2021/03/01 - Amazon Simple Systems Manager (SSM) - 1 updated api methods
Changes Add Support for Patch Manger Baseline Override parameter.
{'BaselineOverride': {'ApprovalRules': {'PatchRules': [{'ApproveAfterDays': 'integer',
'ApproveUntilDate': 'string',
'ComplianceLevel': 'CRITICAL '
'| '
'HIGH '
'| '
'MEDIUM '
'| '
'LOW '
'| '
'INFORMATIONAL '
'| '
'UNSPECIFIED',
'EnableNonSecurity': 'boolean',
'PatchFilterGroup': {'PatchFilters': [{'Key': 'ARCH '
'| '
'ADVISORY_ID '
'| '
'BUGZILLA_ID '
'| '
'PATCH_SET '
'| '
'PRODUCT '
'| '
'PRODUCT_FAMILY '
'| '
'CLASSIFICATION '
'| '
'CVE_ID '
'| '
'EPOCH '
'| '
'MSRC_SEVERITY '
'| '
'NAME '
'| '
'PATCH_ID '
'| '
'SECTION '
'| '
'PRIORITY '
'| '
'REPOSITORY '
'| '
'RELEASE '
'| '
'SEVERITY '
'| '
'SECURITY '
'| '
'VERSION',
'Values': ['string']}]}}]},
'ApprovedPatches': ['string'],
'ApprovedPatchesComplianceLevel': 'CRITICAL | HIGH | '
'MEDIUM | LOW | '
'INFORMATIONAL | '
'UNSPECIFIED',
'ApprovedPatchesEnableNonSecurity': 'boolean',
'GlobalFilters': {'PatchFilters': [{'Key': 'ARCH | '
'ADVISORY_ID '
'| '
'BUGZILLA_ID '
'| PATCH_SET '
'| PRODUCT | '
'PRODUCT_FAMILY '
'| '
'CLASSIFICATION '
'| CVE_ID | '
'EPOCH | '
'MSRC_SEVERITY '
'| NAME | '
'PATCH_ID | '
'SECTION | '
'PRIORITY | '
'REPOSITORY | '
'RELEASE | '
'SEVERITY | '
'SECURITY | '
'VERSION',
'Values': ['string']}]},
'OperatingSystem': 'WINDOWS | AMAZON_LINUX | '
'AMAZON_LINUX_2 | UBUNTU | '
'REDHAT_ENTERPRISE_LINUX | SUSE | '
'CENTOS | ORACLE_LINUX | DEBIAN | '
'MACOS',
'RejectedPatches': ['string'],
'RejectedPatchesAction': 'ALLOW_AS_DEPENDENCY | BLOCK',
'Sources': [{'Configuration': 'string',
'Name': 'string',
'Products': ['string']}]}}
Retrieves the current snapshot for the patch baseline the instance uses. This API is primarily used by the AWS-RunPatchBaseline Systems Manager document.
See also: AWS API Documentation
Request Syntax
client.get_deployable_patch_snapshot_for_instance(
InstanceId='string',
SnapshotId='string',
BaselineOverride={
'OperatingSystem': 'WINDOWS'|'AMAZON_LINUX'|'AMAZON_LINUX_2'|'UBUNTU'|'REDHAT_ENTERPRISE_LINUX'|'SUSE'|'CENTOS'|'ORACLE_LINUX'|'DEBIAN'|'MACOS',
'GlobalFilters': {
'PatchFilters': [
{
'Key': 'ARCH'|'ADVISORY_ID'|'BUGZILLA_ID'|'PATCH_SET'|'PRODUCT'|'PRODUCT_FAMILY'|'CLASSIFICATION'|'CVE_ID'|'EPOCH'|'MSRC_SEVERITY'|'NAME'|'PATCH_ID'|'SECTION'|'PRIORITY'|'REPOSITORY'|'RELEASE'|'SEVERITY'|'SECURITY'|'VERSION',
'Values': [
'string',
]
},
]
},
'ApprovalRules': {
'PatchRules': [
{
'PatchFilterGroup': {
'PatchFilters': [
{
'Key': 'ARCH'|'ADVISORY_ID'|'BUGZILLA_ID'|'PATCH_SET'|'PRODUCT'|'PRODUCT_FAMILY'|'CLASSIFICATION'|'CVE_ID'|'EPOCH'|'MSRC_SEVERITY'|'NAME'|'PATCH_ID'|'SECTION'|'PRIORITY'|'REPOSITORY'|'RELEASE'|'SEVERITY'|'SECURITY'|'VERSION',
'Values': [
'string',
]
},
]
},
'ComplianceLevel': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNSPECIFIED',
'ApproveAfterDays': 123,
'ApproveUntilDate': 'string',
'EnableNonSecurity': True|False
},
]
},
'ApprovedPatches': [
'string',
],
'ApprovedPatchesComplianceLevel': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNSPECIFIED',
'RejectedPatches': [
'string',
],
'RejectedPatchesAction': 'ALLOW_AS_DEPENDENCY'|'BLOCK',
'ApprovedPatchesEnableNonSecurity': True|False,
'Sources': [
{
'Name': 'string',
'Products': [
'string',
],
'Configuration': 'string'
},
]
}
)
string
[REQUIRED]
The ID of the instance for which the appropriate patch snapshot should be retrieved.
string
[REQUIRED]
The user-defined snapshot ID.
dict
Defines the basic information about a patch baseline override.
OperatingSystem (string) --
The operating system rule used by the patch baseline override.
GlobalFilters (dict) --
A set of patch filters, typically used for approval rules.
PatchFilters (list) -- [REQUIRED]
The set of patch filters that make up the group.
(dict) --
Defines which patches should be included in a patch baseline.
A patch filter consists of a key and a set of values. The filter key is a patch property. For example, the available filter keys for WINDOWS are PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, and MSRC_SEVERITY. The filter values define a matching criterion for the patch property indicated by the key. For example, if the filter key is PRODUCT and the filter values are ["Office 2013", "Office 2016"], then the filter accepts all patches where product name is either "Office 2013" or "Office 2016". The filter values can be exact values for the patch property given as a key, or a wildcard (*), which matches all values.
You can view lists of valid values for the patch properties by running the DescribePatchProperties command. For information about which patch properties can be used with each major operating system, see DescribePatchProperties .
Key (string) -- [REQUIRED]
The key for the filter.
Run the DescribePatchProperties command to view lists of valid keys for each operating system type.
Values (list) -- [REQUIRED]
The value for the filter key.
Run the DescribePatchProperties command to view lists of valid values for each key based on operating system type.
(string) --
ApprovalRules (dict) --
A set of rules defining the approval rules for a patch baseline.
PatchRules (list) -- [REQUIRED]
The rules that make up the rule group.
(dict) --
Defines an approval rule for a patch baseline.
PatchFilterGroup (dict) -- [REQUIRED]
The patch filter group that defines the criteria for the rule.
PatchFilters (list) -- [REQUIRED]
The set of patch filters that make up the group.
(dict) --
Defines which patches should be included in a patch baseline.
A patch filter consists of a key and a set of values. The filter key is a patch property. For example, the available filter keys for WINDOWS are PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, and MSRC_SEVERITY. The filter values define a matching criterion for the patch property indicated by the key. For example, if the filter key is PRODUCT and the filter values are ["Office 2013", "Office 2016"], then the filter accepts all patches where product name is either "Office 2013" or "Office 2016". The filter values can be exact values for the patch property given as a key, or a wildcard (*), which matches all values.
You can view lists of valid values for the patch properties by running the DescribePatchProperties command. For information about which patch properties can be used with each major operating system, see DescribePatchProperties .
Key (string) -- [REQUIRED]
The key for the filter.
Run the DescribePatchProperties command to view lists of valid keys for each operating system type.
Values (list) -- [REQUIRED]
The value for the filter key.
Run the DescribePatchProperties command to view lists of valid values for each key based on operating system type.
(string) --
ComplianceLevel (string) --
A compliance severity level for all approved patches in a patch baseline.
ApproveAfterDays (integer) --
The number of days after the release date of each patch matched by the rule that the patch is marked as approved in the patch baseline. For example, a value of 7 means that patches are approved seven days after they are released. Not supported on Debian Server or Ubuntu Server.
ApproveUntilDate (string) --
The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Not supported on Debian Server or Ubuntu Server.
Enter dates in the format YYYY-MM-DD . For example, 2020-12-31 .
EnableNonSecurity (boolean) --
For instances identified by the approval rule filters, enables a patch baseline to apply non-security updates available in the specified repository. The default value is 'false'. Applies to Linux instances only.
ApprovedPatches (list) --
A list of explicitly approved patches for the baseline.
For information about accepted formats for lists of approved patches and rejected patches, see About package name formats for approved and rejected patch lists in the AWS Systems Manager User Guide .
(string) --
ApprovedPatchesComplianceLevel (string) --
Defines the compliance level for approved patches. When an approved patch is reported as missing, this value describes the severity of the compliance violation.
RejectedPatches (list) --
A list of explicitly rejected patches for the baseline.
For information about accepted formats for lists of approved patches and rejected patches, see About package name formats for approved and rejected patch lists in the AWS Systems Manager User Guide .
(string) --
RejectedPatchesAction (string) --
The action for Patch Manager to take on patches included in the RejectedPackages list. A patch can be allowed only if it is a dependency of another package, or blocked entirely along with packages that include it as a dependency.
ApprovedPatchesEnableNonSecurity (boolean) --
Indicates whether the list of approved patches includes non-security updates that should be applied to the instances. The default value is 'false'. Applies to Linux instances only.
Sources (list) --
Information about the patches to use to update the instances, including target operating systems and source repositories. Applies to Linux instances only.
(dict) --
Information about the patches to use to update the instances, including target operating systems and source repository. Applies to Linux instances only.
Name (string) -- [REQUIRED]
The name specified to identify the patch source.
Products (list) -- [REQUIRED]
The specific operating system versions a patch repository applies to, such as "Ubuntu16.04", "AmazonLinux2016.09", "RedhatEnterpriseLinux7.2" or "Suse12.7". For lists of supported product values, see PatchFilter .
(string) --
Configuration (string) -- [REQUIRED]
The value of the yum repo configuration. For example:
[main]
name=MyCustomRepository
baseurl=https://my-custom-repository
enabled=1
Note
For information about other options available for your yum repository configuration, see dnf.conf(5) .
dict
Response Syntax
{
'InstanceId': 'string',
'SnapshotId': 'string',
'SnapshotDownloadUrl': 'string',
'Product': 'string'
}
Response Structure
(dict) --
InstanceId (string) --
The ID of the instance.
SnapshotId (string) --
The user-defined snapshot ID.
SnapshotDownloadUrl (string) --
A pre-signed Amazon S3 URL that can be used to download the patch snapshot.
Product (string) --
Returns the specific operating system (for example Windows Server 2012 or Amazon Linux 2015.09) on the instance for the specified patch snapshot.