Back to Checks
aws

EC2 managed instance is compliant with Systems Manager patching requirements

ssm_managed_compliant_patching
Service: ssmSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsSsmPatchCompliance

SSM-managed EC2 instances report patch compliance against defined baselines. This evaluates each managed node's compliance status from Patch Manager to determine whether required security updates are applied according to policy.

Prowler logoProwlerprowler-provider-aws

Risk

Unpatched instances expose known CVE vulnerabilities, enabling remote code execution, privilege escalation, and lateral movement.

This threatens confidentiality (data exfiltration), integrity (unauthorized changes), and availability (ransomware, crypto-mining, outages).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ssm_managed_compliant_patching

Recommendation

Adopt automated patch management with Systems Manager: enroll EC2 as managed nodes, define strict patch baselines, run frequent compliance scans, and install critical updates promptly.

Apply defense in depth: least-privileged roles for patching, staged rollouts, maintenance windows, and centralized compliance reporting with alerting.

Remediation

CLI

aws ssm send-command --instance-ids <INSTANCE_ID> --document-name AWS-RunPatchBaseline --parameters Operation=Install

Terraform

# Run AWS-RunPatchBaseline to install missing patches on the instance
resource "aws_ssm_association" "<example_resource_name>" {
  name        = "AWS-RunPatchBaseline"
  instance_id = "<example_resource_id>"
  parameters = {
    Operation = ["Install"]  # Critical: installs patches to achieve COMPLIANT status
  }
}

NativeIaC

# Create an SSM Association to install missing patches on the instance
Resources:
  <example_resource_name>:
    Type: AWS::SSM::Association
    Properties:
      Name: AWS-RunPatchBaseline
      InstanceId: <example_resource_id>
      Parameters:
        Operation:
          - Install  # Critical: installs missing patches so the instance becomes COMPLIANT

Other

1Open AWS Console > Systems Manager > Run Command
2Click Run command
3Select document: AWS-RunPatchBaseline
4In Parameters, set Operation = Install
5In Targets, select the non-compliant instance
6Click Run; wait for command to complete and verify Compliance shows COMPLIANT

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ssm.ssm_client import ssm_client
from prowler.providers.aws.services.ssm.ssm_service import ResourceStatus


class ssm_managed_compliant_patching(Check):
    def execute(self):
        findings = []
        for resource in ssm_client.compliance_resources.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=resource)
            # Find tags of the instance in ec2_client
            for instance in ec2_client.instances:
                if instance.id == resource.id:
                    report.resource_tags = instance.tags

            if resource.status == ResourceStatus.COMPLIANT:
                report.status = "PASS"
                report.status_extended = (
                    f"EC2 managed instance {resource.id} is compliant."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"EC2 managed instance {resource.id} is non-compliant."
                )

            findings.append(report)

        return findings

References