Patching practices

AWS provides several services that facilitate patch management:

• AWS Systems Manager: This service provides a suite of tools to automate the process of patching. The Systems Manager Patch Manager automates the process of patching managed instances with both security-related and other types of updates.
• Amazon Inspector: Amazon Inspector can automatically assess applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, it informs the customer of the security findings.

AWS Systems Manager Patch Manager

Patch Manager, a capability of AWS Systems Manager, enables you to automate the process of patching your EC2 instances and on-premises servers and VMs registered with Systems Manager.

Key Features:

• Automated Patching: Schedule patching based on maintenance windows.
• Patch Baselines: Define which patches are approved for installation to ensure consistency across the environment.
• Patch Groups: Group instances to apply specific patch baselines.

How to Configure Patch Manager:

1. Create a Patch Baseline: Define the rules for auto-approval and the list of approved and rejected patches.
2. Define Patch Groups: Assign instances to patch groups by tagging your instances.
3. Schedule Maintenance Windows: Set up a maintenance window to define when patches should be applied.
4. Execute Patching: Run the AWS-RunPatchBaseline document to apply patches.

For example, to automate patching with AWS Systems Manager State Manager, you might create an association like:

Resources:
PatchAssociation:
Type: “AWS::SSM::Association”
Properties:
DocumentVersion: “AWS-RunPatchBaseline”
InstanceId: “i-1234567890abcdef0”
Name: “AWS-RunPatchBaseline”
Parameters:
Operation: “Install”
ScheduleExpression: “rate(7 days)”

Amazon Inspector

While not a patch management tool per se, Amazon Inspector is vital in the patch management process, providing insights into where patches may be needed.

How to Use Amazon Inspector:

1. Install Agents: Install the Amazon Inspector Agent on your EC2 instances.
2. Define Assessment Targets: Group your Amazon EC2 instances that need assessment.
3. Create an Assessment Template: Set up a template for your assessment runs.
4. Run Assessments: Evaluate the security and compliance of the instances.

Patching Strategies

Rolling Updates

For applications running in an Auto Scaling group, implement rolling updates to maintain availability:

1. Increase the size of the Auto Scaling group.
2. Update the instances with new patches.
3. Replace the old instances with patched instances.

Immutable Infrastructure

Instead of patching running instances, replace the entire environment with a newly patched version. This can be achieved by:

• AWS Elastic Beanstalk: Deploy an application on a new platform configuration with the latest patches.
• AWS CloudFormation: Use CloudFormation templates to launch new stacks with patched AMIs.

Blue/Green Deployments

Reduce downtime and risk by running two identical production environments:

1. Blue Environment: Running the unpatched existing version.
2. Green Environment: Running the updated patched version.

After testing, switch traffic to the Green environment.

Patch Compliance Monitoring

Monitoring is an integral part of patch management. AWS Systems Manager provides patch compliance visualization through its dashboard. It helps identify instances that are missing patches or do not comply with the patch baseline.

{
“type”: “PatchCompliance”,
“resource”: “instance”,
“complianceType”: “AWS:PatchCompliance”,
“patchSummary”: {
“patchGroup”: “MyPatchGroup”,
“baselineUsed”: “arn:aws:ssm:us-east-1:123456789012:patchbaseline/pb-0abc123abc123abc1”
},
“filters”: [
{
“key”: “PatchGroup”,
“values”: [“MyPatchGroup”]
}
],
“columns”: [
“instanceId”,
“ipAddress”,
“patchGroup”,
“state”
]
}

In conclusion, efficient patch management is a key component for securing your AWS infrastructure. By leveraging AWS Systems Manager Patch Manager, Amazon Inspector, and incorporating strategies like rolling updates, immutable infrastructure, and Blue/Green deployments, you can ensure that your systems remain secure and compliant. Monitoring patch compliance helps maintain operational effectiveness. Practitioners preparing for the SAP-C02 exam should be well-versed in these concepts and tools to design and operate secure, reliable, and efficient systems on AWS.