EC2 managed instance is compliant with SSM patching

Check ID: ssm_managed_compliant_patching
Provider: AWS
Service: ssm
Severity: HIGH
Categories: vulnerabilities
Resource type: AwsSsmPatchCompliance

What this check verifies

SSM-managed EC2 instances report patch compliance against defined baselines. This evaluates each managed node’s compliance status from Patch Manager to determine whether required security updates are applied according to policy.

Risk

Unpatched instances expose known CVE vulnerabilities, enabling remote code execution, privilege escalation, and lateral movement. This threatens confidentiality (data exfiltration), integrity (unauthorized changes), and availability (ransomware, crypto-mining, outages).

Recommendation

Adopt automated patch management with Systems Manager: enroll EC2 as managed nodes, define strict patch baselines, run frequent compliance scans, and install critical updates promptly. Apply defense in depth: least-privileged roles for patching, staged rollouts, maintenance windows, and centralized compliance reporting with alerting.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ssm send-command --instance-ids <INSTANCE_ID> --document-name AWS-RunPatchBaseline --parameters Operation=Install

# Run AWS-RunPatchBaseline to install missing patches on the instance
resource "aws_ssm_association" "<example_resource_name>" {
  name        = "AWS-RunPatchBaseline"
  instance_id = "<example_resource_id>"
  parameters = {
    Operation = ["Install"]  # Critical: installs patches to achieve COMPLIANT status
  }
}

# Create an SSM Association to install missing patches on the instance
Resources:
  <example_resource_name>:
    Type: AWS::SSM::Association
    Properties:
      Name: AWS-RunPatchBaseline
      InstanceId: <example_resource_id>
      Parameters:
        Operation:
          - Install  # Critical: installs missing patches so the instance becomes COMPLIANT

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ssm_managed_compliant_patching. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

SSM document is not shared publicly SSM Incidents replication set is ACTIVE with a plan

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires