Automating Patch Management with AWS Systems Manager and Terraform
Overview
AWS Systems Manager Patch Manager automates patching for EC2 instances, supporting both security and other updates. You can manage patching using patch baselines, maintenance windows, and instance tags, all of which can be provisioned via Terraform for repeatability and sharing.
📌 Introduction
Managing patch compliance across EC2 instances is a critical aspect of maintaining security and operational efficiency in the cloud. AWS Systems Manager Patch Manager simplifies this process by automating patch scans and installations.
In this guide, we walk through how to:
- Create an EC2 instance using Terraform
- Configure IAM roles and policies to enable SSM access
- Use Patch Manager to scan for missing patches
- Trigger patching manually from the AWS Console
We provision everything using a single Terraform file, making the process clean, repeatable, and infrastructure-as-code driven.
Prerequisites
- AWS Account with permissions to create EC2, IAM, and Systems Manager resources.
- Terraform installed locally.
- AWS CLI configured.
- SSM Agent: Pre-installed on Amazon Linux 2 AMIs by default
SSM Agent Installation on Amazon Linux 2
If you use the official Amazon Linux 2 AMI (or Amazon Linux 2023), the SSM Agent comes preinstalled by default. This means you do not need to add any extra configuration or user data to install the agent when launching the instance. As long as you select the standard Amazon Linux 2 AMI provided by AWS.
- Now lets paste below code in terraform main.tf file You can clone also from https://github.com/shrihariharidass/awssystempatch.git
provider "aws" {
region = "us-east-1"
}
resource "aws_iam_role" "ssm_role" {
name = "ec2_ssm_role"
assume_role_policy = data.aws_iam_policy_document.ec2_assume_role_policy.json
}
data "aws_iam_policy_document" "ec2_assume_role_policy" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["ec2.amazonaws.com"]
}
}
}
resource "aws_iam_role_policy_attachment" "ssm" {
role = aws_iam_role.ssm_role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMFullAccess"
}
resource "aws_instance" "linux" {
ami = "ami-xxxxxxxx" # Use latest Amazon Linux 2 AMI
instance_type = "t3.micro"
iam_instance_profile = aws_iam_instance_profile.ssm_profile.name
tags = {
Name = "patch-demo"
"Patch Group" = "LinuxTestGroup"
}
}
resource "aws_iam_instance_profile" "ssm_profile" {
name = "ec2_ssm_profile"
role = aws_iam_role.ssm_role.name
}IAM Role for EC2 SSM Access
resource "aws_iam_role" "ssm_role" {
name = "ec2_ssm_role"
assume_role_policy = data.aws_iam_policy_document.ec2_assume_role_policy.json
}- Purpose: Creates an IAM role named
ec2_ssm_rolefor EC2 instances. - Effect: This role allows EC2 instances to interact with AWS services as defined by the attached policies.
IAM Assume Role Policy Document
data "aws_iam_policy_document" "ec2_assume_role_policy" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["ec2.amazonaws.com"]
}
}
}- Purpose: Defines a policy document that allows EC2 instances to assume the IAM role.
- Effect: Grants EC2 service permission to use this role.
Attach SSM Policy to Role
resource "aws_iam_role_policy_attachment" "ssm" {
role = aws_iam_role.ssm_role.name
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMFullAccess"
}- Purpose: Attaches the
AmazonSSMFullAccesspolicy to the IAM role. - Effect: Grants the EC2 instance full access to AWS Systems Manager (SSM), which is needed for Patch Manager, Session Manager, and other SSM features.
IAM Instance Profile
resource "aws_iam_instance_profile" "ssm_profile" {
name = "ec2_ssm_profile"
role = aws_iam_role.ssm_role.name
}- Purpose: Creates an instance profile named
ec2_ssm_profilethat refers to the IAM role. - Effect: Allows the EC2 instance to use the IAM role when it launches.
2. Now to apply this configuration apply below terraform command
terraform init
terraform plan
terraform apply
3. Now you can see our instance has been created now for next step Go to AWS Systems Manager > Patch Manager in the AWS Console
4. then click on “Create Patch Manger Policy”
5. Now, in this window, select the "Scan" option. If you want to install patches. If any patch is missing, you can choose that option. As of now, we just launched the instance, so I am not selecting the "Scan and Install" option. also choose “Use recommended details” as option that aws give if you have any custom policy you can go with 2nd option
6. Now, next, select “Current account” since this is my personal AWS account. If you have an organizational AWS account, choose that option instead. I’m proceeding with the current AWS account and selecting the current region.
In the Target Nodes section, choose “Specify tags” and enter the key and value that we previously configured.
7. If you want to write the output to an S3 bucket, enable that option and select your S3 bucket.
8. Then scroll down and click "Create". There are other options available, but since this is just a demonstration, go ahead and click "Create Patch Manager".
9. Now, you can see the Systems Manager Dashboard. In the previous window (before creating), it also showed the scheduled time for scanning. You can configure that as well — this is commonly referred to as a maintenance or patching window, which Patch Manager takes care of.
10. Now, in the next window, select the patching option as “Scan only”. Choose “Only targeted instances” for the target scope. For the Target selection criteria, select “Instance tags”, enter the key and value we used earlier, and click “Add”.
Finally, select the log storage location, scroll down, and click “Patch now”.
11. Now, it will scan the instance and show whether the result is Success, Failed, or Skipped. In my case, we can see that it passed
12. Now, if you go back to the dashboard, it will show whether the instance is compliant or non-compliant, along with other relevant details.
13. So, this is how you can use AWS Systems Manager Patch Manager to scan and manage patch compliance on your instances. You can also explore additional features like:
- Scheduling patching using Maintenance Windows
- Creating Patch Baselines with custom rules
- Storing logs in S3 or sending them to CloudWatch
- Applying patches automatically across multiple instances using tags or resource groups
Feel free to customize it further based on your environment and patching strategy.
14. Once the patching is completed and tested, you can safely delete the policy and destroy the infrastructure that we created using Terraform. This ensures that no unnecessary resources are left running.
🏁 Conclusion
With the combination of Terraform and AWS Systems Manager Patch Manager, you can easily automate and manage patch compliance at scale. This approach helps improve security posture, reduces manual efforts, and ensures consistent infrastructure configuration.
Whether you’re managing a single instance or hundreds, leveraging infrastructure as code for patch management ensures better visibility, repeatability, and control over your cloud environment.
