AWS systems-manager documentation change
Summary
Added documentation about compliance status handling for unapproved security updates in Windows Server environments
Security assessment
Documents security patch compliance configuration options but doesn't fix a vulnerability. Explains security-related compliance management features.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md b/systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md index bb1dd6155..fed43213c 100644 --- a//systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md +++ b//systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md @@ -122,0 +123,6 @@ This means that the managed node is compliant in terms of Systems Manager operat + * For Windows Server only, an available security update patch that is not approved by the patch baseline can have a compliance value or `Compliant` or `Non-Compliant`, as defined in a custom patch baseline. + +When you create or update a patch baseline, you choose the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline. For example, security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed. + +Using the console to create or update a patch baseline, you specify this option in the **Available security updates compliance status** field. Using the AWS CLI to run the [create-patch-baseline](https://docs.aws.amazon.com/cli/latest/reference/ssm/create-patch-baseline.html) or [update-patch-baseline](https://docs.aws.amazon.com/cli/latest/reference/ssm/update-patch-baseline.html) command, you specify this option in the `available-security-updates-compliance-status` parameter. +