steampipe plugin install awssteampipe plugin install aws

Table: aws_ssm_managed_instance_patch_state

AWS Systems Manager (SSM) provides the capability to manage and patch instances in your AWS environment. The managed instance patch states in AWS SSM refer to the different states that an instance can be in during the patching process.

Examples

Basic info

select
  instance_id,
  baseline_id,
  operation,
  patch_group,
  failed_count,
  installed_count,
  installed_other_count
from
  aws_ssm_managed_instance_patch_state;

Count the number of patches installed from patch base line

select
  instance_id,
  baseline_id,
  installed_count
from
  aws_ssm_managed_instance_patch_state;

Count the number of patches installed not from patch base line

select
  instance_id,
  baseline_id,
  installed_other_count
from
  aws_ssm_managed_instance_patch_state;

Count of non-compliant security patches for each instance

select
  instance_id,
  baseline_id,
  security_non_compliant_count
from
  aws_ssm_managed_instance_patch_state;

List patch operations in the last 10 days

select
  instance_id,
  baseline_id,
  operation,
  operation_end_time,
  operation_start_time
from
  aws_ssm_managed_instance_patch_state
where
  operation_end_time >= now() - interval '10' day;

List scan patches

select
  instance_id,
  baseline_id,
  operation
from
  aws_ssm_managed_instance_patch_state
where
  operation = 'Scan';

.inspect aws_ssm_managed_instance_patch_state

AWS SSM Managed Instance Patch State

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
baseline_id	text	The ID of the patch baseline used to patch the managed node.
critical_non_compliant_count	bigint	The number of patches per node that are specified as Critical for compliance reporting in the patch baseline aren't installed. These patches might be missing, have failed installation, were rejected, or were installed but awaiting a required managed node reboot. The status of these managed nodes is NON_COMPLIANT.
failed_count	bigint	The number of patches from the patch baseline that were attempted to be installed during the last patching operation, but failed to install.
installed_count	bigint	The number of patches from the patch baseline that are installed on the managed node.
installed_other_count	bigint	The number of patches not specified in the patch baseline that are installed on the managed node.
installed_pending_reboot_count	bigint	The number of patches installed by Patch Manager since the last time the managed node was rebooted.
installed_rejected_count	bigint	The number of patches installed on a managed node that are specified in a RejectedPatches list. Patches with a status of InstalledRejected were typically installed before they were added to a RejectedPatches list.
instance_id	text	The ID of the managed node the high-level patch compliance information was collected for.
last_no_reboot_install_operation_time	timestamp with time zone	The time of the last attempt to patch the managed node with NoReboot specified as the reboot option.
missing_count	bigint	The number of patches from the patch baseline that are applicable for the managed node but aren't currently installed.
not_applicable_count	bigint	The number of patches from the patch baseline that aren't applicable for the managed node and therefore aren't installed on the node. This number may be truncated if the list of patch names is very large. The number of patches beyond this limit are reported in UnreportedNotApplicableCount.
operation	text	The type of patching operation that was performed.
operation_end_time	timestamp with time zone	The time the most recent patching operation completed on the managed node.
operation_start_time	timestamp with time zone	The time the most recent patching operation was started on the managed node.
other_non_compliant_count	bigint	The number of patches per node that are specified as other than Critical or Security but aren't compliant with the patch baseline. The status of these managed nodes is NON_COMPLIANT.
owner_information	text	Placeholder information. This field will always be empty in the current release of the service.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
patch_group	text	The name of the patch group the managed node belongs to.
reboot_option	text	Indicates the reboot option specified in the patch baseline. Reboot options apply to Install operations only. Reboots aren't attempted for Patch Manager Scan operations.
region	text	The AWS Region in which the resource is located.
security_non_compliant_count	bigint	The number of patches per node that are specified as Security in a patch advisory aren't installed. These patches might be missing, have failed installation, were rejected, or were installed but awaiting a required managed node reboot. The status of these managed nodes is NON_COMPLIANT.
snapshot_id	text	The ID of the patch baseline snapshot used during the patching operation when this compliance data was collected.
title	text	Title of the resource.
unreported_not_applicable_count	bigint	The number of patches beyond the supported limit of NotApplicableCount that aren't reported by name to Inventory. Inventory is a capability of Amazon Web Services Systems Manager.

turbot/aws