PatchBaseline

PatchBaseline is a configuration used by AWS Systems Manager Patch Manager to define which operating system patches are approved for installation on managed instances, and which patches are blocked. Baselines are defined per operating system (for example Windows, Amazon Linux, Amazon Linux 2, Ubuntu, Red Hat, SUSE) and can be either AWS-maintained defaults or customer created.

A patch baseline specifies several elements. Approved patches determine which patches may be installed, and can be chosen by patch classification (such as security, critical, important, or moderate), by specific patch IDs, or by keeping all patches unless explicitly blocked. Rejected patches explicitly prevent installation. Auto-approval rules can automatically approve patches after a set number of days from release, reducing manual effort. Baselines may also include a list of blocked patches to prevent installation of problematic updates. Each baseline can be associated with patch groups and maintenance windows to tailor targeting and scheduling.

How it works in practice: after an instance is configured as a managed instance with the SSM Agent, Patch Manager scans for missing patches. It then applies patches that are approved by the baseline, while leaving non-approved patches untouched. Compliance data is generated, showing which instances are compliant and which require action.

Why it matters: Patch Baselines enforce consistent patching across fleets, help meet security and compliance requirements, and provide auditable records of patch status. IAM roles and correct agent configuration are required to enable patch management workflows.