AWS imagebuilder: Document broadening Windows UpdateOS update coverage via Microsoft Update
Summary
Fixes YAML quoting of `fileNamePattern` values and adds guidance on expanding the set of Windows updates UpdateOS installs by registering the Microsoft Update service with the Windows Update Agent before the UpdateOS step, including a sample ExecutePowerShell step.
Security assessment
The change is patching/hardening guidance: it explains how to broaden the update search so UpdateOS installs more Microsoft product updates (drivers, Office, SQL Server), which improves patch coverage. It documents a security-relevant best practice but does not address a specific vulnerability or CVE.
Evidence
+To have **UpdateOS** also install updates for other Microsoft products, opt in to the Microsoft Update service on the instance before the **UpdateOS** step runs. These products include drivers, Microsoft Office, and SQL Server. To opt in, add an earlier ExecutePowerShell (Windows) step in the same component that registers the Microsoft Update service with the Windows Update Agent.
Diff
diff --git a/imagebuilder/latest/userguide/toe-action-modules.md b/imagebuilder/latest/userguide/toe-action-modules.md index ca6a800d0..4a14705c3 100644 --- a//imagebuilder/latest/userguide/toe-action-modules.md +++ b//imagebuilder/latest/userguide/toe-action-modules.md @@ -1651 +1651 @@ Input Key name | Description | Type | Required | Default value | Acceptable valu - fileNamePattern: *log + fileNamePattern: '*log' @@ -1660 +1660 @@ Input Key name | Description | Type | Required | Default value | Acceptable valu - fileNamePattern: *log + fileNamePattern: '*log' @@ -2659,0 +2660,26 @@ For Linux, you can specify one or more packages to be excluded from the list of +**Expand the set of Windows updates that UpdateOS installs** + +On Windows, **UpdateOS** searches for and installs every update that applies to the instance. The search includes only updates that are not hidden and not already installed. The search draws from the update services that are registered on the instance with the Windows Update Agent, the Windows component that manages update sources. By default, the only registered service is the Windows Update service. This service provides operating system updates only. + +The `include` and `exclude` inputs filter the results of that search. These inputs select updates from, or remove updates from, the set that the search already returned. They cannot add an update that the search did not return. To install a broader set of updates than the default, you broaden what the search covers instead of changing the filters. + +To have **UpdateOS** also install updates for other Microsoft products, opt in to the Microsoft Update service on the instance before the **UpdateOS** step runs. These products include drivers, Microsoft Office, and SQL Server. To opt in, add an earlier ExecutePowerShell (Windows) step in the same component that registers the Microsoft Update service with the Windows Update Agent. After you opt in, the **UpdateOS** search returns the additional updates. Your `include` and `exclude` filters then apply to that broader set. + +The following component document step uses PowerShell to register the Microsoft Update service: + + + - name: OptInToMicrosoftUpdate + action: ExecutePowerShell + onFailure: Abort + maxAttempts: 3 + inputs: + commands: + - | + $serviceManager = New-Object -ComObject Microsoft.Update.ServiceManager + # Register the Microsoft Update service by using its public service ID + $serviceManager.AddService2('7971f918-a847-4430-9279-4a52d1efe18d', 7, '') | Out-Null + +###### Note + +The Microsoft Update service ID `7971f918-a847-4430-9279-4a52d1efe18d` is a well-known public identifier that Microsoft defines. This **ExecutePowerShell** step must appear before the **UpdateOS** step in the component so that you opt in before the update search runs. +