This is a practical AWS Cloud Vulnerability Management procedure using Golden AMIs and AWS Systems Manager — a solid starting point you should adapt to your stack before rolling out.

Overview

This procedure outlines how to automate server vulnerability management using Golden AMIs and AWS Systems Manager - This is a continuation of a past article I wrote Automate Your Server Vulnerability Management with Golden AMIs and AWS Systems Manager. Use these steps as your implementation guide — they cover the full workflow from image creation to live patching.

Prerequisites

• Access to an AWS account with permissions to use EC2, AWS Systems Manager, and related services.
• Familiarity with AWS Systems Manager components (Automation, Patch Manager, Parameter Store).
• A standardized process for installing necessary software and configurations on a server.

Step 1: Create Your Golden AMI

1. Launch a Base Instance:

   • Launch an EC2 instance using a base AMI suitable for your operating system and workload requirements.

2. Configure the Instance:

   • Install necessary software packages and dependencies.
   • Apply all relevant security patches and updates.
   • Configure system settings (e.g., network configurations, application settings).

3. Test Configuration:

   • Ensure the instance is functioning as expected.
   • Perform security checks and vulnerability scans.

4. Create the Golden AMI:

   • Stop the instance.
   • From the EC2 dashboard, create an AMI of the instance.
   • Name it appropriately (e.g., Golden-AMI-<version>).

Step 2: Automate Updates to the Golden AMI

1. Create an Automation Document:

   • In AWS Systems Manager, navigate to the Automation section.
   • Create a new Automation Document (e.g., UpdateGoldenAMI).
   • Define the steps to:
     • Launch the Golden AMI in a temporary instance.
     • Apply the latest security patches and software updates.
     • Create a new AMI from the updated instance.

2. Set Up Automation Execution:

   • Schedule the Automation Document to run regularly (e.g., weekly or monthly).
   • Use AWS Systems Manager’s cron-like scheduling capabilities to maintain consistency.

3. Store the Latest AMI ID:

   • Use AWS Systems Manager Parameter Store to store the ID of the latest Golden AMI for easy access.
   • Update the Parameter Store entry each time a new Golden AMI is created.

Step 3: Deploy New Instances from the Golden AMI

1. Retrieve the Latest AMI ID:

   • Access the Parameter Store to get the current Golden AMI ID.

2. Launch Instances:

   • Use the Golden AMI to launch new instances.
   • Ensure that auto-scaling groups or manual launches use the latest AMI.

3. Configure Post-Launch Settings:

   • Apply any instance-specific configurations using AWS Systems Manager State Manager or startup scripts.

Step 4: Manage Ongoing Patching

1. Set Up Patch Groups:

   • Use AWS Systems Manager Patch Manager to define Patch Groups based on server roles or environments.
   • Assign tags to EC2 instances to organize them into Patch Groups.

2. Configure Patch Baselines:

   • Create custom patch baselines for each Patch Group.
   • Define approved patches and compliance rules.

3. Schedule Patching:

   • Set up maintenance windows for patching activities.
   • Configure AWS Systems Manager to apply patches during these windows.

Step 5: Automate Instance Lifecycle

1. Integrate with Auto Scaling:

   • Configure AWS Auto Scaling to use the latest Golden AMI when launching new instances.

2. Implement Lifecycle Hooks:

   • Use EC2 lifecycle hooks to trigger actions (e.g., configuration updates) during instance launch or termination.

Golden AMIs give you a tested, patched baseline so new instances don't inherit month-old vulnerabilities. Automation handles the toil, and auto scaling picks up the latest image automatically — fewer gaps, less manual effort at scale.

Resources

• AWS Systems Manager Automation Tutorial
• AWS Systems Manager Patch Manager Documentation

Adapt the steps to your environment and you'll have a repeatable, defensible process for keeping your AWS fleet current.