All checks
High
EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation
Verifies that Systems Manager patch compliance on EC2 instances shows a compliant status.
- service
- SSM
- severity
- High
- scope
- evaluated in every region
How to fix it
Install the missing patches, so Patch Manager reports no missing and no failed patches for the instance: AWS-RunPatchBaseline with Operation set to Install applies whatever the instance's applicable baseline approves, and a patch that baseline does not approve stays missing. Expect a reboot, because Patch Manager restarts the node whenever it installed anything. A failed count is a different problem: those patches were attempted and would not install, so the same run repeats the failure rather than clearing it.
In the console
Systems Manager → Run Command → AWS-RunPatchBaseline, with Operation set to Install
With the AWS CLI
aws ssm send-command --document-name AWS-RunPatchBaseline --instance-ids <instance-id> --parameters Operation=Install --region <region>See which of your accounts this check is failing on.
Book a demo