AWS systems-manager documentation change
Summary
Removed Raspberry Pi OS from Python 3 requirements and CentOS-related EnableNonSecurity flag instructions. Updated supported OS versions (removed older CentOS, Debian, Ubuntu, macOS, and Windows Server versions). Simplified Homebrew and macOS patching notes.
Security assessment
The changes primarily update supported OS versions and remove outdated configuration steps (e.g., EnableNonSecurity flag for CentOS). While dropping support for older OS versions (e.g., Windows Server 2008, CentOS 6) could indirectly relate to security (as unsupported OSes lack updates), the documentation change itself does not explicitly address a security vulnerability or mitigation. No concrete evidence of a specific security issue is mentioned in the diff.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-prerequisites.md b/systems-manager/latest/userguide/patch-manager-prerequisites.md index e3921bdaf..ba1d2f696 100644 --- a//systems-manager/latest/userguide/patch-manager-prerequisites.md +++ b//systems-manager/latest/userguide/patch-manager-prerequisites.md @@ -38 +38 @@ An updated version of SSM Agent is released whenever new tools are added to Syst -For macOS and most Linux operating systems (OSs), Patch Manager currently supports Python versions 2.6 - 3.10. The AlmaLinux, Debian Server, Raspberry Pi OS, and Ubuntu Server OSs require a supported version of Python 3 (3.0 - 3.10). +For macOS and most Linux operating systems (OSs), Patch Manager currently supports Python versions 2.6 - 3.10. The AlmaLinux, Debian Server, and Ubuntu Server OSs require a supported version of Python 3 (3.0 - 3.10). @@ -44,6 +43,0 @@ If your managed nodes don't have a direct connection to the Internet and you're -###### CentOS and CentOS Stream: Enable the `EnableNonSecurity` flag - -CentOS 6 and 7 managed nodes use Yum as the package manager. CentOS 8 and CentOS Stream nodes use DNF as the package manager. Both package managers use the concept of an update notice. An update notice is simply a collection of packages that fix specific problems. - -However, CentOS and CentOS Stream default repos aren't configured with an update notice. This means that Patch Manager doesn't detect packages on default CentOS and CentOS Stream repos. To allow Patch Manager to process packages that aren't contained in an update notice, you must turn on the `EnableNonSecurity` flag in the patch baseline rules. - @@ -73 +67 @@ The following command provides this permission for the specified user: -The Patch Manager tool doesn't support all the same operating systems versions that are supported by other Systems Manager tools. For example, Patch Manager doesn't support CentOS 6.3 or Raspberry Pi OS 8 (Jessie). (For the full list of Systems Manager-supported operating systems, see [Supported operating systems for Systems Manager](./operating-systems-and-machine-types.html#prereqs-operating-systems).) Therefore, ensure that the managed nodes you want to use with Patch Manager are running one of the operating systems listed in the following table. +The Patch Manager tool might not support all the same operating systems versions that are supported by other Systems Manager tools. (For the full list of Systems Manager-supported operating systems, see [Supported operating systems for Systems Manager](./operating-systems-and-machine-types.html#prereqs-operating-systems).) Therefore, ensure that the managed nodes you want to use with Patch Manager are running one of the operating systems listed in the following table. @@ -86 +79,0 @@ Linux | - * Amazon Linux 2012.03–2018.03 @@ -88 +80,0 @@ Linux | - * Amazon Linux 2022 @@ -90,3 +82 @@ Linux | - * CentOS 6.5–7.9, 8 _.x_ - * CentOS Stream 8, 9 - * Debian Server 8 _.x_ , 9 _.x_ , 10 _.x_ , 11 _.x_ , and 12 _.x_ + * Debian Server 11 _.x_ , and 12 _.x_ @@ -94,2 +84 @@ Linux | - * Raspberry Pi OS (formerly Raspbian) 9 (Stretch) - * Red Hat Enterprise Linux (RHEL) 6.5–8 _.x_ , 9 _.x_ , 10._x_ + * Red Hat Enterprise Linux (RHEL) 7.x–8 _.x_ , 9 _.x_ , 10._x_ @@ -97,2 +86 @@ Linux | - * SUSE Linux Enterprise Server (SLES) 12.0 and later 12 _.x_ versions; 15 _.x_ - * Ubuntu Server 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 20.10 STR, 22.04 LTS, 23.04, 23.10, 24.04, 24.10, and 25.04 + * Ubuntu Server 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 25.04 @@ -101 +89 @@ Linux | -macOS | _macOS is supported for Amazon EC2 instances only._ 11.3.1; 11.4–11.7 (Big Sur) 12.0–12.7 (Monterey) 13.0–13.7 (Ventura) 14 _.x_ (Sonoma) 15._x_ (Sequoia) +macOS | _macOS is supported for Amazon EC2 instances only._ 13.0–13.7 (Ventura) 14 _.x_ (Sonoma) 15._x_ (Sequoia) @@ -105 +93 @@ macOS | _macOS is supported for Amazon EC2 instances only._ 11.3.1; 11.4–11.7 -Patch Manager doesn't support operating system (OS) updates or upgrades for macOS, such as from 12 _.x_ to 13 _.x_ or 13.1 to 13.2. To perform OS version updates on macOS, we recommend using Apple's built-in OS upgrade mechanisms. For more information, see [Device Management](https://developer.apple.com/documentation/devicemanagement) on the Apple Developer Documentation website. +Patch Manager doesn't support operating system (OS) updates or upgrades for macOS, such as from 13.1 to 13.2. To perform OS version updates on macOS, we recommend using Apple's built-in OS upgrade mechanisms. For more information, see [Device Management](https://developer.apple.com/documentation/devicemanagement) on the Apple Developer Documentation website. @@ -114 +102 @@ Patch Manager requires Homebrew, the open-source software package management sys -Patching operations using Patch Manager fail to function correctly when Homebrew is not installed. Homebrew has discontinued support for macOS 10.14.x (Mojave) and 10.15.x (Catalina). As a result, patching operations using Patch Manager are not supported for these versions. +Patching operations using Patch Manager fail to function correctly when Homebrew is not installed. @@ -123 +111 @@ SSM Agent for AWS IoT Greengrass core devices is not supported on macOS. You can -Windows | Windows Server 2008 through Windows Server 2025, including R2 versions. +Windows | Windows Server 2012 through Windows Server 2025, including R2 versions. @@ -129,4 +116,0 @@ SSM Agent for AWS IoT Greengrass core devices is not supported on Windows 10. Yo -###### Windows Server 2008 support - -As of January 14, 2020, Windows Server 2008 is no longer supported for feature or security updates from Microsoft. Legacy Amazon Machine Images (AMIs) for Windows Server 2008 and 2008 R2 still include version 2 of SSM Agent preinstalled, but Systems Manager no longer officially supports 2008 versions and no longer updates the agent for these versions of Windows Server. In addition, SSM Agent version 3 might not be compatible with all operations on Windows Server 2008 and 2008 R2. The final officially supported version of SSM Agent for Windows Server 2008 versions is 2.3.1644.0. -