Check provider logo

EC2 managed instance is compliant with Systems Manager patching requirements

ssm_managed_compliant_patching

Severityhigh
Servicessm
by Prowler
vulnerabilities

SSM-managed EC2 instances report patch compliance against defined baselines. This evaluates each managed node's compliance status from Patch Manager to determine whether required security updates are applied according to policy.

Risk

Unpatched instances expose known CVE vulnerabilities, enabling remote code execution, privilege escalation, and lateral movement.

This threatens confidentiality (data exfiltration), integrity (unauthorized changes), and availability (ransomware, crypto-mining, outages).

Run this check with Prowler CLI

prowler aws --checks ssm_managed_compliant_patching

Run in Prowler Cloud

Recommendation

Adopt automated patch management with Systems Manager: enroll EC2 as managed nodes, define strict patch baselines, run frequent compliance scans, and install critical updates promptly.

Apply defense in depth: least-privileged roles for patching, staged rollouts, maintenance windows, and centralized compliance reporting with alerting.

Remediation

CLI

aws ssm send-command --instance-ids <INSTANCE_ID> --document-name AWS-RunPatchBaseline --parameters Operation=Install

Native IaC
Terraform
Other
  1. Open AWS Console > Systems Manager > Run Command
  2. Click Run command
  3. Select document: AWS-RunPatchBaseline
  4. In Parameters, set Operation = Install
  5. In Targets, select the non-compliant instance
  6. Click Run; wait for command to complete and verify Compliance shows COMPLIANT

Source Code

Resource Type

AwsSsmPatchCompliance

References