Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[IT-4287] Automate SSM patching for all instances in all accounts #1334

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

[IT-4287] Automate SSM patching for all instances in all accounts #1334

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f8276a0
[IT-3940] Automate SSM patching for all instances in Platform accounts
ConsoleCatzirl Feb 7, 2025
08f5e6d
remove references to prod, apply everywhere
ConsoleCatzirl Feb 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions org-formation/090-systems-manager/QuickSetup-PatchPolicy-Prod.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
AWSTemplateFormatVersion: '2010-09-09'
ConsoleCatzirl marked this conversation as resolved.
Show resolved Hide resolved
Description: An SSM patch policy to patch all instances in the given OUs
Parameters:
TargetOrgUnits:
Type: String
Description: >-
Comma separated list of AWS Organizational Units to target.
TargetRegions:
Type: String
Description: >-
Comma separated list of AWS Organizational Units to target.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's probably better to change these to CommaDelimitedList types

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think that's appropriate, that would unpack the input into a list of strings, but the parameters these are being passed to expect a comma-delimited string, not a list of strings, so I'm pretty sure I would have to repack the values into a single string with !Join if this were a CommaDelimitedList

Resources:
PatchPolicy:
Type: "AWS::SSMQuickSetup::ConfigurationManager"
Properties:
Name: "PatchResourceGroup"
Description: "Patch all SSM managed nodes in production accounts"
ConfigurationDefinitions:
Type: AWSQuickSetupType-PatchPolicy
Parameters:
PatchPolicyName: PatchPolicy
# Patch baselines can be found with the command:
# aws ssm describe-patch-baselines |jq '.BaselineIdentities | map({ (.OperatingSystem): (.value = .BaselineId | .label = .BaselineName | .description = .BaselineDescription | .disabled=false | del(.BaselineId, .BaselineName, .OperatingSystem, .BaselineDescription, .DefaultBaseline)) }) | add'
#
# More information at:
# https://aws.amazon.com/blogs/mt/deploy-aws-systems-manager-quick-setup-programmatically-across-your-aws-organization/
# https://github.com/aws-samples/aws-management-and-governance-samples/blob/master/AWSSystemsManager/Quick-Setup-API/patch-policy-examples/patch-policy-cfn-template.yaml
# https://github.com/aws-samples/aws-management-and-governance-samples/blob/master/AWSSystemsManager/Quick-Setup-API/patch-policy-examples/default-patch-baselines.txt
SelectedPatchBaselines: >-
{
"ALMA_LINUX": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0cb0c4966f86b059b","label":"AWS-AlmaLinuxDefaultPatchBaseline","description":"Default Patch Baseline for Alma Linux Provided by AWS.","disabled":false},
"AMAZON_LINUX": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0c10e657807c7a700","label":"AWS-AmazonLinuxDefaultPatchBaseline","description":"Default Patch Baseline for Amazon Linux Provided by AWS.","disabled":false},
"AMAZON_LINUX_2": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0be8c61cde3be63f3","label":"AWS-AmazonLinux2DefaultPatchBaseline","description":"Default Patch Baseline for Amazon Linux 2 Provided by AWS.","disabled":false},
"AMAZON_LINUX_2022": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0028ca011460d5eaf","label":"AWS-AmazonLinux2022DefaultPatchBaseline","description":"Default Patch Baseline for Amazon Linux 2022 Provided by AWS.","disabled":false},
"AMAZON_LINUX_2023": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-05c9c9bf778d4c4d0","label":"AWS-AmazonLinux2023DefaultPatchBaseline","description":"Default Patch Baseline for Amazon Linux 2023 Provided by AWS.","disabled":false},
"CENTOS": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-03e3f588eec25344c","label":"AWS-CentOSDefaultPatchBaseline","description":"Default Patch Baseline for CentOS Provided by AWS.","disabled":false},
"DEBIAN": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-09a5f8eb62bde80b1","label":"AWS-DebianDefaultPatchBaseline","description":"Default Patch Baseline for Debian Provided by AWS.","disabled":false},
"MACOS": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0ee4f94581368c0d4","label":"AWS-MacOSDefaultPatchBaseline","description":"Default Patch Baseline for MacOS Provided by AWS.","disabled":false}},
"ORACLE_LINUX": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-06bff38e95fe85c02","label":"AWS-OracleLinuxDefaultPatchBaseline","description":"Default Patch Baseline for Oracle Linux Server Provided by AWS.","disabled":false},
"RASPBIAN": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0ec16280999c5c75e","label":"AWS-RaspbianDefaultPatchBaseline","description":"Default Patch Baseline for Raspbian Provided by AWS.","disabled":false},
"REDHAT_ENTERPRISE_LINUX": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0cbb3a633de00f07c","label":"AWS-RedHatDefaultPatchBaseline","description":"Default Patch Baseline for Redhat Enterprise Linux Provided by AWS.","disabled":false},
"ROCKY_LINUX": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-03ec98bc512aa3ac0","label":"AWS-RockyLinuxDefaultPatchBaseline","description":"Default Patch Baseline for Rocky Linux Provided by AWS.","disabled":false},
"SUSE": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-07d8884178197b66b","label":"AWS-SuseDefaultPatchBaseline","description":"Default Patch Baseline for Suse Provided by AWS.","disabled":false},
"UBUNTU": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0c7e89f711c3095f4","label":"AWS-UbuntuDefaultPatchBaseline","description":"Default Patch Baseline for Ubuntu Provided by AWS.","disabled":false},
"WINDOWS": {"value":"arn:aws:ssm:us-east-1:075727635805:patchbaseline/pb-0fafa8379afee7c83","label":"AWS-WindowsPredefinedPatchBaseline-OS-Applications","description":"For the Windows Server operating system, approves all patches that are classified as CriticalUpdates or SecurityUpdates and that have an MSRC severity of Critical or Important. For Microsoft applications, approves all patches. Patches are auto-approved seven days after release.","disabled":false}
}
ConfigurationOptionsPatchOperation: "ScanAndInstall"
TargetType: '*'
TargetOrganizationalUnits: !Ref TargetOrgUnits
TargetRegions: !Ref TargetRegions
Outputs:
PatchPolicyArn:
Description: 'Patch policy ARN'
Value: !Ref PatchPolicy
Export:
Name: !Sub '${AWS::StackName}-PatchPolicyArn'
12 changes: 12 additions & 0 deletions org-formation/090-systems-manager/_tasks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,18 @@ PatchMembers:
Parameters:
ManagementAccountNumber: !Ref accountId

PatchPolicy:
Type: update-stacks
Template: QuickSetup-PatchPolicy-Prod.yaml
StackName: !Sub '${resourcePrefix}-${appName}-patchpolicy'
StackDescription: Setup Systems manager patch policy for prod OUs
ConsoleCatzirl marked this conversation as resolved.
Show resolved Hide resolved
DefaultOrganizationBindingRegion: !Ref primaryRegion
DefaultOrganizationBinding:
Account: !Ref accountId
Parameters:
TargetOrgUnits: !Ref PlatformOU
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zaro0508 can I !Ref the OU here like this?

Copy link
Contributor

@zaro0508 zaro0508 Feb 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To answer your question, I'm not sure this example seems to indicate that it's possible however i'm not sure if it's only possible in context of an OrganizationBindings.

if it doesn't work you might want to think about converting the cloudformation template to a nunjucks template so that you can list each OU or account here.

Also I'm wondering if * works for this parameter?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately * isn't valid, but we can specify the organization root to target all accounts in the organization. I'll try doing it with a !Ref, but I might have to hard-code the value

TargetRegions: !Ref primaryRegion

# This will run the Stack Armor Nessus installation script each day
# on any EC2 in us-east-1 tagged with execute-script:install-stack-armor-agent
# Since the script is idempotent, running every day ensures the script
Expand Down