AWS systems-manager medium security documentation change
Summary
Simplified documentation about patch group tagging by removing detailed CLI examples and consolidating requirements. Removed specific guidance about using 'PatchGroup' (no space) when allowing tags in EC2 instance metadata.
Security assessment
Original text contained security guidance about using 'PatchGroup' (no space) when allowing tags in EC2 instance metadata to prevent unintended exposure. Removal of this guidance could lead to misconfigurations where users might expose sensitive tag data via instance metadata.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-patch-groups.md b/systems-manager/latest/userguide/patch-manager-patch-groups.md index f9d014c03..96f963878 100644 --- a/systems-manager/latest/userguide/patch-manager-patch-groups.md +++ b/systems-manager/latest/userguide/patch-manager-patch-groups.md @@ -5 +5 @@ -Using tags to define patch groupsHow it works +How it works @@ -17,35 +17 @@ You can use a _patch group_ to associate managed nodes with a specific patch bas -When you run `AWS-RunPatchBaseline` or other SSM Command documents for patching, you can target managed nodes using their ID or tags. SSM Agent and Patch Manager then evaluate which patch baseline to use based on the patch group value that you added to the managed node. - -## Using tags to define patch groups - -You create a patch group by using tags applied to your Amazon Elastic Compute Cloud (Amazon EC2) instances and non-EC2 nodes in a [hybrid and multicloud](./operating-systems-and-machine-types.html#supported-machine-types) environment. Note the following details about using tags for patch groups: - - * A patch group must be defined using either the tag key `Patch Group` or `PatchGroup` applied to your managed nodes. When registering a patch group for a patch baseline, any identical _values_ specified for these two keys are interpreted to be part of the same group. For instance, say that you have tagged five nodes with the first of the following key-value pairs, and five with the second: - - * `key=PatchGroup,value=DEV` - - * `key=Patch Group,value=DEV` - -The Patch Manager command to create a baseline combines these 10 managed nodes into a single group based on the value `DEV`. The AWS CLI equivalent for the command to create a patch baseline for patch groups is as follows: - - aws ssm register-patch-baseline-for-patch-group \ - --baseline-id pb-0c10e65780EXAMPLE \ - --patch-group DEV - -Combining values from different keys into a single target is unique to this Patch Manager command for creating a new patch group and not supported by other API actions. For example, if you run [send-command](https://docs.aws.amazon.com/cli/latest/reference/ssm/send-command.html) actions using `PatchGroup` and `Patch Group` keys with the same values, you are targeting two completely different sets of nodes: - - aws ssm send-command \ - --document-name AWS-RunPatchBaseline \ - --targets "Key=tag:PatchGroup,Values=DEV" - - aws ssm send-command \ - --document-name AWS-RunPatchBaseline \ - --targets "Key=tag:Patch Group,Values=DEV" - - * There are limits on tag-based targeting. Each array of targets for `SendCommand` can contain a maximum of five key-value pairs. - - * We recommend that you choose only one of these tag key conventions, either `PatchGroup` (without a space) or `Patch Group` (with a space). However, if you have [allowed tags in EC2 instance metadata](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#allow-access-to-tags-in-IMDS) on an instance, you must use `PatchGroup`. - - * The key is case-sensitive. You can specify any _value_ to help you identify and target the resources in that group, for example "web servers" or "US-EAST-PROD", but the key must be `Patch Group` or `PatchGroup`. - - +When you run `AWS-RunPatchBaseline`, you can target managed nodes using their ID or tags. SSM Agent and Patch Manager then evaluate which patch baseline to use based on the patch group value that you added to the managed node. @@ -52,0 +19 @@ Combining values from different keys into a single target is unique to this Patc +You create a patch group by using Amazon Elastic Compute Cloud (Amazon EC2) tags. Unlike other tagging scenarios across Systems Manager, a patch group _must_ be defined with the either the tag key `Patch Group` or `PatchGroup`. The key is case-sensitive. You can specify any value to help you identify and target the resources in that group, for example "web servers" or "US-EAST-PROD", but the key must be `Patch Group` or `PatchGroup`.