Patch Manager for Linux and Windows

Start as usual, and add a small helper that waits for a Run Command to finish:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
.\Start-SsmEndpoints.ps1
function Wait-Command([string]$CommandId, [string]$InstanceId) {
  do { Start-Sleep 15; $st = aws ssm get-command-invocation --command-id $CommandId --instance-id $InstanceId --query Status --output text 2>$null } until ($st -in 'Success', 'Failed', 'Cancelled', 'TimedOut')
  $st
}

1Launch a server that needs patches

Paste this whole block. It picks an Amazon Linux 2023 image at least six months old:

$old = aws ec2 describe-images --owners amazon --include-deprecated --filters "Name=name,Values=al2023-ami-2023.*-kernel-6.1-x86_64" --query 'sort_by(Images,&CreationDate)[].[CreationDate,ImageId,Name]' --output text |
  ForEach-Object { $d, $id, $n = $_ -split "`t"; [pscustomobject]@{ Date = [datetime]$d; Id = $id; Name = $n } } |
  Where-Object { $_.Date -lt (Get-Date).AddMonths(-6) } | Select-Object -Last 1
$old.Name
$i = aws ec2 run-instances --image-id $old.Id --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=patch01},{Key=PatchGroup,Value=saat-web},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=27}]' --query "Instances[0].InstanceId" --output text
do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online')
$p

You should see something like this:

al2023-ami-2023.7.20250414.0-kernel-6.1-x86_64
Online

Teams don’t do this on purpose, but old images are common: an Auto Scaling group whose launch template nobody updated, or a server built from a “golden” AMI two years ago.

2Create a baseline and a patch group

Paste this whole block:

@'
{
  "PatchRules": [
    {
      "PatchFilterGroup": {
        "PatchFilters": [
          { "Key": "CLASSIFICATION", "Values": [ "Security" ] },
          { "Key": "SEVERITY", "Values": [ "Critical", "Important" ] }
        ]
      },
      "ApproveAfterDays": 7,
      "ComplianceLevel": "HIGH"
    }
  ]
}
'@ | Set-Content patch-rules.json
$pb = aws ssm create-patch-baseline --name saat-al2023 --operating-system AMAZON_LINUX_2023 --description "Security, Critical and Important, after 7 days" --approval-rules file://patch-rules.json --tags Key=course,Value=saatvedha-aws --query BaselineId --output text
aws ssm register-patch-baseline-for-patch-group --baseline-id $pb --patch-group saat-web | Out-Null
aws ssm describe-patch-groups --query "Mappings[].[PatchGroup,BaselineIdentity.BaselineName]" --output text

You should see this:

saat-web        saat-al2023

Waiting seven days before auto-approving gives the wider world time to find a bad patch before it reaches you. Emergency patches can still be added to the approved list by hand.

3Scan, then install

Paste this whole block (the install usually takes five to ten minutes, including a reboot):

$scan = aws ssm send-command --document-name AWS-RunPatchBaseline --targets "Key=tag:PatchGroup,Values=saat-web" --parameters Operation=Scan --comment "lesson 27 scan" --query Command.CommandId --output text
Wait-Command $scan $i
aws ssm describe-instance-patch-states --instance-ids $i --query "InstancePatchStates[0].[Operation,InstalledCount,MissingCount,FailedCount]" --output text
aws ssm describe-instance-patches --instance-id $i --filters Key=State,Values=Missing --query "Patches[:3].[Title,Severity]" --output text
$inst = aws ssm send-command --document-name AWS-RunPatchBaseline --targets "Key=tag:PatchGroup,Values=saat-web" --parameters "Operation=Install,RebootOption=RebootIfNeeded" --comment "lesson 27 install" --query Command.CommandId --output text
Wait-Command $inst $i
aws ssm describe-instance-patch-states --instance-ids $i --query "InstancePatchStates[0].[Operation,InstalledCount,MissingCount,FailedCount]" --output text

You should see something like this (your counts will differ):

Success
Scan    412     23      0
openssl-libs.x86_64:1:3.2.2-1.amzn2023.0.3      Important
kernel.x86_64:6.1.141-155.222.amzn2023          Important
glibc.x86_64:2.34-196.amzn2023.0.1              Important
Success
Install 435     0       0

Twenty-three approved security patches were missing, including the kernel, and now none are. You targeted by tag, so this would have patched every server in the group the same way. Check Systems Manager, then Patch Manager, then Compliance reporting in the console for the same view.

4Schedule Sunday-night patching

Paste this whole block:

$mw = aws ssm create-maintenance-window --name saat-sunday-patching --schedule "cron(0 2 ? * SUN *)" --schedule-timezone Asia/Kolkata --duration 3 --cutoff 1 --no-allow-unassociated-targets --tags Key=course,Value=saatvedha-aws --query WindowId --output text
$wt = aws ssm register-target-with-maintenance-window --window-id $mw --resource-type INSTANCE --targets "Key=tag:PatchGroup,Values=saat-web" --query WindowTargetId --output text
'{ "RunCommand": { "Parameters": { "Operation": [ "Install" ], "RebootOption": [ "RebootIfNeeded" ] } } }' | Set-Content mw-task.json
aws ssm register-task-with-maintenance-window --window-id $mw --task-type RUN_COMMAND --task-arn AWS-RunPatchBaseline --targets "Key=WindowTargetIds,Values=$wt" --task-invocation-parameters file://mw-task.json --max-concurrency 50% --max-errors 10% --priority 1 | Out-Null
aws ssm get-maintenance-window --window-id $mw --query "[Name,Schedule,ScheduleTimezone,NextExecutionTime]" --output text

You should see something like this:

saat-sunday-patching    cron(0 2 ? * SUN *)     Asia/Kolkata    2026-10-25T02:00+05:30

Every Sunday at 2 a.m. India time, half the servers in saat-web at a time get patched, and the run stops if more than 10 percent fail. The window closes new tasks one hour before its three-hour end, so nothing starts too late.

✅ Checkpoint: patch01 went from 23 missing patches to 0 using the saat-al2023 baseline, and saat-sunday-patching shows its next run. Keep everything for the break lab.