• The AWS Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). # Working with patch compliance reports Patch compliance reports Use the information in the following topics to help you generate and work with patch compliance reports in Patch Manager, a tool in AWS Systems Manager. The information in the following topics apply no matter which method or type of configuration you're using for your patching operations: + A patch policy configured in Quick Setup + A Host Management option configured in Quick Setup + A maintenance window to run a patch `Scan` or `Install` task + An on-demand **Patch now** operation **Important** Patch compliance reports are point-in-time snapshots generated only by successful patching operations. Each report contains a capture time that identifies when the compliance status was calculated. If you have multiple types of operations in place to scan your instances for patch compliance, note that each scan overwrites the patch compliance data of previous scans. As a result, you might end up with unexpected results in your patch compliance data. For more information, see [Identifying the execution that created patch compliance data](patch-manager-compliance-data-overwrites.md). To verify which patch baseline was used to generate the latest compliance information, navigate to the **Compliance reporting** tab in Patch Manager, locate the row for the managed node you want information about, and then choose the baseline ID in the **Baseline ID used** column. **Topics** + [ # Viewing patch compliance results ](patch-manager-view-compliance-results.md) + [ # Generating .csv patch compliance reports ](patch-manager-store-compliance-results-in-s3.md) + [ # Remediating noncompliant managed nodes with Patch Manager ](patch-manager-noncompliant-nodes.md) + [ # Identifying the execution that created patch compliance data ](patch-manager-compliance-data-overwrites.md) # Viewing patch compliance results Viewing patch compliance results Use these procedures to view patch compliance information about your managed nodes. This procedure applies to patch operations that use the `AWS-RunPatchBaseline` document. For information about viewing patch compliance information for patch operations that use the `AWS-RunPatchBaselineAssociation` document, see [Identifying noncompliant managed nodes](patch-manager-find-noncompliant-nodes.md). **Note** The patch scanning operations for Quick Setup and Explorer use the `AWS-RunPatchBaselineAssociation` document. Quick Setup and Explorer are both tools in AWS Systems Manager. **Identify the patch solution for a specific CVE issue (Linux)** For many Linux-based operating systems, patch compliance results indicate which Common Vulnerabilities and Exposure (CVE) bulletin issues are resolved by which patches. This information can help you determine how urgently you need to install a missing or failed patch. CVE details are included for supported versions of the following operating system types: + AlmaLinux + Amazon Linux 2 + Amazon Linux 2023 + Oracle Linux + Red Hat Enterprise Linux (RHEL) + Rocky Linux **Note** By default, CentOS Stream doesn't provide CVE information about updates. You can, however, allow this support by using third-party repositories such as the Extra Packages for Enterprise Linux (EPEL) repository published by Fedora. For information, see [EPEL](https://fedoraproject.org/wiki/EPEL) on the Fedora Wiki. Currently, CVE ID values are reported only for patches with a status of `Missing` or `Failed`. You can also add CVE IDs to your lists of approved or rejected patches in your patch baselines, as the situation and your patching goals warrant. For information about working with approved and rejected patch lists, see the following topics: + [Working with custom patch baselines](patch-manager-manage-patch-baselines.md) + [Package name formats for approved and rejected patch lists](patch-manager-approved-rejected-package-name-formats.md) + [How patch baseline rules work on Linux-based systems](patch-manager-linux-rules.md) + [How patches are installed](patch-manager-installing-patches.md) **Note** In some cases, Microsoft releases patches for applications that don't specify an updated date and time. In these cases, an updated date and time of `01/01/1970` is supplied by default. ## Viewing patching compliance results Use the following procedures to view patch compliance results in the AWS Systems Manager console. **Note** For information about generating patch compliance reports that are downloaded to an Amazon Simple Storage Service (Amazon S3) bucket, see [Generating .csv patch compliance reports](patch-manager-store-compliance-results-in-s3.md). **To view patch compliance results** 1. Do one of the following. **Option 1** (recommended) – Navigate from Patch Manager, a tool in AWS Systems Manager: + In the navigation pane, choose **Patch Manager**. + Choose the **Compliance reporting** tab. + In the **Node patching details** area, choose the node ID of the managed node for which you want to review patch compliance results. Nodes that are `stopped` or `terminated` will not be displayed here. + In the **Details** area, in the **Properties** list, choose **Patches**. **Option 2** – Navigate from Compliance, a tool in AWS Systems Manager: + In the navigation pane, choose **Compliance**. + For **Compliance resources summary**, choose a number in the column for the types of patch resources you want to review, such as **Non-Compliant resources**. + Below, in the **Resource** list, choose the ID of the managed node for which you want to review patch compliance results. + In the **Details** area, in the **Properties** list, choose **Patches**. **Option 3** – Navigate from Fleet Manager, a tool in AWS Systems Manager. + In the navigation pane, choose **Fleet Manager**. + In the **Managed instances** area, choose the ID of the managed node for which you want to review patch compliance results. + In the **Details** area, in the **Properties** list, choose **Patches**. 1. (Optional) In the Search box (![\[The Search icon\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/images/search-icon.png)), choose from the available filters. For example, for Red Hat Enterprise Linux (RHEL), choose from the following: + Name + Classification + State + Severity For Windows Server, choose from the following: + KB + Classification + State + Severity 1. Choose one of the available values for the filter type you chose. For example, if you chose **State**, now choose a compliance state such as **InstalledPendingReboot**, **Failed** or **Missing**. **Note** Currently, CVE ID values are reported only for patches with a status of `Missing` or `Failed`. 1. Depending on the compliance state of the managed node, you can choose what action to take to remedy any noncompliant nodes. For example, you can choose to patch your noncompliant managed nodes immediately. For information about patching your managed nodes on demand, see [Patching managed nodes on demand](patch-manager-patch-now-on-demand.md). For information about patch compliance states, see [Patch compliance state values](patch-manager-compliance-states.md). # Generating .csv patch compliance reports Generating .csv patch compliance reports You can use the AWS Systems Manager console to generate patch compliance reports that are saved as a .csv file to an Amazon Simple Storage Service (Amazon S3) bucket of your choice. You can generate a single on-demand report or specify a schedule for generating the reports automatically. Reports can be generated for a single managed node or for all managed nodes in your selected AWS account and AWS Region. For a single node, a report contains comprehensive details, including the IDs of patches related to a node being noncompliant. For a report on all managed nodes, only summary information and counts of noncompliant nodes' patches are provided. After a report is generated, you can use a tool like Amazon Quick to import and analyze the data. Quick is a business intelligence (BI) service you can use to explore and interpret information in an interactive visual environment. For more information, see the [Amazon Quick User Guide](https://docs.aws.amazon.com/quicksuite/latest/userguide/what-is.html). **Note** When you create a custom patch baseline, you can specify a compliance severity level for patches approved by that patch baseline, such as `Critical` or `High`. If the patch state of any approved patch is reported as `Missing`, then the patch baseline's overall reported compliance severity is the severity level you specified. You can also specify an Amazon Simple Notification Service (Amazon SNS) topic to use for sending notifications when a report is generated. **Service roles for generating patch compliance reports** The first time you generate a report, Systems Manager creates an Automation assume role named `AWS-SystemsManager-PatchSummaryExportRole` to use for the export process to S3. **Note** If you are exporting compliance data to an encrypted S3 bucket, you must update its associated AWS KMS key policy to provide the necessary permissions for `AWS-SystemsManager-PatchSummaryExportRole`. For instance, add a permission similar to this to your S3 bucket's AWS KMS policy: ``` { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "role-arn" } ``` Replace *role-arn* with the Amazon Resource Name (ARN) of the created in your account, in the format `arn:aws:iam::111222333444:role/service-role/AWS-SystemsManager-PatchSummaryExportRole`. For more information, see [Key policies in AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) in the *AWS Key Management Service Developer Guide*. The first time you generate a report on a schedule, Systems Manager creates another service role named `AWS-EventBridge-Start-SSMAutomationRole`, along with the service role `AWS-SystemsManager-PatchSummaryExportRole` (if not created already) to use for the export process. `AWS-EventBridge-Start-SSMAutomationRole` enables Amazon EventBridge to start an automation using the runbook [AWS-ExportPatchReportToS3](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-exportpatchreporttos3). We recommend against attempting to modify these policies and roles. Doing so could cause patch compliance report generation to fail. For more information, see [Troubleshooting patch compliance report generation](#patch-compliance-reports-troubleshooting). **Topics** + [ ## What's in a generated patch compliance report? ](#patch-compliance-reports-to-s3-examples) + [ ## Generating patch compliance reports for a single managed node ](#patch-compliance-reports-to-s3-one-instance) + [ ## Generating patch compliance reports for all managed nodes ](#patch-compliance-reports-to-s3-all-instances) + [ ## Viewing patch compliance reporting history ](#patch-compliance-reporting-history) + [ ## Viewing patch compliance reporting schedules ](#patch-compliance-reporting-schedules) + [ ## Troubleshooting patch compliance report generation ](#patch-compliance-reports-troubleshooting) ## What's in a generated patch compliance report? This topic provides information about the types of content included in the patch compliance reports that are generated and downloaded to a specified S3 bucket. ### Report format for a single managed node A report generated for a single managed node provides both summary and detailed information. [Download a sample report (single node)](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/Sample-single-instance-patch-compliance-report.zip) Summary information for a single managed node includes the following: + Index + Instance ID + Instance name + Instance IP + Platform name + Platform version + SSM Agent version + Patch baseline + Patch group + Compliance status + Compliance severity + Noncompliant Critical severity patch count + Noncompliant High severity patch count + Noncompliant Medium severity patch count + Noncompliant Low severity patch count + Noncompliant Informational severity patch count + Noncompliant Unspecified severity patch count Detailed information for a single managed node includes the following: + Index + Instance ID + Instance name + Patch name + KB ID/Patch ID + Patch state + Last report time + Compliance level + Patch severity + Patch classification + CVE ID + Patch baseline + Logs URL + Instance IP + Platform name + Platform version + SSM Agent version **Note** When you create a custom patch baseline, you can specify a compliance severity level for patches approved by that patch baseline, such as `Critical` or `High`. If the patch state of any approved patch is reported as `Missing`, then the patch baseline's overall reported compliance severity is the severity level you specified. ### Report format for all managed nodes A report generated for all managed nodes provides only summary information. [Download a sample report (all managed nodes)](https://docs.aws.amazon.com/systems-manager/latest/userguide/samples/Sample-all-instances-patch-compliance-report.zip) Summary information for all managed nodes includes the following: + Index + Instance ID + Instance name + Instance IP + Platform name + Platform version + SSM Agent version + Patch baseline + Patch group + Compliance status + Compliance severity + Noncompliant Critical severity patch count + Noncompliant High severity patch count + Noncompliant Medium severity patch count + Noncompliant Low severity patch count + Noncompliant Informational severity patch count + Noncompliant Unspecified severity patch count ## Generating patch compliance reports for a single managed node Use the following procedure to generate a patch summary report for a single managed node in your AWS account. The report for a single managed node provides details about each patch that is out of compliance, including patch names and IDs. **To generate patch compliance reports for a single managed node** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Patch Manager**. 1. Choose the **Compliance reporting** tab. 1. Choose the button for the row of the managed node for which you want to generate a report, and then choose **View detail**. 1. In the **Patch summary** section, choose **Export to S3**. 1. For **Report name**, enter a name to help you identify the report later. 1. For **Reporting frequency**, choose one of the following: + **On demand** – Create a one-time report. Skip to Step 9. + **On a schedule** – Specify a recurring schedule for automatically generating reports. Continue to Step 8. 1. For **Schedule type**, specify either a rate expression, such as every 3 days, or provide a cron expression to set the report frequency. For information about cron expressions, see [Reference: Cron and rate expressions for Systems Manager](reference-cron-and-rate-expressions.md). 1. For **Bucket name**, select the name of an S3 bucket where you want to store the .csv report files. **Important** If you're working in an AWS Region that was launched after March 20, 2019, you must select an S3 bucket in that same Region. Regions launched after that date were turned off by default. For more information and a list of these Regions, see [Enabling a Region](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable) in the *Amazon Web Services General Reference*. 1. (Optional) To send notifications when the report is generated, expend the **SNS topic** section, and then choose an existing Amazon SNS topic from **SNS topic Amazon Resource Name (ARN)**. 1. Choose **Submit**. For information about viewing a history of generated reports, see [Viewing patch compliance reporting history](#patch-compliance-reporting-history). For information about viewing details of reporting schedules you have created, see [Viewing patch compliance reporting schedules](#patch-compliance-reporting-schedules). ## Generating patch compliance reports for all managed nodes Use the following procedure to generate a patch summary report for all managed nodes in your AWS account. The report for all managed nodes indicates which nodes are out of compliance and the numbers of noncompliant patches. It doesn't provide the names or other identifiers of the patches. For these additional details, you can generate a patch compliance report for a single managed node. For information, see [Generating patch compliance reports for a single managed node](#patch-compliance-reports-to-s3-one-instance) earlier in this topic. **To generate patch compliance reports for all managed nodes** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Patch Manager**. 1. Choose the **Compliance reporting** tab. 1. Choose **Export to S3**. (Don't select a node ID first.) 1. For **Report name**, enter a name to help you identify the report later. 1. For **Reporting frequency**, choose one of the following: + **On demand** – Create a one-time report. Skip to Step 8. + **On a schedule** – Specify a recurring schedule for automatically generating reports. Continue to Step 7. 1. For **Schedule type**, specify either a rate expression, such as every 3 days, or provide a cron expression to set the report frequency. For information about cron expressions, see [Reference: Cron and rate expressions for Systems Manager](reference-cron-and-rate-expressions.md). 1. For **Bucket name**, select the name of an S3 bucket where you want to store the .csv report files. **Important** If you're working in an AWS Region that was launched after March 20, 2019, you must select an S3 bucket in that same Region. Regions launched after that date were turned off by default. For more information and a list of these Regions, see [Enabling a Region](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable) in the *Amazon Web Services General Reference*. 1. (Optional) To send notifications when the report is generated, expend the **SNS topic** section, and then choose an existing Amazon SNS topic from **SNS topic Amazon Resource Name (ARN)**. 1. Choose **Submit**. For information about viewing a history of generated reports, see [Viewing patch compliance reporting history](#patch-compliance-reporting-history). For information about viewing details of reporting schedules you have created, see [Viewing patch compliance reporting schedules](#patch-compliance-reporting-schedules). ## Viewing patch compliance reporting history Use the information in this topic to help you view details about the patch compliance reports generated in your AWS account. **To view patch compliance reporting history** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Patch Manager**. 1. Choose the **Compliance reporting** tab. 1. Choose **View all S3 exports**, and then choose the **Export history** tab. ## Viewing patch compliance reporting schedules Use the information in this topic to help you view details about the patch compliance reporting schedules created in your AWS account. **To view patch compliance reporting history** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Patch Manager**. 1. Choose the **Compliance reporting** tab. 1. Choose **View all S3 exports**, and then choose the **Report schedule rules** tab. ## Troubleshooting patch compliance report generation Use the following information to help you troubleshoot problems with generating patch compliance report generation in Patch Manager, a tool in AWS Systems Manager. **Topics** + [ ### A message reports that the `AWS-SystemsManager-PatchManagerExportRolePolicy` policy is corrupted ](#patch-compliance-reports-troubleshooting-1) + [ ### After deleting patch compliance policies or roles, scheduled reports aren't generated successfully ](#patch-compliance-reports-troubleshooting-2) ### A message reports that the `AWS-SystemsManager-PatchManagerExportRolePolicy` policy is corrupted **Problem**: You receive an error message similar to the following, indicating the `AWS-SystemsManager-PatchManagerExportRolePolicy` is corrupted: ``` An error occurred while updating the AWS-SystemsManager-PatchManagerExportRolePolicy policy. If you have edited the policy, you might need to delete the policy, and any role that uses it, then try again. Systems Manager recreates the roles and policies you have deleted. ``` + **Solution**: Use the Patch Manager console or AWS CLI to delete the affected roles and policies before generating a new patch compliance report. **To delete the corrupt policy using the console** 1. Open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. Do one of the following: **On-demand reports** – If the problem occurred while generating a one-time on-demand report, in the left navigation, choose **Policies**, search for `AWS-SystemsManager-PatchManagerExportRolePolicy`, then delete the policy. Next, choose **Roles**, search for `AWS-SystemsManager-PatchSummaryExportRole`, then delete the role. **Scheduled reports** – If the problem occurred while generating a report on a schedule, in the left navigation, choose **Policies**, search one at a time for `AWS-EventBridge-Start-SSMAutomationRolePolicy` and `AWS-SystemsManager-PatchManagerExportRolePolicy`, and delete each policy. Next, choose **Roles**, search one at a time for `AWS-EventBridge-Start-SSMAutomationRole` and `AWS-SystemsManager-PatchSummaryExportRole`, and delete each role. **To delete the corrupt policy using the AWS CLI** Replace the *placeholder values* with your account ID. + If the problem occurred while generating a one-time on-demand report, run the following commands: ``` aws iam delete-policy --policy-arn arn:aws:iam::account-id:policy/AWS-SystemsManager-PatchManagerExportRolePolicy ``` ``` aws iam delete-role --role-name AWS-SystemsManager-PatchSummaryExportRole ``` If the problem occurred while generating a report on a schedule, run the following commands: ``` aws iam delete-policy --policy-arn arn:aws:iam::account-id:policy/AWS-EventBridge-Start-SSMAutomationRolePolicy ``` ``` aws iam delete-policy --policy-arn arn:aws:iam::account-id:policy/AWS-SystemsManager-PatchManagerExportRolePolicy ``` ``` aws iam delete-role --role-name AWS-EventBridge-Start-SSMAutomationRole ``` ``` aws iam delete-role --role-name AWS-SystemsManager-PatchSummaryExportRole ``` After completing either procedure, follow the steps to generate or schedule a new patch compliance report. ### After deleting patch compliance policies or roles, scheduled reports aren't generated successfully **Problem**: The first time you generate a report, Systems Manager creates a service role and a policy to use for the export process (`AWS-SystemsManager-PatchSummaryExportRole` and `AWS-SystemsManager-PatchManagerExportRolePolicy`). The first time you generate a report on a schedule, Systems Manager creates another service role and a policy (`AWS-EventBridge-Start-SSMAutomationRole` and `AWS-EventBridge-Start-SSMAutomationRolePolicy`). These let Amazon EventBridge start an automation using the runbook [AWS-ExportPatchReportToS3 ](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-exportpatchreporttos3). If you delete any of these policies or roles, the connections between your schedule and your specified S3 bucket and Amazon SNS topic might be lost. + **Solution**: To work around this problem, we recommend deleting the previous schedule and creating a new schedule to replace the one that was experiencing issues. # Remediating noncompliant managed nodes with Patch Manager Remediating noncompliant managed nodes The topics in this section provide overviews of how to identify managed nodes that are out of patch compliance and how to bring nodes into compliance. **Topics** + [ # Identifying noncompliant managed nodes ](patch-manager-find-noncompliant-nodes.md) + [ # Patch compliance state values ](patch-manager-compliance-states.md) + [ # Patching noncompliant managed nodes ](patch-manager-compliance-remediation.md) # Identifying noncompliant managed nodes Out-of-compliance managed nodes are identified when either of two AWS Systems Manager documents (SSM documents) are run. These SSM documents reference the appropriate patch baseline for each managed node in Patch Manager, a tool in AWS Systems Manager. They then evaluate the patch state of the managed node and then make compliance results available to you. There are two SSM documents that are used to identify or update noncompliant managed nodes: `AWS-RunPatchBaseline` and `AWS-RunPatchBaselineAssociation`. Each one is used by different processes, and their compliance results are available through different channels. The following table outlines the differences between these documents. **Note** Patch compliance data from Patch Manager can be sent to AWS Security Hub CSPM. Security Hub CSPM gives you a comprehensive view of your high-priority security alerts and compliance status. It also monitors the patching status of your fleet. For more information, see [Integrating Patch Manager with AWS Security Hub CSPM](patch-manager-security-hub-integration.md). | | `AWS-RunPatchBaseline` | `AWS-RunPatchBaselineAssociation` | | --- | --- | --- | | Processes that use the document | **Patch on demand** - You can scan or patch managed nodes on demand using the **Patch now** option. For information, see [Patching managed nodes on demand](patch-manager-patch-now-on-demand.md). **Systems Manager Quick Setup patch policies** – You can create a patching configuration in Quick Setup, a tool in AWS Systems Manager, that can scan for or install missing patches on separate schedules for an entire organization, a subset of organizational units, or a single AWS account. For information, see [Configure patching for instances in an organization using a Quick Setup patch policy](quick-setup-patch-manager.md). **Run a command** – You can manually run `AWS-RunPatchBaseline` in an operation in Run Command, a tool in AWS Systems Manager. For information, see [Running commands from the console](running-commands-console.md). **Maintenance window** – You can create a maintenance window that uses the SSM document `AWS-RunPatchBaseline` in a Run Command task type. For information, see [Tutorial: Create a maintenance window for patching using the console](maintenance-window-tutorial-patching.md). | **Systems Manager Quick Setup Host Management** – You can enable a Host Management configuration option in Quick Setup to scan your managed instances for patch compliance each day. For information, see [Set up Amazon EC2 host management using Quick Setup](quick-setup-host-management.md). **Systems Manager [Explorer](Explorer.md)** – When you allow Explorer, a tool in AWS Systems Manager, it regularly scans your managed instances for patch compliance and reports results in the Explorer dashboard. | | Format of the patch scan result data | After `AWS-RunPatchBaseline` runs, Patch Manager sends an `AWS:PatchSummary` object to Inventory, a tool in AWS Systems Manager. This report is generated only by successful patching operations and includes a capture time that identifies when the compliance status was calculated. | After `AWS-RunPatchBaselineAssociation` runs, Patch Manager sends an `AWS:ComplianceItem` object to Systems Manager Inventory. | | Viewing patch compliance reports in the console | You can view patch compliance information for processes that use `AWS-RunPatchBaseline` in [Systems Manager Configuration Compliance](systems-manager-compliance.md) and [Working with managed nodes](fleet-manager-managed-nodes.md). For more information, see [Viewing patch compliance results](patch-manager-view-compliance-results.md). | If you use Quick Setup to scan your managed instances for patch compliance, you can see the compliance report in [Systems Manager Fleet Manager](fleet-manager.md). In the Fleet Manager console, choose the node ID of your managed node. In the **General** menu, choose **Configuration compliance**. If you use Explorer to scan your managed instances for patch compliance, you can see the compliance report in both Explorer and [Systems Manager OpsCenter](OpsCenter.md). | | AWS CLI commands for viewing patch compliance results | For processes that use `AWS-RunPatchBaseline`, you can use the following AWS CLI commands to view summary information about patches on a managed node. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-find-noncompliant-nodes.html) | For processes that use `AWS-RunPatchBaselineAssociation`, you can use the following AWS CLI command to view summary information about patches on an instance. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-find-noncompliant-nodes.html) | | Patching operations | For processes that use `AWS-RunPatchBaseline`, you specify whether you want the operation to run a `Scan` operation only, or a `Scan and install` operation. If your goal is to identify noncompliant managed nodes and not remediate them, run only a `Scan` operation. | Quick Setup and Explorer processes, which use AWS-RunPatchBaselineAssociation, run only a Scan operation. | | More info | [SSM Command document for patching: `AWS-RunPatchBaseline`](patch-manager-aws-runpatchbaseline.md) | [SSM Command document for patching: `AWS-RunPatchBaselineAssociation`](patch-manager-aws-runpatchbaselineassociation.md) | For information about the various patch compliance states you might see reported, see [Patch compliance state values](patch-manager-compliance-states.md) For information about remediating managed nodes that are out of patch compliance, see [Patching noncompliant managed nodes](patch-manager-compliance-remediation.md). # Patch compliance state values The information about patches for a managed node include a report of the state, or status, of each individual patch. **Tip** If you want to assign a specific patch compliance state to a managed node, you can use the [https://docs.aws.amazon.com/cli/latest/reference/ssm/put-compliance-items.html](https://docs.aws.amazon.com/cli/latest/reference/ssm/put-compliance-items.html) AWS Command Line Interface (AWS CLI) command or the [https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutComplianceItems.html](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutComplianceItems.html) API operation. Assigning compliance state isn't supported in the console. Use the information in the following tables to help you identify why a managed node might be out of patch compliance. ## Patch compliance values for Debian Server and Ubuntu Server For Debian Server and Ubuntu Server, the rules for package classification into the different compliance states are described in the following table. **Note** Keep the following in mind when you're evaluating the `INSTALLED`, `INSTALLED_OTHER`, and `MISSING` status values: If you don't select the **Include nonsecurity updates** check box when creating or updating a patch baseline, patch candidate versions are limited to patches in the following repositories: . Ubuntu Server 16.04 LTS: `xenial-security` Ubuntu Server 18.04 LTS: `bionic-security` Ubuntu Server 20.04 LTS: `focal-security` Ubuntu Server 22.04 LTS (`jammy-security`) Ubuntu Server 24.04 LTS (`noble-security`) Ubuntu Server 25.04 (`plucky-security`) `debian-security` (Debian Server) If you do select the **Include nonsecurity updates** check box, patches from other repositories are considered as well. | Patch state | Description | Compliance status | | --- | --- | --- | | **`INSTALLED`** | The patch is listed in the patch baseline and is installed on the managed node. It could have been installed either manually by an individual or automatically by Patch Manager when the `AWS-RunPatchBaseline` document was run on the managed node. | Compliant | | **`INSTALLED_OTHER`** | The patch isn't included in the baseline or isn't approved by the baseline but is installed on the managed node. The patch might have been installed manually, the package could be a required dependency of another approved patch, or the patch might have been included in an InstallOverrideList operation. If you don't specify `Block` as the **Rejected patches** action, `INSTALLED_OTHER` patches also includes installed but rejected patches. | Compliant | | **`INSTALLED_PENDING_REBOOT`** | `INSTALLED_PENDING_REBOOT` can mean either of two things: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-compliance-states.html) In neither case does it mean that a patch with this status *requires* a reboot, only that the node hasn't been rebooted since the patch was installed. | Non-Compliant | | **`INSTALLED_REJECTED`** | The patch is installed on the managed node but is specified in a **Rejected patches** list. This typically means the patch was installed before it was added to a list of rejected patches. | Non-Compliant | | **`MISSING`** | The patch is approved in the baseline, but it isn't installed on the managed node. If you configure the `AWS-RunPatchBaseline` document task to scan (instead of install), the system reports this status for patches that were located during the scan but haven't been installed. | Non-Compliant | | **`FAILED`** | The patch is approved in the baseline, but it couldn't be installed. To troubleshoot this situation, review the command output for information that might help you understand the problem. | Non-Compliant | ## Patch compliance values for other operating systems For all operating systems besides Debian Server and Ubuntu Server, the rules for package classification into the different compliance states are described in the following table. | Patch state | Description | Compliance value | | --- | --- | --- | | **`INSTALLED`** | The patch is listed in the patch baseline and is installed on the managed node. It could have been installed either manually by an individual or automatically by Patch Manager when the `AWS-RunPatchBaseline` document was run on the node. | Compliant | | **`INSTALLED_OTHER`**¹ | The patch isn't in the baseline, but it is installed on the managed node. There are two possible reasons for this: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-compliance-states.html) | Compliant | | **`INSTALLED_REJECTED`** | The patch is installed on the managed node but is specified in a rejected patches list. This typically means the patch was installed before it was added to a list of rejected patches. | Non-Compliant | | **`INSTALLED_PENDING_REBOOT`** | `INSTALLED_PENDING_REBOOT` can mean either of two things: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-compliance-states.html) In neither case does it mean that a patch with this status *requires* a reboot, only that the node hasn't been rebooted since the patch was installed. | Non-Compliant | | **`MISSING`** | The patch is approved in the baseline, but it isn't installed on the managed node. If you configure the `AWS-RunPatchBaseline` document task to scan (instead of install), the system reports this status for patches that were located during the scan but haven't been installed. | Non-Compliant | | **`FAILED`** | The patch is approved in the baseline, but it couldn't be installed. To troubleshoot this situation, review the command output for information that might help you understand the problem. | Non-Compliant | | **`NOT_APPLICABLE`**¹ | *This compliance state is reported only for Windows Server operating systems.* The patch is approved in the baseline, but the service or feature that uses the patch isn't installed on the managed node. For example, a patch for a web server service such as Internet Information Services (IIS) would show `NOT_APPLICABLE` if it was approved in the baseline, but the web service isn't installed on the managed node. A patch can also be marked `NOT_APPLICABLE` if it has been superseded by a subsequent update. This means that the later update is installed and the `NOT_APPLICABLE` update is no longer required. | Not applicable | | AVAILABLE\$1SECURITY\$1UPDATES | *This compliance state is reported only for Windows Server operating systems.* An available security update patch that is not approved by the patch baseline can have a compliance value of `Compliant` or `Non-Compliant`, as defined in a custom patch baseline. When you create or update a patch baseline, you choose the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline. For example, security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed. For patch summary counts, when a patch is reported as `AvailableSecurityUpdate`, it will always be included in `AvailableSecurityUpdateCount`. If the baseline is configured to report these patches as `NonCompliant`, it is also included in `SecurityNonCompliantCount`. If the baseline is configured to report these patches as `Compliant`, they are not included in `SecurityNonCompliantCount`. These patches are always reported with an unspecified severity and are never included in the `CriticalNonCompliantCount`. | Compliant or Non-Compliant, depending on the option selected for available security updates. Using the console to create or update a patch baseline, you specify this option in the **Available security updates compliance status** field. Using the AWS CLI to run the [https://docs.aws.amazon.com/cli/latest/reference/ssm/create-patch-baseline.html](https://docs.aws.amazon.com/cli/latest/reference/ssm/create-patch-baseline.html) or [https://docs.aws.amazon.com/cli/latest/reference/ssm/update-patch-baseline.html](https://docs.aws.amazon.com/cli/latest/reference/ssm/update-patch-baseline.html) command, you specify this option in the `available-security-updates-compliance-status` parameter. | ¹ For patches with the state `INSTALLED_OTHER` and `NOT_APPLICABLE`, Patch Manager omits some data from query results based on the [https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-patches.html](https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-patches.html) command, such as the values for `Classification` and `Severity`. This is done to help prevent exceeding the data limit for individual nodes in Inventory, a tool in AWS Systems Manager. To view all patch details, you can use the [https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-available-patches.html](https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-available-patches.html) command. # Patching noncompliant managed nodes Many of the same AWS Systems Manager tools and processes you can use to check managed nodes for patch compliance can be used to bring nodes into compliance with the patch rules that currently apply to them. To bring managed nodes into patch compliance, Patch Manager, a tool in AWS Systems Manager, must run a `Scan and install` operation. (If your goal is only to identify noncompliant managed nodes and not remediate them, run a `Scan` operation instead. For more information, see [Identifying noncompliant managed nodes](patch-manager-find-noncompliant-nodes.md).) **Install patches using Systems Manager** You can choose from several tools to run a `Scan and install` operation: + (Recommended) Configure a patch policy in Quick Setup, a tool in Systems Manager, that lets you install missing patches on a schedule for an entire organization, a subset of organizational units, or a single AWS account. For more information, see [Configure patching for instances in an organization using a Quick Setup patch policy](quick-setup-patch-manager.md). + Create a maintenance window that uses the Systems Manager document (SSM document) `AWS-RunPatchBaseline` in a Run Command task type. For information, see [Tutorial: Create a maintenance window for patching using the console](maintenance-window-tutorial-patching.md). + Manually run `AWS-RunPatchBaseline` in a Run Command operation. For information, see [Running commands from the console](running-commands-console.md). + Install patches on demand using the **Patch now** option. For information, see [Patching managed nodes on demand](patch-manager-patch-now-on-demand.md). # Identifying the execution that created patch compliance data Patch compliance data represents a point-in-time snapshot from the latest successful patching operation. Each compliance report includes both an execution ID and a capture time that help you identify which operation created the compliance data and when it was generated. If you have multiple types of operations in place to scan your instances for patch compliance, each scan overwrites the patch compliance data of previous scans. As a result, you might end up with unexpected results in your patch compliance data. For example, suppose you create a patch policy that scans for patch compliance each day at 2 AM local time. That patch policy uses a patch baseline that targets patches with severity marked as `Critical`, `Important`, and `Moderate`. This patch baseline also specifies a few specifically rejected patches. Also suppose that you already had a maintenance window set up to scan the same set of managed nodes each day at 4 AM local time, which you don't delete or deactivate. That maintenance window’s task uses a different patch baseline, one that targets only patches with a `Critical` severity and doesn’t exclude any specific patches. When this second scan is performed by the maintenance window, the patch compliance data from the first scan is deleted and replaced with patch compliance from the second scan. Therefore, we strongly recommend using only one automated method for scanning and installing in your patching operations. If you're setting up patch policies, you should delete or deactivate other methods of scanning for patch compliance. For more information, see the following topics: + To remove a patching operation task from a maintenance window – [Updating or deregistering maintenance window tasks using the console](sysman-maintenance-update.md#sysman-maintenance-update-tasks) + To delete a State Manager association – [Deleting associations](systems-manager-state-manager-delete-association.md). To deactivate daily patch compliance scans in a Host Management configuration, do the following in Quick Setup: 1. In the navigation pane, choose **Quick Setup**. 1. Select the Host Management configuration to update. 1. Choose **Actions, Edit configuration**. 1. Clear the **Scan instances for missing patches daily** check box. 1. Choose **Update**. **Note** Using the **Patch now** option to scan a managed node for compliance also results in an overwrite of patch compliance data.