Examkin

Question

Difficulty: HardPatch Management and OS Compliance Automation

A SysOps Administrator is setting up automated OS patching for a fleet of Amazon EC2 instances running Ubuntu 22.04 LTS. The organization requires a custom patch baseline that automatically approves security updates with a 'Critical' or 'Important' severity 10 days after release. Patching must occur during a weekly maintenance window, and target instances must be grouped dynamically. Arrange the steps in the correct chronological order to configure this automated patch management workflow, starting with the baseline configuration.

  1. 1Create a custom patch baseline for Ubuntu specifying the approval rules for Critical and Important security updates with a 10-day auto-approval delay.
  2. 2Tag the target EC2 instances with the case-sensitive tag key 'Patch Group' and a unique value like 'Prod-Ubuntu'.
  3. 3Associate the 'Prod-Ubuntu' patch group with the newly created custom patch baseline.
  4. 4Create a Systems Manager Maintenance Window defining the weekly schedule, duration, and cutoff for the patch operations.
  5. 5Register the target instances with the Maintenance Window by referencing the 'Prod-Ubuntu' tag.
  6. 6Register the 'AWS-RunPatchBaseline' Run Command task with the Maintenance Window, specifying the registered targets and setting the operation parameter to 'Install'.

Answer

To configure the automated patch management workflow: 1. Create a custom patch baseline for Ubuntu with the specified rules. 2. Tag the target EC2 instances with the case-sensitive tag key 'Patch Group'. 3. Associate the patch group with the custom patch baseline. 4. Create a Systems Manager Maintenance Window. 5. Register the target instances with the Maintenance Window. 6. Register the 'AWS-RunPatchBaseline' Run Command task with the Maintenance Window.
To automate patching with a custom baseline, the baseline must first be created with the required approval rules. Instances must then be tagged with the case-sensitive 'Patch Group' tag key to define the patch group. Next, the patch group is associated with the custom patch baseline. Then, a maintenance window is created to define the execution schedule. The target instances are registered with the maintenance window, and finally, the task executing the AWS-RunPatchBaseline document with the Install operation is registered to target those instances within the maintenance window.

Step-by-Step Solution

1
Create the custom patch baseline with the specified OS, approval rules, and auto-approval delay.
A custom patch baseline is created but not yet applied to any instances.
You must define the patching rules (e.g., auto-approving Critical patches after 10 days) first before applying them.
2
Apply the 'Patch Group' tag key (case-sensitive) with a custom value (e.g., 'Prod-Ubuntu') to the target instances.
The target instances are logically grouped under the 'Prod-Ubuntu' patch group.
SSM Patch Manager uses the 'Patch Group' tag key to map instances to specific baselines.
3
Associate the patch group name with the custom patch baseline.
Instances tagged with the patch group are now bound to the custom patch baseline instead of the default one.
This association ensures SSM Patch Manager applies the custom rules to the correct group of instances.
4
Create a Systems Manager Maintenance Window specifying the schedule (e.g., weekly) and duration.
A maintenance window is established but has no targets or tasks associated with it.
The maintenance window provides the scheduling framework for running the patching task.
5
Register the target instances with the Maintenance Window using resource tags.
The Maintenance Window now has defined targets to run tasks against.
You must register targets to the window so the task knows which instances to execute on.
6
Register the 'AWS-RunPatchBaseline' Run Command task with the Maintenance Window, specifying the registered targets and the 'Install' operation.
The configuration is complete, and patching will execute automatically on the schedule.
The task definition links the actual patch execution command ('AWS-RunPatchBaseline') to the maintenance window schedule and registered targets.

Key Concept

AWS Systems Manager Patch Manager configuration workflow involving custom baselines, case-sensitive patch groups, and maintenance window scheduling.
Estimated Time:2m 30s
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic