AWS API Changes

2023/03/22 - Amazon Simple Systems Manager (SSM) - 9 updated api methods

Changes This Patch Manager release supports creating, updating, and deleting Patch Baselines for AmazonLinux2023, AlmaLinux.

CreatePatchBaseline (updated)

Link ¶
Changes (request)

{'OperatingSystem': {'ALMA_LINUX', 'AMAZON_LINUX_2023'}}

Creates a patch baseline.

See also: AWS API Documentation

Request Syntax

client.create_patch_baseline(
    OperatingSystem='WINDOWS'|'AMAZON_LINUX'|'AMAZON_LINUX_2'|'AMAZON_LINUX_2022'|'UBUNTU'|'REDHAT_ENTERPRISE_LINUX'|'SUSE'|'CENTOS'|'ORACLE_LINUX'|'DEBIAN'|'MACOS'|'RASPBIAN'|'ROCKY_LINUX'|'ALMA_LINUX'|'AMAZON_LINUX_2023',
    Name='string',
    GlobalFilters={
        'PatchFilters': [
            {
                'Key': 'ARCH'|'ADVISORY_ID'|'BUGZILLA_ID'|'PATCH_SET'|'PRODUCT'|'PRODUCT_FAMILY'|'CLASSIFICATION'|'CVE_ID'|'EPOCH'|'MSRC_SEVERITY'|'NAME'|'PATCH_ID'|'SECTION'|'PRIORITY'|'REPOSITORY'|'RELEASE'|'SEVERITY'|'SECURITY'|'VERSION',
                'Values': [
                    'string',
                ]
            },
        ]
    },
    ApprovalRules={
        'PatchRules': [
            {
                'PatchFilterGroup': {
                    'PatchFilters': [
                        {
                            'Key': 'ARCH'|'ADVISORY_ID'|'BUGZILLA_ID'|'PATCH_SET'|'PRODUCT'|'PRODUCT_FAMILY'|'CLASSIFICATION'|'CVE_ID'|'EPOCH'|'MSRC_SEVERITY'|'NAME'|'PATCH_ID'|'SECTION'|'PRIORITY'|'REPOSITORY'|'RELEASE'|'SEVERITY'|'SECURITY'|'VERSION',
                            'Values': [
                                'string',
                            ]
                        },
                    ]
                },
                'ComplianceLevel': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNSPECIFIED',
                'ApproveAfterDays': 123,
                'ApproveUntilDate': 'string',
                'EnableNonSecurity': True|False
            },
        ]
    },
    ApprovedPatches=[
        'string',
    ],
    ApprovedPatchesComplianceLevel='CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNSPECIFIED',
    ApprovedPatchesEnableNonSecurity=True|False,
    RejectedPatches=[
        'string',
    ],
    RejectedPatchesAction='ALLOW_AS_DEPENDENCY'|'BLOCK',
    Description='string',
    Sources=[
        {
            'Name': 'string',
            'Products': [
                'string',
            ],
            'Configuration': 'string'
        },
    ],
    ClientToken='string',
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ]
)

type OperatingSystem:

string

param OperatingSystem:

Defines the operating system the patch baseline applies to. The default value is WINDOWS.

type Name:

string

param Name:

[REQUIRED]

The name of the patch baseline.

type GlobalFilters:

dict

param GlobalFilters:

A set of global filters used to include patches in the baseline.

PatchFilters (list) -- [REQUIRED]

The set of patch filters that make up the group.
- (dict) --
  
  Defines which patches should be included in a patch baseline.
  
  A patch filter consists of a key and a set of values. The filter key is a patch property. For example, the available filter keys for WINDOWS are PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, and MSRC_SEVERITY.
  
  The filter values define a matching criterion for the patch property indicated by the key. For example, if the filter key is PRODUCT and the filter values are ["Office 2013", "Office 2016"], then the filter accepts all patches where product name is either "Office 2013" or "Office 2016". The filter values can be exact values for the patch property given as a key, or a wildcard (*), which matches all values.
  
  You can view lists of valid values for the patch properties by running the DescribePatchProperties command. For information about which patch properties can be used with each major operating system, see DescribePatchProperties.
  - Key (string) -- [REQUIRED]
    
    The key for the filter.
    
    Run the DescribePatchProperties command to view lists of valid keys for each operating system type.
  - Values (list) -- [REQUIRED]
    
    The value for the filter key.
    
    Run the DescribePatchProperties command to view lists of valid values for each key based on operating system type.
    - (string) --

type ApprovalRules:

dict

param ApprovalRules:

A set of rules used to include patches in the baseline.

PatchRules (list) -- [REQUIRED]

The rules that make up the rule group.
- (dict) --
  
  Defines an approval rule for a patch baseline.
  - PatchFilterGroup (dict) -- [REQUIRED]
    
    The patch filter group that defines the criteria for the rule.
    - PatchFilters (list) -- [REQUIRED]
      
      The set of patch filters that make up the group.
      - (dict) --
        
        Defines which patches should be included in a patch baseline.
        
        A patch filter consists of a key and a set of values. The filter key is a patch property. For example, the available filter keys for WINDOWS are PATCH_SET, PRODUCT, PRODUCT_FAMILY, CLASSIFICATION, and MSRC_SEVERITY.
        
        The filter values define a matching criterion for the patch property indicated by the key. For example, if the filter key is PRODUCT and the filter values are ["Office 2013", "Office 2016"], then the filter accepts all patches where product name is either "Office 2013" or "Office 2016". The filter values can be exact values for the patch property given as a key, or a wildcard (*), which matches all values.
        
        You can view lists of valid values for the patch properties by running the DescribePatchProperties command. For information about which patch properties can be used with each major operating system, see DescribePatchProperties.
        
        Key (string) -- [REQUIRED]
        
        The key for the filter.
        
        Run the DescribePatchProperties command to view lists of valid keys for each operating system type.
        
        Values (list) -- [REQUIRED]
        
        The value for the filter key.
        
        Run the DescribePatchProperties command to view lists of valid values for each key based on operating system type.
        
        (string) --
  - ComplianceLevel (string) --
    
    A compliance severity level for all approved patches in a patch baseline.
  - ApproveAfterDays (integer) --
    
    The number of days after the release date of each patch matched by the rule that the patch is marked as approved in the patch baseline. For example, a value of 7 means that patches are approved seven days after they are released. Not supported on Debian Server or Ubuntu Server.
  - ApproveUntilDate (string) --
    
    The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically. Not supported on Debian Server or Ubuntu Server.
    
    Enter dates in the format YYYY-MM-DD. For example, 2021-12-31.
  - EnableNonSecurity (boolean) --
    
    For managed nodes identified by the approval rule filters, enables a patch baseline to apply non-security updates available in the specified repository. The default value is false. Applies to Linux managed nodes only.

type ApprovedPatches:

list

param ApprovedPatches:

A list of explicitly approved patches for the baseline.

For information about accepted formats for lists of approved patches and rejected patches, see About package name formats for approved and rejected patch lists in the Amazon Web Services Systems Manager User Guide.

(string) --

type ApprovedPatchesComplianceLevel:

string

param ApprovedPatchesComplianceLevel:

Defines the compliance level for approved patches. When an approved patch is reported as missing, this value describes the severity of the compliance violation. The default value is UNSPECIFIED.

type ApprovedPatchesEnableNonSecurity:

boolean

param ApprovedPatchesEnableNonSecurity:

Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes. The default value is false. Applies to Linux managed nodes only.

type RejectedPatches:

list

param RejectedPatches:

A list of explicitly rejected patches for the baseline.

(string) --

type RejectedPatchesAction:

string

param RejectedPatchesAction:

The action for Patch Manager to take on patches included in the RejectedPackages list.

ALLOW_AS_DEPENDENCY : A package in the Rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as InstalledOther. This is the default action if no option is specified.
BLOCK : Packages in the RejectedPatches list, and packages that include them as dependencies, aren't installed under any circumstances. If a package was installed before it was added to the Rejected patches list, it is considered non-compliant with the patch baseline, and its status is reported as InstalledRejected.

type Description:

string

param Description:

A description of the patch baseline.

type Sources:

list

param Sources:

Information about the patches to use to update the managed nodes, including target operating systems and source repositories. Applies to Linux managed nodes only.

(dict) --

Information about the patches to use to update the managed nodes, including target operating systems and source repository. Applies to Linux managed nodes only.
- Name (string) -- [REQUIRED]
  
  The name specified to identify the patch source.
- Products (list) -- [REQUIRED]
  
  The specific operating system versions a patch repository applies to, such as "Ubuntu16.04", "AmazonLinux2016.09", "RedhatEnterpriseLinux7.2" or "Suse12.7". For lists of supported product values, see PatchFilter.
  - (string) --
- Configuration (string) -- [REQUIRED]
  
  The value of the yum repo configuration. For example:
  
  [main]
  
  name=MyCustomRepository
  
  baseurl=https://my-custom-repository
  
  enabled=1
  
  Note
  
  For information about other options available for your yum repository configuration, see dnf.conf(5).

type ClientToken:

string

param ClientToken:

User-provided idempotency token.

This field is autopopulated if not provided.

type Tags:

list

param Tags:

Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a patch baseline to identify the severity level of patches it specifies and the operating system family it applies to. In this case, you could specify the following key-value pairs:

Key=PatchSeverity,Value=Critical
Key=OS,Value=Windows

(dict) --

Metadata that you assign to your Amazon Web Services resources. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment. In Amazon Web Services Systems Manager, you can apply tags to Systems Manager documents (SSM documents), managed nodes, maintenance windows, parameters, patch baselines, OpsItems, and OpsMetadata.
- Key (string) -- [REQUIRED]
  
  The name of the tag.
- Value (string) -- [REQUIRED]
  
  The value of the tag.

rtype:

dict

returns:

Response Syntax

{
    'BaselineId': 'string'
}

Response Structure

(dict) --
- BaselineId (string) --
  
  The ID of the created patch baseline.

DescribePatchBaselines (updated)

Link ¶
Changes (response)

{'BaselineIdentities': {'OperatingSystem': {'ALMA_LINUX', 'AMAZON_LINUX_2023'}}}

Lists the patch baselines in your Amazon Web Services account.

See also: AWS API Documentation

Request Syntax

client.describe_patch_baselines(
    Filters=[
        {
            'Key': 'string',
            'Values': [
                'string',
            ]
        },
    ],
    MaxResults=123,
    NextToken='string'
)

type Filters:

list

param Filters:

Each element in the array is a structure containing a key-value pair.

Supported keys for DescribePatchBaselines include the following:

NAME_PREFIX Sample values: AWS- | My-
OWNER Sample values: AWS | Self
OPERATING_SYSTEM Sample values: AMAZON_LINUX | SUSE | WINDOWS

(dict) --

Defines a filter used in Patch Manager APIs. Supported filter keys depend on the API operation that includes the filter. Patch Manager API operations that use PatchOrchestratorFilter include the following:
- DescribeAvailablePatches
- DescribeInstancePatches
- DescribePatchBaselines
- DescribePatchGroups
- Key (string) --
  
  The key for the filter.
- Values (list) --
  
  The value for the filter.
  - (string) --

type MaxResults:

integer

param MaxResults:

The maximum number of patch baselines to return (per page).

type NextToken:

string

param NextToken:

The token for the next set of items to return. (You received this token from a previous call.)

rtype:

dict

returns:

Response Syntax

{
    'BaselineIdentities': [
        {
            'BaselineId': 'string',
            'BaselineName': 'string',
            'OperatingSystem': 'WINDOWS'|'AMAZON_LINUX'|'AMAZON_LINUX_2'|'AMAZON_LINUX_2022'|'UBUNTU'|'REDHAT_ENTERPRISE_LINUX'|'SUSE'|'CENTOS'|'ORACLE_LINUX'|'DEBIAN'|'MACOS'|'RASPBIAN'|'ROCKY_LINUX'|'ALMA_LINUX'|'AMAZON_LINUX_2023',
            'BaselineDescription': 'string',
            'DefaultBaseline': True|False
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) --
- BaselineIdentities (list) --
  
  An array of PatchBaselineIdentity elements.
  - (dict) --
    
    Defines the basic information about a patch baseline.
    - BaselineId (string) --
      
      The ID of the patch baseline.
    - BaselineName (string) --
      
      The name of the patch baseline.
    - OperatingSystem (string) --
      
      Defines the operating system the patch baseline applies to. The default value is WINDOWS.
    - BaselineDescription (string) --
      
      The description of the patch baseline.
    - DefaultBaseline (boolean) --
      
      Whether this is the default baseline. Amazon Web Services Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system.
- NextToken (string) --
  
  The token to use when requesting the next set of items. If there are no additional items to return, the string is empty.

DescribePatchGroups (updated)

Link ¶
Changes (response)

{'Mappings': {'BaselineIdentity': {'OperatingSystem': {'ALMA_LINUX',
                                                       'AMAZON_LINUX_2023'}}}}

Lists all patch groups that have been registered with patch baselines.

See also: AWS API Documentation

Request Syntax

client.describe_patch_groups(
    MaxResults=123,
    Filters=[
        {
            'Key': 'string',
            'Values': [
                'string',
            ]
        },
    ],
    NextToken='string'
)

type MaxResults:

integer

param MaxResults:

The maximum number of patch groups to return (per page).

type Filters:

list

param Filters:

Each element in the array is a structure containing a key-value pair.

Supported keys for DescribePatchGroups include the following:

NAME_PREFIX Sample values: AWS- | My-.
OPERATING_SYSTEM Sample values: AMAZON_LINUX | SUSE | WINDOWS

(dict) --

Defines a filter used in Patch Manager APIs. Supported filter keys depend on the API operation that includes the filter. Patch Manager API operations that use PatchOrchestratorFilter include the following:
- DescribeAvailablePatches
- DescribeInstancePatches
- DescribePatchBaselines
- DescribePatchGroups
- Key (string) --
  
  The key for the filter.
- Values (list) --
  
  The value for the filter.
  - (string) --

type NextToken:

string

param NextToken:

The token for the next set of items to return. (You received this token from a previous call.)

rtype:

dict

returns:

Response Syntax

{
    'Mappings': [
        {
            'PatchGroup': 'string',
            'BaselineIdentity': {
                'BaselineId': 'string',
                'BaselineName': 'string',
                'OperatingSystem': 'WINDOWS'|'AMAZON_LINUX'|'AMAZON_LINUX_2'|'AMAZON_LINUX_2022'|'UBUNTU'|'REDHAT_ENTERPRISE_LINUX'|'SUSE'|'CENTOS'|'ORACLE_LINUX'|'DEBIAN'|'MACOS'|'RASPBIAN'|'ROCKY_LINUX'|'ALMA_LINUX'|'AMAZON_LINUX_2023',
                'BaselineDescription': 'string',
                'DefaultBaseline': True|False
            }
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) --
- Mappings (list) --
  
  Each entry in the array contains:
  - PatchGroup: string (between 1 and 256 characters. Regex: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$)
  - PatchBaselineIdentity: A PatchBaselineIdentity element.
  - (dict) --
    
    The mapping between a patch group and the patch baseline the patch group is registered with.
    - PatchGroup (string) --
      
      The name of the patch group registered with the patch baseline.
    - BaselineIdentity (dict) --
      
      The patch baseline the patch group is registered with.
      - BaselineId (string) --
        
        The ID of the patch baseline.
      - BaselineName (string) --
        
        The name of the patch baseline.
      - OperatingSystem (string) --
        
        Defines the operating system the patch baseline applies to. The default value is WINDOWS.
      - BaselineDescription (string) --
        
        The description of the patch baseline.
      - DefaultBaseline (boolean) --
        
        Whether this is the default baseline. Amazon Web Services Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system.
- NextToken (string) --
  
  The token to use when requesting the next set of items. If there are no additional items to return, the string is empty.

DescribePatchProperties (updated)

Link ¶
Changes (request)

{'OperatingSystem': {'ALMA_LINUX', 'AMAZON_LINUX_2023'}}

Lists the properties of available patches organized by product, product family, classification, severity, and other properties of available patches. You can use the reported properties in the filters you specify in requests for operations such as CreatePatchBaseline, UpdatePatchBaseline, DescribeAvailablePatches, and DescribePatchBaselines.

The following section lists the properties that can be used in filters for each major operating system type:

AMAZON_LINUX