CloudOps Orchestration Service:Scheduled fix

Background information

Most enterprises often have specific compliance requirements for IT assets, including Alibaba Cloud Elastic Compute Service (ECS) instances. The system vulnerabilities of the instances need to be fixed at the earliest opportunity to prevent security attacks, or some software packages need to be kept up to date. In such cases, the patch management feature can be used. You can configure a scheduled fix to scan or install patches every day or at a specified point in time. For example, you can use this feature to install patches with a low priority based on a default patch baseline or a custom patch baseline as scheduled. This topic shows you how to configure a scheduled fix. Scheduled fixes support the following modes:

1. Scan patches: Check patches and return the results.

2. Install patches without restarting an ECS instance.

3. Install patches and restart an ECS instance as required by the patches.

Permissions

CloudOps Orchestration Service (OOS) must be granted the permissions to call specific operations. The following code block provides an example on how to grant the permissions:

{
    "Policy": {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "ecs:RebootInstance",
                    "ecs:DescribeInvocationResults",
                    "ecs:DescribeCloudAssistantStatus",
                    "ecs:DescribeInstances",
                    "ecs:DescribeInvocations",
                    "ecs:RunCommand"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
             },
             {
                 "Action": [
                     "oos:ListInstancePatchStates"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
              }
      ]
   }
}

For more information, visit the following URL:

Grant RAM permissions to OOS

Procedure