CmdID / aws / aws ssm

aws ssm describe-instance-patches

Retrieves information about the patches on the specified managed node and their state relative to the patch baseline being used for the node. AWS CLI reference

3 examples 4 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

Example 1: To get the patch state details for an instance

The following describe-instance-patches example retrieves details about the patches for the specified instance.

aws ssm describe-instance-patches --instance-id "i-1234567890abcdef0"Identify

--instance-idThe ID of the managed node whose patch state information should be retrieved.

Its output

{
    "Patches": [
        {
            "Title": "2019-01 Security Update for Adobe Flash Player for Windows Server 2016 for x64-based Systems (KB4480979)",
            "KBId": "KB4480979",
            "Classification": "SecurityUpdates",
            "Severity": "Critical",
            "State": "Installed",
            "InstalledTime": "2019-01-09T00:00:00+00:00"
        },
        {
            "Title": "",
            "KBId": "KB4481031",
            "Classification": "",
            "Severity": "",
            "State": "InstalledOther",
            "InstalledTime": "2019-02-08T00:00:00+00:00"
        }
    ],
    "NextToken": "--token string truncated--"
}

Example 2: To get a list of patches in the Missing state for an instance

The following describe-instance-patches example retrieves information about patches that are in the Missing state for the specified instance.

aws ssm describe-instance-patches --instance-id "i-1234567890abcdef0" --filters Key=State,Values=MissingIdentify

--instance-idThe ID of the managed node whose patch state information should be retrieved.

--filtersEach element in the array is a structure containing a key-value pair.

Its output

{
    "Patches": [
        {
            "Title": "Windows Malicious Software Removal Tool x64 - February 2019 (KB890830)",
            "KBId": "KB890830",
            "Classification": "UpdateRollups",
            "Severity": "Unspecified",
            "State": "Missing",
            "InstalledTime": "1970-01-01T00:00:00+00:00"
        }
    ],
    "NextToken": "--token string truncated--"
}

For more information, see About Patch Compliance States in the AWS Systems Manager User Guide.

Example 3: To get a list of patches installed since a specified InstalledTime for an instance

The following describe-instance-patches example retrieves information about patches installed since a specified time for the specified instance by combining the use of --filters and --query.

aws ssm describe-instance-patches --instance-id "i-1234567890abcdef0" --filters Key=State,Values=Installed --query 'Patches[?InstalledTime >= `"2023-01-01T16:00:00"`]'

Identify

--instance-idThe ID of the managed node whose patch state information should be retrieved.

--filtersEach element in the array is a structure containing a key-value pair.

--queryA JMESPath query to use in filtering the response data.

Its output

[
    {
        "Title": "2023-03 Cumulative Update for Windows Server 2019 (1809) for x64-based Systems (KB5023702)",
        "KBId": "KB5023702",
        "Classification": "SecurityUpdates",
        "Severity": "Critical",
        "State": "Installed",
        "InstalledTime": "2023-03-16T11:00:00+00:00"
    }
]

Options

4 in the AWS CLI reference

--filtersEach element in the array is a structure containing a key-value pair.

--instance-idThe ID of the managed node whose patch state information should be retrieved.

--max-resultsThe maximum number of patches to return (per page).

--next-tokenThe token for the next set of items to return.