AWS systems-manager medium security documentation change
Summary
Added a new 'Available security updates compliance status' configuration option and renumbered subsequent steps. The change explains how unapproved security patches are classified as compliant/non-compliant based on installation criteria.
Security assessment
The change introduces documentation about compliance status classification for security patches that aren't approved due to installation criteria. This directly relates to security patch management and compliance reporting, which are security-related processes. The example scenario highlights potential security implications where security patches might remain uninstalled due to configuration settings.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-create-a-patch-baseline-for-windows.md b/systems-manager/latest/userguide/patch-manager-create-a-patch-baseline-for-windows.md index b8007214c..b09acae4d 100644 --- a//systems-manager/latest/userguide/patch-manager-create-a-patch-baseline-for-windows.md +++ b//systems-manager/latest/userguide/patch-manager-create-a-patch-baseline-for-windows.md @@ -31 +31,5 @@ If you are accessing Patch Manager for the first time in the current AWS Region, - 7. If you want to begin using this patch baseline as the default for Windows as soon as you create it, select **Set this patch baseline as the default patch baseline for Windows Server instances** . + 7. For **Available security updates compliance status** , choose the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline, **Non-Compliant** or **Compliant**. + +Example scenario: Security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed. + + 8. If you want to begin using this patch baseline as the default for Windows as soon as you create it, select **Set this patch baseline as the default patch baseline for Windows Server instances** . @@ -39 +43 @@ For information about setting an existing patch baseline as the default, see [Se - 8. In the **Approval rules for operating systems** section, use the fields to create one or more auto-approval rules. + 9. In the **Approval rules for operating systems** section, use the fields to create one or more auto-approval rules. @@ -63 +67 @@ If you specify a compliance reporting level and the patch state of any approved - 9. (Optional) In the **Approval rules for applications** section, use the fields to create one or more auto-approval rules. + 10. (Optional) In the **Approval rules for applications** section, use the fields to create one or more auto-approval rules. @@ -89 +93 @@ If you specify a compliance reporting level and the patch state of any approved - 10. (Optional) If you want to explicitly approve any patches instead of letting patches be selected according to approval rules, do the following in the **Patch exceptions** section: + 11. (Optional) If you want to explicitly approve any patches instead of letting patches be selected according to approval rules, do the following in the **Patch exceptions** section: @@ -97 +101 @@ For information about accepted formats for lists of approved patches and rejecte - 11. If you want to explicitly reject any patches that otherwise meet your approval rules, do the following in the **Patch exceptions** section: + 12. If you want to explicitly reject any patches that otherwise meet your approval rules, do the following in the **Patch exceptions** section: @@ -111 +115 @@ For more information about rejected package actions, see [Rejected patch list op - 12. (Optional) For **Manage tags** , apply one or more tag key name/value pairs to the patch baseline. + 13. (Optional) For **Manage tags** , apply one or more tag key name/value pairs to the patch baseline. @@ -121 +125 @@ Tags are optional metadata that you assign to a resource. Tags allow you to cate - 13. Choose **Create patch baseline**. + 14. Choose **Create patch baseline**.