Update patches to improve the security of ECS instances - Elastic Compute Service

Scan, install, and schedule patches on ECS instances with OOS Patch Management using default or custom patch baselines.

Background

Patch Management automatically updates security and other patches for operating systems and applications. It scans or installs patches based on the default patch baseline of the selected instance's operating system. See How a patch manager works and Patch baseline.

Patch Management supports Fix Now and Scheduled Fix modes for the following scenarios.

Patch management type	Scenarios
Fix Now	High-risk vulnerabilities: Patch immediately to reduce threat exposure from vulnerabilities that can lead to system intrusions or data breaches. Core systems: Apply security updates promptly to systems running business-critical services or processing sensitive data. Known exploits: Patch immediately if a vulnerability is widely exploited, even if your system is not yet affected. Compliance requirements: Patch vulnerabilities within required timeframes to meet industry or regional regulations.
Fix on a schedule	Non-critical vulnerabilities: Schedule patches for low-risk vulnerabilities during off-peak hours to minimize business impact. System stability: In large or complex environments, deploy patches during planned maintenance windows to allow thorough testing and backups. Resource optimization: Schedule batch patches during off-peak times, such as weekends or nights, to optimize O&M resource usage.

Prerequisites

ECS instances run operating systems that support Patch Management. See Supported operating systems.

The account has the following permissions. See Use RAM to grant permissions to OOS.

{
    "Policy": {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "ecs:RebootInstance",
                    "ecs:DescribeInvocationResults",
                    "ecs:DescribeCloudAssistantStatus",
                    "ecs:DescribeInstances",
                    "ecs:DescribeInvocations",
                    "ecs:RunCommand"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
             },
             {
                 "Action": [
                     "oos:ListInstancePatchStates"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
              }
      ]
   }
}

Procedure

This example uses Scheduled Fix mode. To update patches immediately, see Immediate fix.

Log on to the CloudOps Orchestration Service (OOS) console.
In the left-side navigation pane, choose Server Management > Patch Management. Click Scheduled Fix.
In the Basic Information section, configure the parameters.

Key parameters:
- Scheduled Task Type: The schedule for OOS to update patches. Example: every day at 0:00:00.
- Fix Operations:
  - Scan: Scans each instance and generates a list of missing patches.
  - Scan and Install: Scans each instance, compares existing patches against the patch baseline, and installs missing approved patches.
- Whether to Create Snapshot for System Disk: Select Yes and specify a snapshot retention period.
- Allow restart: Whether to restart the instance after patching.
  - Yes: If an installed patch requires a restart, the instance is restarted.
  - No: The instance is not restarted. Patches that require a restart remain in the Pending state.
- Permissions: Select Default Service-linked Role.
Click Select Instances. Set Resource Types to ECS Instance and select the target instances.
Keep the default values in the Advanced Options section and click Immediate execution.
In the Parameter Confirmation dialog box, confirm the parameters and click OK.

The dialog box contains the following key information:
- Execution mode: Automatic execution
- Risky operations: RunCommand, RebootInstance, RebootDesktops (involves instance restart, proceed with caution)
- Execution targets: 4 instances in the China (Beijing) region
- Resource type: ALIYUN::ECS::Instance
View the patch update task details.
1. On the Patch Management page, check the Status column. Success indicates the task is complete.
2. Click the Execution ID or Details in the Actions column to view patch details.
  
  The execution details page displays the following information:
  - Basic information: Execution ID, execution mode (automatic execution), execution status (succeeded), region, template name (such as Configure patch baselines for ECS instances in batches).
  - Task information: Patch baseline configuration method (such as scan), whether to create a system disk snapshot, whether to restart, resource type, and target instance IDs.
  - Execution steps and results: The left side shows the execution status of each step. Select the Patches tab to view patch statistics (all, installed, not installed, installed pending restart, installation failed, installed not meeting patch baseline, installed rejected patches) and the patch details list.

References

CloudOps Orchestration Service (OOS) is a free cloud-based O&M platform for automating repetitive tasks, event-driven workflows, scheduled batch operations, and cross-region management. OOS standardizes O&M by converting playbooks and guides into templates (Operations as Code). See What is CloudOps Orchestration Service?.