patch baseline, In my account i have multiple EC2 instances with Tags based on Env + AZ, now how to define the patch group based on these 2 tags, you did it using tag PRODUCTION only.

[@Cloud4DevOps]

If your tagging if diff , then you can create multiple tags and patch groups to define your patching systems.. Its not necessary that only one patch baseline is required , i just showed the concept on how it works.. This can be tweak as per your req,.

[@avdheshoracle]

Is it possible to to use script/cloudformation or any other CLI method to automate this as it will be time consuming if you do it using console.

[@Cloud4DevOps]

Most of time we use CLI with defined parameter to provision infrastructure , we have lot of cli module of CloudFormation which you can convert into script as per your requirement. AWS CLI:- docs.aws.amazon.com/cli/latest/reference/cloudformation/index.html

[@amoldoshi8831]

Hi Shashank, Really well explained .. thank you this video .. I need small guidance if you could help please .. As we have some applications running on linux ec2 instances. So i want to scheduled the patching at midnight so is there any way by which a script can run and stop the services before patching as pre-request and then start patching and post patching complete start the service again. Note - I tried for lifecycle hook policy but that is used only at patch now but cant find for schedule time.

[@Cloud4DevOps]

you can run a cron job which will stop services before patch and start after activity gets completed.

[@AnilKumar-gv9hw]

Hello Shashank, Content and presentation is Awesome. Thanks.

[@Cloud4DevOps]

Glad you liked it

[@irfan4701]

Can you please make a video where it automatically updates the autoscaling group and Launch Configuration/Launch Templated and new instance from the group should be created by patched AMI?

[@Cloud4DevOps]

You can use AWS-PatchASGInstance to patch ASG groups along with AMI patch.

[@kingsraj1]

You didn't mentioned of Noreboot and reboot option.If we have any Application running on the server how do we define the baseline to takecare of those.

[@Cloud4DevOps]

While configuring the patch you get option to NOReboot..

[@bhaskararaomacherla7205]

Hi Shashank, How AWS system manager going to download packages/patches from Microsoft for windows instances. Is there any internet access allows for instance ?

[@Cloud4DevOps]

SSM talks to internet outbound where it download patches into SSM inventory and from there patches gets installed on ur machine...

[@gourbhoi722]

Hi Shasank, There ate few linux servers onpremise which are version 7.x We are planning to migrated those to aws and then do OS upgrade to versio 8.x for those linux servers . Can we do it by Aws system manager or do we have any other way

[@Cloud4DevOps]

Use migration tool like cloud endure or App Migration Service from AWS. OS upgrade is diff activity cannot be done during migration as there is no tool present in market..

[@petesathianathan6548]

So question can I use AmazonSSMManagedInstanceCore as oppose to the one you choose?

[@Cloud4DevOps]

If you are talking regards to permission i would always prefer to run this as admin , create account and assign that with admin privileges . AmazonSSMManagedInstanceCore is use when you want to have explicit permission to use Systems Manager core service functionality It provides minimum permissions which allow the instance to: Register as a managed instance Send heartbeat information Send and receive messages for Run Command and Session Manager Retrieve State Manager association details Read parameters in Parameter Store

[@lockdownvibes2079]

Thanks for the video After it is completed, I checked those windows servers manually and checked updated history , there is nothing there and tried to check for update again and I could see cumulative is getting downloaded and install. Could you tell me why? My doubt is how to verify windows got cumulative install eventhough we see successful on run command on run patch baseline. Please help

[@Cloud4DevOps]

in terms of CU , if AWS SSM inventory has that update it will download and install on server , generally it takes few patches in terms of CU to come into inventory and then AWS SSM pushes the patch on server and update the server. You can find the patches installed on server from output section of run command which you can send to S3 and from there create report.. Somehow reporting system is not direct in SSM and you have to integrate few other services if you need it into ur mail or some other places.

[@leemarositamil8477]

Hello, Can we do the same thing in terraform ? Do you have any video or similar to that?

[@Cloud4DevOps]

Terraform is more of a infra provision tool from IAC category, you can integrate terraform with ansible to do this job. As of now i dont have video on that end.

[@anandvamsi5141]

Nice Tutorial Shashank..Lets say example i have 3 env{dev,uat,prd} is it possible to apply same patches all the 3 environments

[@Cloud4DevOps]

Thanks..Yes, you can apply the same patch across environments , thats why we have SSM patch using patchbaseline

[@murahariraoinuganti6887]

For "skip maintainence and patch" option will there be any down time ?

[@Cloud4DevOps]

Downtime depends upon the reboot section...

[@SenthilKumar-tt4xf]

Hi Shashank, How to install the patches for Windows instances if they are not connected to Internet.Is it possible to download the updates and save it in S3 bucket from there shall i install it. Could you help on how to copy the files from S3 bucket and run the .msi file in windows instances

[@Cloud4DevOps]

Sorry for Delay response as i was out and not. working on YT.. You can patches servers within private. subnets having no access to internet with help of endpoints.. Please go through.. Its good article from AWS. aws.amazon.com/blogs/mt/how-to-patch-windows-ec2-instances-in-private-subnets-using-aws-systems-manager/

[@chundurusriharsha2402]

What are the services(like ec2, eks, s3, route 53 etc) uses in system manager in AWS?

[@Cloud4DevOps]

AWS SSM has almost touches all services , so you name it you will get it..

[@chundurusriharsha2402]

@@Cloud4DevOps may I know what services does it touches?

[@leemarositamil8477]

My S3 bucket shows 0 object, how to get output logs in s3 bucket? I have same policy as you have.

[@Cloud4DevOps]

Check the permission please.

[@27deshraj]

hi , Nice explanation. Do u hv sample code for amazon linux 2 using cloudformation? this will help

[@Cloud4DevOps]

Thanks.. Its not handy as i create as per my usage..

[@arunmathuria321]

1. is there any way we can take EC2 instance snapshot before patching like we do with Vmware 2. Is there any option to reboot EC2 instance after server patching

[@Cloud4DevOps]

You can trigger SSM to take AMI before patch and while configuring the patch you get option to reboot or no reboot option..

[@SandeepSingh-hn6it]

Hi Sir, this is good ,Can you make it for UPTIME Incident Manager automatic alert to the customer once incident will resloved.

[@Cloud4DevOps]

Will try to cover soon.

[@venkateshgunda]

In console, manage instance is not visible ( and in header, only nodes is visible. Instance is not visible). Can you tell me, why it could happen?

[@Cloud4DevOps]

You need to instal SSM agent and IAM role to make it managed instances.

[@user-ny3fz7lh2v]

Qq, Why do we specify patch group both in patch baseline and also in maintenance window configuration? Didnt we already specify in the baseline the required patch group? Btw, nicee tutorial !!

[@Cloud4DevOps]

Thanks.. You have to specify patch group just to make backend configuration understand that these are the servers has to be patched. Again there are multiple way of doing the configuration.

[@tirushv9681]

how can someone create baseline with best practices like considering security ?

[@Cloud4DevOps]

Sorry for Delay response as i was out and not. working on YT.. You can create patch baseline of your own with the OS you are part of and application or software you want to update time to time with SSM.. Its on the configuration video of patch manger

[@tirushv9681]

@@Cloud4DevOps thanks man appreciated ❤️

[@SayyedJuned]

Hi Shashank explained very well 😍 Please help me I want to Patch all the instances in my organization but till now I don't know which patch or update should be installed and what will be impacted in the live environment of these patch. I'm new in system manager Please help me thanks

[@Cloud4DevOps]

You have to use MAINT WINDOW IN SSM to schedule patch. In terms of which patch needs to be updated as per your application dependency, thats something you/team need to decide as few patches are application dependent..

[@SayyedJuned]

@@Cloud4DevOps You means the team has to decide which type of update or patch needs to be installed? i have performed all the steps ok now tell me how do i verify that patch has been done on my machine or not ? i have windows OS only Please help me thanks

[@Cloud4DevOps]

@@SayyedJuned When SSM Patch the system you can either apply SNS notification which all patches are deployed on system , or you can integrate AWS config for better reporting.. Unfortunately SSM reporting is not that good where you get all detail at one place. Another way of finding out the report is SSM inventory..

[@amit15277]

Please make video on session manager

[@Cloud4DevOps]

its already there in SSM playlist. Please checkout

[@sandeepsahu1716]

How to apply patching for http url through AWS

[@Cloud4DevOps]

Are you referring to build update from AWS SSM for application??

[@maheshd5841]

Can we see what all patches installed?? I mean, patch list..

[@Cloud4DevOps]

You will see that in SSM logs on SSM dashboard or on server

[@maheshd5841]

Thanks, but can we export any report for audit point of you regarding list of patches installed on servers ??

[@Cloud4DevOps]

@@maheshd5841 Till date reporting system is not good for SSM , if you need to check out reports then send out logs. to S3 buckets or integrate AWS Config to do the reporting. You can check the patches as well in compliance section of SSM.

[@maheshd5841]

@@Cloud4DevOps Thanks for your information and appreciated...