The lab will be set up in ap-southeast-2 (Sydney). Please ensure all operations are performed in this Region.
In the process of building a security strategy, OS Patching is an indispensable activity to ensure that EC2 instances running critical applications always use an operating system with the latest security patches, which will minimize the risk of security vulnerabilities and the attack surface.
The majority of security standards worldwide at least require evidence of the system updating and patching process because this is a daily and mandatory activity. On the other hand, for enterprises with a large number of resources, managers must be careful to avoid potential risks that could arise due to Operational Overhead and ensure that downtime is always minimal.
Therefore, an Automated Patching Solution is highly necessary; besides helping to reduce Operational Overhead, it also creates readiness for future Audits activities.
There are quite a few approaches so that we can automate the OS Patching task through the combination of AWS services.
A typical one among them is utilizing the Blue/Green Deployment method to build a new Amazon Machine Image (AMI) containing the latest patches, then this AMI will be fully ready to be used for EC2 instances running applications. To easily visualize, the following processes will be performed:
Regarding the shell used to run commands. The commands in the lab are provided in two versions, you choose the tab corresponding to your environment:
If you use Windows PowerShell, please note three commonly error-prone differences:
| Bash | PowerShell |
|---|---|
VAR=$(command) | $VAR = command |
command \ newline | use backtick `, or write concisely on a single line |
head -n 10 | Select-Object -First 10 |
curl -s | curl.exe -s, because curl is an alias of Invoke-WebRequest |
Upon completing this lab, you will be charged for resources that are not covered under the AWS Free Tier. The most significant costs are NAT Gateway and the EBS Snapshot of the AMIs created by Image Builder. Please complete the Resource Cleanup section immediately after finishing.
Approximately 90 to 120 minutes, in which the AMI build step of EC2 Image Builder alone takes 20 to 30 minutes.
The lab will include the following sections:
| Order | Name | Main Content |
|---|---|---|
| 1 | Introduction | Context, goals, and prerequisites |
| 2 | Base Infrastructure | VPC, Subnets, Internet Gateway, NAT Gateway |
| 3 | Application Infrastructure | ALB, Launch Template, Auto Scaling Group |
| 4 | AMI Builder Pipeline | Component, Recipe, Infrastructure Configuration, Pipeline |
| 5 | SSM Build Automation | Automation Document orchestrating the entire process |
| 6 | Resource Cleanup | Tear down all created resources |