AWS cli high security documentation change

Service: cli · 2026-06-19 · Security-related high

File: cli/latest/reference/sagemaker/update-cluster.md

Summary

Added documentation for AutoPatchConfig and ImageReleaseVersion parameters to support automatic OS security patching in SageMaker clusters

Security assessment

The change introduces AutoPatchConfig for automatic OS security patching, which directly addresses security vulnerabilities through timely patching. The configuration includes patching strategies, scheduling, deployment rollback policies, and alarm monitoring - all security-focused mechanisms to maintain instance security.

Diff

diff --git a/cli/latest/reference/sagemaker/update-cluster.md b/cli/latest/reference/sagemaker/update-cluster.md
index 7f71c9172..7d90b0b14 100644
--- a//cli/latest/reference/sagemaker/update-cluster.md
+++ b//cli/latest/reference/sagemaker/update-cluster.md
@@ -15 +15 @@
-  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.8 Command Reference](../../index.html) »
@@ -874,0 +875,131 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/sagema
+>> 
+>> AutoPatchConfig -> (structure)
+>>
+>>> The configuration for automatic OS security patching. If present, the system automatically applies PATCH AMI updates to this instance group.
+>>> 
+>>> PatchingStrategy -> (string) [required]
+>>>
+>>>> The strategy for applying patches to instances in the group.
+>>>> 
+>>>> Possible values:
+>>>> 
+>>>>   * `WhenIdle`
+>>>>   * `WhenAllIdle`
+>>>> 
+
+>>> 
+>>> PatchSchedule -> (structure)
+>>>
+>>>> The schedule for automatic patching, including the next patch date.
+>>>> 
+>>>> NextPatchDate -> (timestamp)
+>>>>
+>>>>> The date and time of the next scheduled automatic patch. The system sets this automatically when a patch is detected. Use this field to reschedule the patch to a different date.
+>>> 
+>>> DeploymentConfig -> (structure)
+>>>
+>>>> The deployment configuration for rolling patch updates, including rollback settings and batch sizes. Only applicable when using a rolling patching strategy.
+>>>> 
+>>>> RollingUpdatePolicy -> (structure)
+>>>>
+>>>>> The policy that SageMaker uses when updating the AMI versions of the cluster.
+>>>>> 
+>>>>> MaximumBatchSize -> (structure) [required]
+>>>>>
+>>>>>> The maximum amount of instances in the cluster that SageMaker can update at a time.
+>>>>>> 
+>>>>>> Type -> (string) [required]
+>>>>>>
+>>>>>>> Specifies whether SageMaker should process the update by amount or percentage of instances.
+>>>>>>> 
+>>>>>>> Possible values:
+>>>>>>> 
+>>>>>>>   * `INSTANCE_COUNT`
+>>>>>>>   * `CAPACITY_PERCENTAGE`
+>>>>>>> 
+
+>>>>>> 
+>>>>>> Value -> (integer) [required]
+>>>>>>
+>>>>>>> Specifies the amount or percentage of instances SageMaker updates at a time.
+>>>>>>> 
+>>>>>>> Constraints:
+>>>>>>> 
+>>>>>>>   * min: `1`
+>>>>>>> 
+
+>>>>> 
+>>>>> RollbackMaximumBatchSize -> (structure)
+>>>>>
+>>>>>> The maximum amount of instances in the cluster that SageMaker can roll back at a time.
+>>>>>> 
+>>>>>> Type -> (string) [required]
+>>>>>>
+>>>>>>> Specifies whether SageMaker should process the update by amount or percentage of instances.
+>>>>>>> 
+>>>>>>> Possible values:
+>>>>>>> 
+>>>>>>>   * `INSTANCE_COUNT`
+>>>>>>>   * `CAPACITY_PERCENTAGE`
+>>>>>>> 
+
+>>>>>> 
+>>>>>> Value -> (integer) [required]
+>>>>>>
+>>>>>>> Specifies the amount or percentage of instances SageMaker updates at a time.
+>>>>>>> 
+>>>>>>> Constraints:
+>>>>>>> 
+>>>>>>>   * min: `1`
+>>>>>>> 
+
+>>>> 
+>>>> WaitIntervalInSeconds -> (integer)
+>>>>
+>>>>> The duration in seconds that SageMaker waits before updating more instances in the cluster.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `3600`
+>>>>> 
+
+>>>> 
+>>>> AutoRollbackConfiguration -> (list)
+>>>>
+>>>>> An array that contains the alarms that SageMaker monitors to know whether to roll back the AMI update.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `1`
+>>>>>   * max: `10`
+>>>>> 
+
+>>>>> 
+>>>>> (structure)
+>>>>>
+>>>>>> The details of the alarm to monitor during the AMI update.
+>>>>>> 
+>>>>>> AlarmName -> (string) [required]
+>>>>>>
+>>>>>>> The name of the alarm.
+>>>>>>> 
+>>>>>>> Constraints:
+>>>>>>> 
+>>>>>>>   * min: `1`
+>>>>>>>   * max: `255`
+>>>>>>>   * pattern: `(?!\s*$).+`
+>>>>>>> 
+
+>> 
+>> ImageReleaseVersion -> (string)
+>>
+>>> The version of the HyperPod-managed AMI to use for the instance group. Uses semantic versioning in the format `MAJOR.MINOR.PATCH` (for example, `1.2.3` ). If omitted, the latest available version is used.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `0`
+>>>   * max: `64`
+>>>   * pattern: `[0-9]+\.[0-9]+\.[0-9]+`
+>>> 
+
@@ -1099,0 +1231,26 @@ JSON Syntax:
+        "AutoPatchConfig": {
+          "PatchingStrategy": "WhenIdle"|"WhenAllIdle",
+          "PatchSchedule": {
+            "NextPatchDate": timestamp
+          },
+          "DeploymentConfig": {
+            "RollingUpdatePolicy": {
+              "MaximumBatchSize": {
+                "Type": "INSTANCE_COUNT"|"CAPACITY_PERCENTAGE",
+                "Value": integer
+              },
+              "RollbackMaximumBatchSize": {
+                "Type": "INSTANCE_COUNT"|"CAPACITY_PERCENTAGE",
+                "Value": integer
+              }
+            },
+            "WaitIntervalInSeconds": integer,
+            "AutoRollbackConfiguration": [
+              {
+                "AlarmName": "string"
+              }
+              ...
+            ]
+          }
+        },
+        "ImageReleaseVersion": "string",
@@ -2140 +2297 @@ ClusterArn -> (string)
-  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.8 Command Reference](../../index.html) »