Instructor: So now let's see an overview
of the SSM Patch Manager.
So we use the Patch Manager to automate the process
of patching our managed instances.
This includes OS updates, applications updates,
and security updates.
Of course, it supports both EC2 instances
and on-premises server
and Linux, macOS, and Windows.
You're going to patch on-demand
so you can run the Patch Manager as you want
or on the schedule if you want to use a Maintenance Window.
What's going to happen is that the Patch Manager
will scan the instances
and will generate a patch compliance report,
which is a list of all the missing patches,
and then this report can be sent to S3.
And then we can act upon this report.
So Patch Manager has two components we need to know about,
which is the number one is the Patch Baseline,
and the number two is Patch Groups.
So Patch Baseline defines
which patches should and shouldn't be installed
on your EC2 instances and the ability
to create custom Patch Baseline is up to you
if you want to specify approved or rejected patches
on your instance.
The patches can also be auto-approved
within days of their release
in case someone is not there to approve them.
By default,
the patch baseline is to install only critical patches
and patches related to security
onto your SSM managed instances.
Now for Patch Group,
this is to associate a set of instances
with a specific Patch Baseline.
So if you define custom patch baselines,
then you can create Patch Groups to associate them together.
And for example,
you can have a Patch Group for dev, test, and prod.
Now instances when using patch groups
should be defined with the tag key Patch Group
and an instance at any time therefore can only be part
of one Patch Group.
And the Patch Group can only be registered
with one Patch Baseline.
So hopefully that makes sense,
but I made this diagram for you.
So we have three types of EC2 instances, okay,
all running the SSM agents.
The number ones are going to be tagged
with OS, Windows; Patch Group, Dev.
Number two is OS, Windows.
Number three is OS, Windows; Patch Group, Prod, okay.
And in Patch Manager, we're going to define Patch Baselines.
So the first Patch Baseline is attached
to the default Patch Group,
which is when a Patch Group is not defined by default, okay.
And this is default yes,
so any instance
that doesn't have a specific Patch Group is going
to get the first Patch Baseline ID.
And the second one is running the Patch Group Dev,
which is not a default Patch Baseline,
and we have a specific Patch Baseline ID.
So thanks to this tagging, the first instance,
which is under Patch Group Dev is going
to have the PB nine, eight, whatever Patch Baseline ID.
And the other two are going
to have the PB zero, one, two, three Patch Baseline ID
because they are not patched,
tagged with the Patch Group Dev, okay.
So here we are going to run a command
and this command is going to be
running a documents called AWS-RunPatchBaseline, okay.
And this can be initiated from the console,
the SDK or the Maintenance Window.
And then the run command itself will be applied
to all these EC2 instances
from within, obviously, to install the patches.
Now the SSN agents on these instances will query
to the Patch Manager service to get an idea
of which patches to include and to run
thanks to the Patch Baseline.
So this may seem complicated,
but hopefully it's something you understand.
And then obviously you can have rate control
just like anything in SSM using a Maintenance Window.
So talking about Maintenance Windows,
this is when you want to define a schedule
for when to perform actions on your instances.
For example, OS patching, updating drivers
and installing software.
For example, this could be done
at night between 3:00 and 5:00 AM
and a Maintenance Window contains a schedule,
a duration and a set of registered instances,
as well as a set of tasks
that can be run during that Maintenance Window.
So hopefully that makes sense.
From an exam perspective,
what you need to know is that Patch Manager is used
to patch your instances,
but that comes, I guess, naturally.
And these patches can be run
within a specific maintenance window
with a specific rate control if you need to.
Okay, that's it.
I will see you in the next lecture.