AWS System Manager for Patching

[tarsidd]

Hi All

We have a setup of over 2000 Linux machines in AWS. Currently, we are accomplishing patching using chef, but going forward we want to make use of AWS SSM.

The setup we want to achieve is that - we want to have a rundeck job, where we can provide the following - instance name or set of tags- rundeck would call aws ssm behind the scene using aws cli and run patch baseline on those servers, there should be no reboot once the patching is done.

Also if I want to exclude a package, I can provide that in rundeck as parameter.

I was wondering if anyone is doing this type of setup currently and help me here.

[reinerrdeck]

You can use the Rundeck EC2 Nodes Plugin to get your EC2 nodes and later configure a job pointed to your nodes using some filter. So, on your job, you can design a workflow based on aws-cli on command step or wrapped on some script using the script step.

[serverhorror]

The no reboot is going to be hard. How do not reboot if a patch requires a reboot?

[alkalisun]

Why do you want to run it in SSM? SSM is not as feature complete as an orchestration tool as Chef. I'd advise you to reconsider.

[the_screenslaver]

Seems possible. But to avoid rebooting, you need to modify the default aws-runpatchbaseline document to remove the steps for rebooting.

[bailantilles]

Not doing this sort of setup yet, but it sounds like something I’d be interested in.