Résumé
ONYEDIKACHI BERNARDCLOUD · DEVSECOPS · AI
RésuméGet in touch
CASE 09SECURE COMPUTE

Unpatched EC2 Instance

An EC2 instance was 21 patches behind. I measured the gap with a Patch Manager scan, installed the missing patches through Run Command, and confirmed the instance reached zero missing and zero failed.

Status: REMEDIATED · VERIFIED

DOMAIN
Secure compute
PLATFORM
AWS EC2, Systems Manager
SEVERITY
Medium
OUTCOME
Patch compliant

TOOLS

AWS CLIAmazon EC2AWS Systems ManagerSystems Manager Patch ManagerAWS-RunPatchBaseline
RESULT
BEFORE21 missing patches
AFTER0 missing, 0 failed
01

Objective

I set out to measure the patch compliance of a running EC2 instance, put a number on its missing patches, install them, and confirm it reached a compliant state.

02

Scenario

The instance was managed by Systems Manager and its agent was online, so Patch Manager could scan and patch it. Before I could judge its state I needed a fresh compliance record, so I started with a scan.

03

What I found

patch-state-before21 MISSING
Failed     Installed     Missing
0          120           21
FINDING 01MEDIUM

21 missing patches

The AWS-RunPatchBaseline scan completed successfully and showed the instance was behind.

Unpatched systems stay exposed to known vulnerabilities until the fixes are installed. Here the gap was concrete: 21 missing patches on one instance.

04

What I did

  1. Found the instance

    I identified it by its lab tag.

  2. Checked it was managed

    I confirmed it was registered with Systems Manager and the agent was online.

  3. Scanned

    I ran AWS-RunPatchBaseline with Operation=Scan, which completed with Status: Success.

  4. Read the patch state

    I queried the result and found 21 missing patches.

  5. Installed

    I ran the same document with Operation=Install through Run Command. It completed with Status: Success.

  6. Rechecked

    I queried the patch state again after the install.

05

Validation

After the install, the instance reported no missing and no failed patches:

patch-state-after
Failed     Installed     Missing
0          142           0
06

Before and after

PATCH COMPLIANCEBEFOREAFTER
Installed patches120142
Missing patches210
Failed patches00
OperationScanInstall
SSM statusOnlineOnline
07

What I recommend

  1. 01Scan EC2 workloads for missing patches on a schedule.
  2. 02Set a defined patching cadence for production.
  3. 03Watch patch compliance and chase instances that stay behind.
  4. 04Verify the patch state after installing, instead of assuming it worked.
  5. 05Prioritise security patches by severity and exposure.

“Patching should be measured with a compliance scan and verified afterwards, so the patch debt is a number, not a guess.”

WHAT I LEARNED

SKILLS IT PROVES

  • Cloud Security
  • Patch Management
  • AWS Systems Manager
  • EC2 Security
  • Vulnerability Assessment
  • Vulnerability Remediation
  • Security Posture Improvement
  • AWS CLI
View my labs on GitHub