AWS AWSCloudFormation documentation change
Summary
Added detailed compliance state explanations for rejected patches and dependencies, including SCAN/INSTALL operation impacts.
Security assessment
Enhances documentation of patch compliance reporting mechanisms, which are part of security posture management. No evidence of addressing a specific vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-patchbaseline.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-patchbaseline.md index 17165b046..4cf7de7b1 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-patchbaseline.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-patchbaseline.md @@ -260 +260,10 @@ BLOCK -**All OSs** : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as `INSTALLED_REJECTED`. +**All OSs** : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. + +State value assignment for patch compliance: + + * If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as `INSTALLED_REJECTED`. + + * If an update attempts to install a dependency package that is now rejected by the baseline, when previous versions of the package were not rejected, the package being updated is reported as `MISSING` for `SCAN` operations and as `FAILED` for `INSTALL` operations. + + + @@ -313,0 +323,4 @@ For more information about using the `Ref` function, see [`Ref`](https://docs.aw +The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values. + +For more information about using the `Fn::GetAtt` intrinsic function, see [`Fn::GetAtt`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html). +