AWS-PatchAsgInstance to patch instances in the AutoScaling group in turn

AWS-PatchAsgInstance to patch instances in the AutoScaling group in turn

The following pages cover how to schedule the application of patches to EC2 instances using the Maintenance Window.

In this case, we will consider targeting EC2 instances in the Auto Scaling group.

This can be accomplished by using the SSM Automation runbook AWS-PatchAsgInstance.

Patch EC2 instances in an Auto Scaling group.

About the AWS-RunPatchBaseline SSM document

Use CloudFormation to build an environment to run AWS-PatchAsgInstance.


Diagram of AWS-PatchAsgInstance to patch instances in Auto Scaling Group in turn.

Create an Auto Scaling group in a private subnet.
The instance to be created in the group will be Amazon Linux 2.

Set up a maintenance window.
The content is to periodically run the SSM Automation runbook AWS-PatchAsgInstance.
Running this runbook will cause the AWS-RunPatchBaseline to be run for each EC2 instance in the Auto Scaling group in turn.

CloudFormation template files

The above configuration is built with CloudFormation.
The CloudFormation templates are placed at the following URL

awstut-fa/115 at main · awstut-an-r/awstut-fa
Contribute to awstut-an-r/awstut-fa development by creating an account on GitHub.

Explanation of key points of template files

When setting up a maintenance window, set up the following three resources

  • Maintenance Window
  • Maintenance Window Target
  • Maintenance Window Task

Maintenance Window

    Type: AWS::SSM::MaintenanceWindow
      AllowUnassociatedTargets: false
      Cutoff: 1
      Duration: 2
      Name: !Sub "${Prefix}-MaintenanceWindow"
      Schedule: rate(30 minutes)
      ScheduleTimezone: Asia/Tokyo
Code language: YAML (yaml)

Set the task to run every 60 minutes with a RATE expression.

Maintenance Window Target

    Type: AWS::SSM::MaintenanceWindowTarget
      Name: !Sub "${Prefix}-MaintenanceWindowTarget"
      ResourceType: INSTANCE
        - Key: tag:aws:autoscaling:groupName
            - !Ref AutoScalingGroup
      WindowId: !Ref MaintenanceWindow
Code language: YAML (yaml)

If an instance in an Auto Scaling group is to be the maintenance window, the ResourceType property should be “INSTANCE”.

Instances in an Auto Scaling group have tags that are set automatically.

The Auto Scaling group automatically adds a tag to instances with a key of aws:autoscaling:groupName and a value of the Auto Scaling group name.

Tag Auto Scaling groups and instances

In this case, this is specified in the Targets property.
When specifying a tag name in the Key property, use the format “tag:[tag name]”.

Maintenance Window Task

    Type: AWS::SSM::MaintenanceWindowTask
      MaxConcurrency: 1
      MaxErrors: 0
      Name: !Sub "${Prefix}-MaintenanceWindowTask"
      Priority: 10
      ServiceRoleArn: !GetAtt SSMAutomationRole.Arn
        - Key: WindowTargetIds
            - !Ref MaintenanceWindowTarget
      TaskArn: AWS-PatchAsgInstance
              - "{{RESOURCE_ID}}"
      TaskType: AUTOMATION
      WindowId: !Ref MaintenanceWindow
Code language: YAML (yaml)

The task to be created is to execute AWS-PatchAsgInstance.

The TaskType property should be “AUTOMATION” and the Targets property should be the maintenance window ID mentioned earlier.

The TaskInvocationParameters property allows you to set parameters for running AWS-PatchAsgInstance.
Please refer to the following page for more information about parameters.

AWS-PatchAsgInstance - AWS Systems Manager オートメーションランブックリファレンス
Auto Scaling グループ内の EC2 インスタンスにパッチを適用します。

This time, only the required parameter, InstanceId, is set.
This parameter specifies the ID of an instance in the Auto Scaling group.
This means that it is different for each instance.
For this one, you can specify a pseudo-parameter.

You can use pseudo parameter values in the required input parameter fields to dynamically reference the resource IDs that the maintenance window targets. Pseudo parameters, such as {{RESOURCE_ID}}, allow you to target multiple resources without entering each resource ID individually.

How do I add parameters when registering an Automation task with Systems Manager maintenance windows?

This time, specify “{{RESOURCE_ID}}” according to the above.

(Reference) ALB and Auo Scaling Group

This page focuses on setting up a maintenance window to run AWS-PatchAsgInstance periodically.

For information on how to create an Auto Scaling group in a private subnet and attach it to an ALB, please see the following page.


Use CloudFormation to build this environment and check its actual behavior.

Create CloudFormation stacks and check the resources in the stacks

Create CloudFormation stacks.
For information on how to create stacks and check each stack, please refer to the following pages.

After reviewing the resources in each stack, information on the main resources created in this case is as follows

  • Maintenance window: 0dd5b473dd8357e1b
  • Auto Scaling Group: fa-115-AutoScalingGroup
  • ALB DNS name:

Check each resource from the AWS Management Console.

Check the maintenance window.

Detail of SSM 1.

You can see that the task is set to run every 5 minutes.

Detail of SSM 2.

The content of the task indicates that the content is to execute AWS-PatchAsgInstance.

Detail of SSM 3.

Instances with the tag key “aws:autoscaling:groupName” and value “fa-115-AutoScalingGroup” are the target of the maintenance window.

Check the Auto Scaling group.

Detail of Auto Scaling 1.

A group is created with a minimum value of 1, a maximum value of 2, and a desired value of 2.

Detail of Auto Scaling 2.

Indeed, two instances are created in the group, both “InService”.

Operation Check

Now that it is ready, check its operation.

Detail of SSM 4.

Indeed, the AWS-PatchAsgInstance task is executed.
The steps are executed for one of the instances in the Auto Scaling group in turn, and the patching is performed.

Detail of SSM 5.

Looking at the Auto Scaling group again, the status of one instance has indeed changed to “Standby”.
This means that no traffic from the ALB is routed to this instance.

Detail of Auto Scaling 3.

When accessing ALB, the instance that is not currently subject to patching responded.
Since patching is not performed on all instances in the group at the same time, the application is not stopped.

After a short wait, the execution of all steps is completed.

Detail of SSM 6.

Check the Auto Scaling group again.

Detail of Auto Scaling 4.

The status of the instance that has been patched has returned to “InService”.

Detail of Auto Scaling 5.

After the first instance is completed, the other instance will be subject to patching.

In this way, AWS-PatchAsgInstance can be used to apply patches to instances in an Auto Scaling group in sequence.


We have created an environment to run AWS-PatchAsgInstance.