Returns high-level aggregated patch compliance state information for a patch group.
See also: AWS API Documentation
See ‘aws help’ for descriptions of global parameters.
describe-patch-group-state
--patch-group <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
--patch-group
(string)
The name of the patch group whose patch snapshot should be retrieved.
--cli-input-json
| --cli-input-yaml
(string)
Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton
. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml
.
--generate-cli-skeleton
(string)
Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input
, prints a sample input JSON that can be used as an argument for --cli-input-json
. Similarly, if provided yaml-input
it will print a sample input YAML that can be used with --cli-input-yaml
. If provided with the value output
, it validates the command inputs and returns a sample output JSON for that command.
See ‘aws help’ for descriptions of global parameters.
To get the state of a patch group
The following describe-patch-group-state
example retrieves the high-level patch compliance summary for a patch group.
aws ssm describe-patch-group-state \
--patch-group "Production"
Output:
{
"Instances": 21,
"InstancesWithCriticalNonCompliantPatches": 1,
"InstancesWithFailedPatches": 2,
"InstancesWithInstalledOtherPatches": 3,
"InstancesWithInstalledPatches": 21,
"InstancesWithInstalledPendingRebootPatches": 2,
"InstancesWithInstalledRejectedPatches": 1,
"InstancesWithMissingPatches": 3,
"InstancesWithNotApplicablePatches": 4,
"InstancesWithOtherNonCompliantPatches": 1,
"InstancesWithSecurityNonCompliantPatches": 1,
"InstancesWithUnreportedNotApplicablePatches": 2
}
For more information, see About patch groups <https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-patchgroups.html>__ and Understanding patch compliance state values in the AWS Systems Manager User Guide.
Instances -> (integer)
The number of instances in the patch group.
InstancesWithInstalledPatches -> (integer)
The number of instances with installed patches.
InstancesWithInstalledOtherPatches -> (integer)
The number of instances with patches installed that aren’t defined in the patch baseline.
InstancesWithInstalledPendingRebootPatches -> (integer)
The number of instances with patches installed by Patch Manager that haven’t been rebooted after the patch installation. The status of these instances is
NON_COMPLIANT
.
InstancesWithInstalledRejectedPatches -> (integer)
The number of instances with patches installed that are specified in a
RejectedPatches
list. Patches with a status ofINSTALLED_REJECTED
were typically installed before they were added to aRejectedPatches
list.Note
If
ALLOW_AS_DEPENDENCY
is the specified option forRejectedPatchesAction
, the value ofInstancesWithInstalledRejectedPatches
will always be0
(zero).
InstancesWithMissingPatches -> (integer)
The number of instances with missing patches from the patch baseline.
InstancesWithFailedPatches -> (integer)
The number of instances with patches from the patch baseline that failed to install.
InstancesWithNotApplicablePatches -> (integer)
The number of instances with patches that aren’t applicable.
InstancesWithUnreportedNotApplicablePatches -> (integer)
The number of instances with
NotApplicable
patches beyond the supported limit, which aren’t reported by name to Inventory. Inventory is a capability of Amazon Web Services Systems Manager.
InstancesWithCriticalNonCompliantPatches -> (integer)
The number of instances where patches that are specified as
Critical
for compliance reporting in the patch baseline aren’t installed. These patches might be missing, have failed installation, were rejected, or were installed but awaiting a required instance reboot. The status of these instances isNON_COMPLIANT
.
InstancesWithSecurityNonCompliantPatches -> (integer)
The number of instances where patches that are specified as
Security
in a patch advisory aren’t installed. These patches might be missing, have failed installation, were rejected, or were installed but awaiting a required instance reboot. The status of these instances isNON_COMPLIANT
.
InstancesWithOtherNonCompliantPatches -> (integer)
The number of instances with patches installed that are specified as other than
Critical
orSecurity
but aren’t compliant with the patch baseline. The status of these instances isNON_COMPLIANT
.