AWS systems-manager documentation change
Summary
Removed deprecated patch baselines (e.g., Amazon Linux 1, CentOS), updated OS version examples, clarified auto-approval delay behavior for specific OS, and emphasized use of supported OS versions.
Security assessment
The change adds security documentation by explicitly recommending 'supported versions' of operating systems, which is a security best practice to ensure systems receive updates. However, there is no evidence of a specific security vulnerability being addressed. The removal of outdated baseline references and updated examples reflect documentation maintenance rather than direct security fixes.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md b/systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md index fed43213c..8a81f09bc 100644 --- a//systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md +++ b//systems-manager/latest/userguide/patch-manager-predefined-and-custom-patch-baselines.md @@ -44 +43,0 @@ Name | Supported operating system | Details -`AWS-AmazonLinuxDefaultPatchBaseline` | Amazon Linux 1 | Approves all operating system patches that are classified as "Security" and that have a severity level of "Critical" or "Important". Also auto-approves all patches with a classification of "Bugfix". Patches are auto-approved 7 days after they are released or updated.¹ @@ -46 +44,0 @@ Name | Supported operating system | Details -`AWS-AmazonLinux2022DefaultPatchBaseline` | Amazon Linux 2022 | Approves all operating system patches that are classified as "Security" and that have a severity level of "Critical" or "Important". Patches are auto-approved seven days after release. Also approves all patches with a classification of "Bugfix" seven days after release. @@ -48 +45,0 @@ Name | Supported operating system | Details -`AWS-CentOSDefaultPatchBaseline` | CentOS and CentOS Stream | Approves all updates 7 days after they become available, including nonsecurity updates. @@ -52 +48,0 @@ Name | Supported operating system | Details -`AWS-DefaultRaspbianPatchBaseline` | Raspberry Pi OS | Immediately approves all operating system security-related patches that have a priority of "Required", "Important", "Standard," "Optional," or "Extra." There is no wait before approval because reliable release dates aren't available in the repositories. @@ -55 +50,0 @@ Name | Supported operating system | Details -`AWS-SuseDefaultPatchBaseline` | SUSE Linux Enterprise Server (SLES) | Approves all operating system patches that are classified as "Security" and with a severity of "Critical" or "Important". Patches are auto-approved 7 days after they are released or updated.¹ @@ -61 +56 @@ Name | Supported operating system | Details -¹ For Amazon Linux 1 and Amazon Linux 2, the 7-day wait before patches are auto-approved is calculated from an `Updated Date` value in `updateinfo.xml`, not a `Release Date` value. Various factors can affect the `Updated Date` value. Other operating systems handle release and update dates differently. For information to help you avoid unexpected results with auto-approval delays, see [How package release dates and update dates are calculated](./patch-manager-release-dates.html). +¹ For Amazon Linux 2, the 7-day wait before patches are auto-approved is calculated from an `Updated Date` value in `updateinfo.xml`, not a `Release Date` value. Various factors can affect the `Updated Date` value. Other operating systems handle release and update dates differently. For information to help you avoid unexpected results with auto-approval delays, see [How package release dates and update dates are calculated](./patch-manager-release-dates.html). @@ -82 +77 @@ If you create your own patch baseline, you can choose which patches to auto-appr - * **Operating system** : Windows Server, Amazon Linux, Ubuntu Server, and so on. + * **Operating system** : Supported versions of Windows Server, Amazon Linux, Ubuntu Server, and so on. @@ -84 +79 @@ If you create your own patch baseline, you can choose which patches to auto-appr - * **Product name**(for operating systems): For example, RHEL 6.5, Amazon Linux 2014.09, Windows Server 2012, Windows Server 2012 R2, and so on. + * **Product name**(for operating systems): For example, RHEL 7.5, Amazon Linux 2023 2023.8.20250808, Windows Server 2012, Windows Server 2012 R2, and so on. @@ -103 +98 @@ An auto-approval delay is the number of days to wait after the patch was release -If a Linux repository does not provide release date information for packages, Patch Manager uses the build time of the package as the date for auto-approval date specifications for Amazon Linux 1, Amazon Linux 2, SUSE Linux Enterprise Server (SLES), Red Hat Enterprise Linux (RHEL), and CentOS. If the build time of the package can't be determined, Patch Manager uses a default date of January 1st, 1970. This results in Patch Manager bypassing any auto-approval date specifications in patch baselines that are configured to approve patches for any date after January 1st, 1970. +If a Linux repository does not provide release date information for packages, Patch Manager uses the build time of the package as the date for auto-approval date specifications for Amazon Linux 2, and Red Hat Enterprise Linux (RHEL). If the build time of the package can't be determined, Patch Manager uses a default date of January 1st, 1970. This results in Patch Manager bypassing any auto-approval date specifications in patch baselines that are configured to approve patches for any date after January 1st, 1970.