AWS systems-manager documentation change
Summary
Added detailed documentation about node detail tabs (Tags, Inventory, Associations, Patches, Configuration Compliance) in unified console. Enhanced explanation of patch states and compliance reporting.
Security assessment
Changes focus on improving documentation clarity about existing features (patch states, compliance reporting) rather than addressing vulnerabilities. While patches with 'Security' classification are mentioned, this describes existing functionality rather than introducing new security controls or addressing specific vulnerabilities.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-unified-console.md b/systems-manager/latest/userguide/systems-manager-unified-console.md index 0406428b3..47f59481c 100644 --- a//systems-manager/latest/userguide/systems-manager-unified-console.md +++ b//systems-manager/latest/userguide/systems-manager-unified-console.md @@ -7 +7 @@ -The unified Systems Manager console is a consolidated experience that combines various tools to help you complete common node tasks across multiple AWS accounts and AWS Regions in an AWS Organizations organization, or a single account and Region. Nodes can be EC2 instances, hybrid servers, or servers running in a multicloud environment. In the unified console, you're provided with detailed insights to your nodes. You can generate reports for your nodes, diagnose and remediate common issues that prevent nodes from reporting as managed by Systems Manager, like connectivity issues. In addition to summaries about your nodes, you can view specific details about a node. +The unified Systems Manager console is a consolidated experience that combines various tools to help you complete common node tasks across multiple AWS accounts and AWS Regions in an AWS Organizations organization, or a single account and Region. Nodes can be EC2 instances, hybrid servers, or servers running in a multicloud environment. In the unified console, you're provided with detailed insights to your nodes. You can generate reports for your nodes, diagnose and remediate common issues that prevent nodes from reporting as managed by Systems Manager, like connectivity issues. @@ -10,0 +11,2 @@ The unified Systems Manager console is a consolidated experience that combines v +In addition to summaries about your nodes on the **Review node insights** page, you can view specific details about a node from the **Explore nodes** page. + @@ -12,0 +15,35 @@ The unified Systems Manager console is a consolidated experience that combines v +###### Node details tabs + +When you select a node on the **Explore nodes** page, the node detail page provides a comprehensive overview of node details and additional information on a series of tabs: + + + +****Tags**** + + +(Optional) Manage resource tags to group and filter the managed node with other resources. Tags consist of a case-senstive key-value pair and are used to categorize resources in different ways, such as by purpose, owner, or environment. + +****Inventory**** + + +Displays metadata about the managed node, which you can view according to over 10 different inventory types. For example, when you select the type `AWS:Application`, the inventory filter results provide details about applications installed on the node, such as **Name** , **Version** , **Architecture** , and more. For more information about Inventory, see [AWS Systems Manager Inventory](./systems-manager-inventory.html). + +****Associations**** + + +An association is a resource type in State Manager that defines the target state for a managed node and maintains all managed nodes in your account in a consistent state. The association can define the commands, scripts, or policies to apply to which managed instances, and how often the association should run to ensure the nodes are match the defined configuration for the node. An association can drive compliance reporting of required states for resources in your account. For more information about State Manager and assocations, see [AWS Systems Manager State Manager](./systems-manager-state.html). + +****Patches**** + + +Displays metadata about the managed node, such as which patch baseline is assigned to the node and the total number of updates for packages that have been updated successfully, failed, or still required for installation. The **Patches** tab also reports details about patches available for the node based on the configuration requirements in the patch baseline, including the package **Name** , such as `libblockdev-crypto.x86_64`; **Classification** (such as `Bugfix` or `Security`); **Description** (showing the full patch title, such as `coreutils.x86_64:0:8.32-36.el9` and `java-11-amazon-corretto-headless-1:11.0.15+9-1.amzn2.x86_64`; and **Patch State** , such as `Installed`, `Installed_Pending_Reboot`, `Missing`, and `Failed`. + +###### Note + +Patch _states_ do not indicate whether or not a managed node is _compliant_. Patch compliance is not innately tied to patch states, nor is it defined by AWS, by operating system (OS) vendors, or by third parties such as security consulting firms. Instead, you define what patch compliance means for managed nodes in your organization or account in a _patch baseline_. For more information, see [What is compliance in Patch Manager?](./patch-manager.html#patch-manager-definition-of-compliance) and [Predefined and custom patch baselines](./patch-manager-predefined-and-custom-patch-baselines.html). + +****Configuration compliance**** + + +Reports patch compliance and configuration inconsistencies on the node (whether the state of a package on the managed node is `Compliant` or `Non-compliant` according to the definition of Compliant as defined in either a State Manager association or a Patch Manager patch baseline). You can filter configuration compliance results according to a package **ID** , **Compliance status** , **Compliance type** (`Association` or `Patch`), `Severity`, and different execution details. For related information, see [AWS Systems Manager Compliance](./systems-manager-compliance.html). + @@ -15 +52 @@ Whether you have nodes in multiple accounts and Regions in an organization, or n -Proceed to the next topics to set up your nodes to be managed by Systems Manager. To learn more about setting up your nodes for Systems Manager, see [Setting up managed nodes for AWS Systems Manager](./systems-manager-setting-up-nodes.html). After you've set up your nodes, you can set up Systems Manager and the unified console. To learn more about setting up Systems Manager, see [Setting up AWS Systems Manager](./systems-manager-setting-up-console.html). +For more information about setting up your nodes for Systems Manager, see [Setting up managed nodes for AWS Systems Manager](./systems-manager-setting-up-nodes.html). After you've set up your nodes, you can set up Systems Manager and the unified console. To learn more about setting up Systems Manager, see [Setting up AWS Systems Manager](./systems-manager-setting-up-console.html).