AWS systems-manager medium security documentation change
Summary
Added troubleshooting guidance for external reboot interruptions during patching
Security assessment
Documents how external reboots (including for security features like SecureBoot) can cause false patching failures. This impacts security posture by potentially causing misreported compliance status. Provides explicit mitigation steps to verify actual patch status, directly addressing security operations visibility.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-troubleshooting.md b/systems-manager/latest/userguide/patch-manager-troubleshooting.md index c4e5ca839..6db9db8a1 100644 --- a//systems-manager/latest/userguide/patch-manager-troubleshooting.md +++ b//systems-manager/latest/userguide/patch-manager-troubleshooting.md @@ -92 +92,5 @@ You can also use the AWS Command Line Interface (AWS CLI) to check for concurren -If you determine that conflicting patching operations weren't the cause of the failure in this scenario, we recommend contacting AWS Support. +**Possible cause** : When patching managed nodes, the document execution may be interrupted and marked as failed even though patches were successfully installed. This can occur if the system initiates an unexpected reboot during the patching operation (for example, to apply updates to firmware or features like SecureBoot). The SSM Agent cannot persist and resume the document execution state across external reboots, resulting in the execution being reported as failed. + +**Solution** : To verify patch installation status after a failed execution, run a `Scan` patching operations, then check the patch compliance data in Patch Manager to assess the current compliance state. + +If you determine that conflicting patching operations or external reboots weren't the cause of the failure in this scenario, we recommend contacting AWS Support.