EC2 instance has missing or failed SSM patch state
- Severity
- High
- Service
- Systems Manager
- Check ID
- SSM_PATCH_NOT_COMPLIANT
What this check finds
This EC2 instance has patches that are missing or failed to install according to AWS Systems Manager Patch Manager. Unpatched instances are vulnerable to known CVEs.
Passing looks like: EC2 SSM patch state compliant.
How to fix it
Run the patch baseline on the instance.
AWS CLI
aws ssm send-command --document-name AWS-RunPatchBaseline --targets Key=instanceids,Values=INSTANCE_ID --parameters Operation=Install
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
Systems Manager → Patch Manager → Patch now.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs