Study guide
9.2 Systems Manager Patch Manager & Session Manager
AWS Certified CloudOps Engineer – Associate SOA-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Monitoring & Observability Infrastructure
1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms
2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation
2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda
3 Chapter 3: Performance Optimization for Compute, Storage & Databases
3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance
4 Chapter 4: Compute & Database Scalability and Elasticity
4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB
5 Chapter 5: High Availability, Fault Tolerance & Load Balancing
5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments
6 Chapter 6: Backup, Data Protection & Disaster Recovery
6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience
7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK
7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures
8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC
8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows
9 Chapter 9: Systems Manager & Event-Driven Operations Automation
9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation
10 Chapter 10: Identity, Access Management & Governance
10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs
11 Chapter 11: Data Security, Encryption & Vulnerability Management
11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings
12 Chapter 12: VPC Architecture, Endpoints & Network Protection
12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing
13 Chapter 13: DNS, Route 53 Routing & Content Delivery
13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity
14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting
9.2 Systems Manager Patch Manager & Session Manager
Key Takeaways Explain This Topic AI
Patch Manager automates operating system patching across Windows and Linux distributions using the AWS-RunPatchBaseline document with Scan or Install operations.
Patch Baselines define patch approval rules including vendor release delay buffers, classifications, severities, compliance levels, and explicit approved and rejected patch lists.
Instances are assigned to specific patch baselines using the reserved tag key Patch Group; an instance can belong to only one patch group at any given time.
Maintenance Windows define the schedule (cron/rate), duration, cutoff buffer, target instances, and registered tasks, preventing disruptive patch operations during peak business hours.
Session Manager provides browser-based and CLI shell access without open inbound security group ports, bastion hosts, or SSH keys, logging encrypted sessions to S3 and CloudWatch Logs.
Last updated: September 2026
9.2 Systems Manager Patch Manager & Session Manager
CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to automate operating system patching with Systems Manager Patch Manager, establish multi-tier approval rules using Patch Groups, schedule update cycles via Maintenance Windows, and eliminate bastion hosts using secure, audited Session Manager access.
Systems Manager Patch Manager Architecture & Baselines
Maintaining operating system security compliance across enterprise server fleets requires automated patch evaluation, testing, and deployment. AWS Systems Manager Patch Manager automates operating system patching for Amazon EC2 instances and hybrid servers across Windows Server and Linux distributions (Amazon Linux, AL2023, Ubuntu, RHEL, Debian, SLES).
Under the hood, Patch Manager orchestrates native operating system package managers ( yum , dnf , apt , zypper , Windows Update) using the Systems Manager document AWS-RunPatchBaseline .
Default vs. Custom Patch Baselines
A Patch Baseline defines the specific rules governing which operating system patches are approved for installation.
AWS provides Default Patch Baselines for each supported OS (e.g., AWS-AmazonLinux2023DefaultPatchBaseline , AWS-WindowsPredefinedpatchBaseline-OS ). These baselines automatically approve all vendor patches categorized as Critical or Important security updates after an auto-approval wait period of 7 days . However, default baselines cannot be modified, do not support custom package exclusions, and cannot be tailored to specific compliance regimes.
Enterprise cloud operations rely on Custom Patch Baselines , configuring granular controls:
Product Filtering: Explicitly targets specific operating system versions (such as WindowsServer2022 , Ubuntu22.04 , or AmazonLinux2023 ).
Classification & Severity: Filters updates by classification ( Security , Bugfix , Enhancement , CriticalUpdates ) and severity ( Critical , Important , Moderate , Low ).
Auto-Approval Delay: Specifies the number of days to wait after vendor release before a patch is automatically approved (e.g., 10 days or 14 days ). This delay creates a vital testing soak buffer, preventing untested zero-day updates from breaking production workloads.
Compliance Severity Level: Assigns a compliance status severity ( Critical , High , Medium , Low ) if an approved patch is missing during a compliance scan.
Approved Patches List: An explicit allowlist that immediately approves critical patches regardless of auto-approval delay rules.
Rejected Patches List: An explicit blocklist that prevents designated packages (such as a buggy kernel release or incompatible driver) from ever being installed, overriding general approval criteria.
Patch Groups & Target Segmentation
To safely roll out updates, administrators segment fleets into staged deployment tiers (Development, Staging, Production) using Patch Groups .
A Patch Group links a Patch Baseline to a designated set of managed nodes:
Instances are assigned to a patch group using the reserved tag key Patch Group .
The tag value defines the group name (e.g., Patch Group = Web-Dev or Patch Group = Web-Prod ).
A managed node can belong to only one Patch Group at any given time.
Each Patch Group is registered to exactly one Patch Baseline within an AWS Region.
Deployment Tier Patch Group Tag Value Auto-Approval Delay Baseline Rules
Development Web-Dev 0 days (immediate) Approves all security and bugfix patches immediately for rapid testing.
Staging Web-Staging 7 days Validates patch stability against pre-production traffic.
Production Web-Prod 14 days Applies proven patches; enforces explicit Rejected Patches blocklists.
Maintenance Windows: Scheduled Execution Windows
While Patch Baselines define what patches to install, Systems Manager Maintenance Windows dictate when and how patching operations execute, preventing business disruption.
A Maintenance Window consists of five core components:
Schedule: Defined using timezone-aware cron expressions (e.g., cron(0 2 ? * SUN *) ) or rate expressions.
Duration: The total window duration (between 1 and 24 hours, e.g., 4 hours).
Cutoff Buffer: The hours before window end (e.g., 1 hour) when Systems Manager stops scheduling tasks. In a 4-hour window with a 1-hour cutoff, tasks dispatch only during the first 3 hours, leaving the final hour for active tasks and reboots to finish safely.
Registered Targets: Instances targeted by tags (e.g., Patch Group = Web-Prod ), Resource Groups, or explicit IDs.
Registered Tasks: Configured tasks specifying:
Task Document: Typically AWS-RunPatchBaseline .
Operation Parameter: Scan (evaluates missing patches and reports compliance without changes) or Install (downloads and applies approved missing patches).
Reboot Behavior: RebootIfNeeded (restarts if an installed update requires it) or NoReboot (installs updates but defers reboot).
Rate Control: Configures Concurrency and Error Thresholds to prevent concurrent patching from causing service outages.
Systems Manager Session Manager: Secure Bastionless Access
AWS Systems Manager Session Manager replaces bastion hosts, public IP addresses, and SSH key management with fully managed, auditable shell access:
Zero Inbound Open Ports: The SSM Agent connects outbound over HTTPS (port 443) to the ssmmessages endpoint. Instance security groups require no inbound rules for SSH (port 22) or RDP (port 3389).
Centralized IAM Governance: Access permissions are managed entirely through AWS IAM policies. Administrators use tag-based conditions (e.g., ssm:resourceTag/Environment: "Development" ) to grant access while denying production sessions.
RunAs OS User Support: Session Manager can enforce launching sessions under a restricted local OS account (e.g., ec2-user or ssm-user ) rather than root .
Auditing & Logging:
Terminal session streams are logged in real time to Amazon CloudWatch Logs and archived to Amazon S3 .
Logs are encrypted using an AWS KMS customer managed key (CMK) to prevent tampering.
AWS CloudTrail audits session lifecycle events ( StartSession , ResumeSession , TerminateSession ).
Port Forwarding and SSH Tunneling via Session Manager Plugin
Using the AWS CLI Session Manager Plugin ( session-manager-plugin ), operators tunnel traffic securely to private instances:
Port Forwarding ( AWS-StartPortForwardingSession ): Forwards a local port to a remote instance or private resource (such as an Amazon RDS MySQL database in an isolated subnet) using AWS-StartPortForwardingSessionToRemoteHost without exposing database ports to the internet.
SSH Tunneling ( AWS-StartSSHSession ): Proxies standard OpenSSH and SCP commands over Session Manager via the SSH ProxyCommand directive, enabling secure file copy and IDE remote development without public IPs.