Patch Manager prerequisites

Make sure that you have met the required prerequisites before using Patch Manager, a tool in Amazon Systems Manager.

SSM Agent version

Version 2.0.834.0 or later of SSM Agent is running on the managed node you want to manage with Patch Manager.

Python version

For macOS and most Linux operating systems (OSs), Patch Manager currently supports Python versions 2.6 - 3.10. The AlmaLinux, Debian Server, Raspberry Pi OS, and Ubuntu Server OSs require a supported version of Python 3 (3.0 - 3.10).

Connectivity to the patch source

If your managed nodes don't have a direct connection to the Internet and you're using an Amazon Virtual Private Cloud (Amazon VPC) with a VPC endpoint, you must ensure that the nodes have access to the source patch repositories (repos). On Linux nodes, patch updates are typically downloaded from the remote repos configured on the node. Therefore, the node must be able to connect to the repos so the patching can be performed. For more information, see How security patches are selected.

CentOS and CentOS Stream: Enable the EnableNonSecurity flag

CentOS 6 and 7 managed nodes use Yum as the package manager. CentOS 8 and CentOS Stream nodes use DNF as the package manager. Both package managers use the concept of an update notice. An update notice is simply a collection of packages that fix specific problems.

However, CentOS and CentOS Stream default repos aren't configured with an update notice. This means that Patch Manager doesn't detect packages on default CentOS and CentOS Stream repos. To allow Patch Manager to process packages that aren't contained in an update notice, you must turn on the EnableNonSecurity flag in the patch baseline rules.

Windows Server: Ensure connectivity to Windows Update Catalog or Windows Server Update Services (WSUS)

Windows Server managed nodes must be able to connect to the Windows Update Catalog or Windows Server Update Services (WSUS). Confirm that your nodes have connectivity to the Microsoft Update Catalog through an internet gateway, NAT gateway, or NAT instance. If you are using WSUS, confirm that the node has connectivity to the WSUS server in your environment. For more information, see Issue: managed node doesn't have access to Windows Update Catalog or WSUS.

S3 endpoint access

Whether your managed nodes operate in a private or public network, without access to the required Amazon managed Amazon Simple Storage Service (Amazon S3) buckets, patching operations fail. For information about the S3 buckets your managed nodes must be able to access, see SSM Agent communications with Amazon managed S3 buckets and Improve the security of EC2 instances by using VPC endpoints for Systems Manager.

Permissions to install patches locally

On Windows Server and Linux operating systems, Patch Manager assumes the Administrator and root user accounts, respectively, to install patches.

On macOS, however, for Brew and Brew Cask, Homebrew doesn't support its commands running under the root user account. As a result, Patch Manager queries for and runs Homebrew commands as either the owner of the Homebrew directory, or as a valid user belonging to the Homebrew directory’s owner group. Therefore, in order to install patches, the owner of the homebrew directory also needs recursive owner permissions for the /usr/local directory.

sudo chown -R $USER:admin /usr/local

Supported operating systems for Patch Manager

The Patch Manager tool doesn't support all the same operating systems versions that are supported by other Systems Manager tools. For example, Patch Manager doesn't support CentOS 6.3 or Raspberry Pi OS 8 (Jessie). (For the full list of Systems Manager-supported operating systems, see Supported operating systems for Systems Manager.) Therefore, ensure that the managed nodes you want to use with Patch Manager are running one of the operating systems listed in the following table.