Skip to main content
- What it is
- A capability of AWS Systems Manager that automates patching of OS and applications across EC2 and on-premises servers.
- How it works
- Patch baselines — rules for which patches are approved (e.g. auto-approve critical security patches after 7 days).
- Patch groups — tag instances so different groups get different baselines.
- Maintenance windows — schedule when patching runs, so it hits during low-traffic hours.
- Reporting
- Compliance dashboard shows which nodes are missing approved patches.
- Not to be confused with
- AWS Config — reports whether a resource is compliant. Patch Manager actually applies the patches.
- Pairs with
- State Manager / maintenance windows to run patch scans and installs on a schedule.