How can I use alternate patch source repositories with Systems Manager Patch Manager?

Short description

To install patches in a different source repository instead of the default one on a managed node, create a custom patch baseline.

Note: When you use a custom patch baseline with alternate patch repositories, you don't change the default repositories on the operating system (OS). After the patching operation is complete, the repositories that you previously configured remain the defaults. For more information, see How to specify an alternate patch source repository (Linux).

Resolution

To use alternate patch sources for Amazon Elastic Compute Cloud (Amazon EC2) managed nodes, complete one of the following tasks to create a custom patch baseline:

• For Linux instructions, see Creating a custom patch baseline for Linux.
• For macOS instructions, see Creating a custom patch baseline for macOS.
• For Windows instructions, see Creating a custom patch baseline for Windows Server

When you create your custom patch baseline, select Set this patch baseline as the default patch baseline for operating system name instances. Then, for Patch sources, enter the following details:

Name: Epel

Product: *

Configuration:

For Linux, use the following configuration:

[epel]
name=example-name - $basearch
#baseurl=example-url/$basearch
metalink=example-url/metalink?repo=epel-7&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=1
gpgkey=example-gpgkey

Note: Replace example-name with the name of your repository. Replace example-baseurl with your repository's base URL. Replace example-metalink with your repo's metalink. Replace example-gpgkey with the file path for your GNU Privacy Guard key. See the following example configuration for Amazon Linux 2:

[epel]
name=Extra Packages for Enterprise Linux 7 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/7/$basearch
metalink=https://mirrors.fedoraproject.org/metalink?repo=epel-7&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7

For a different OS, use the following format for Configuration:

[main]
name=MyCustomRepository
baseurl=https://my-custom-repository
enabled=1

For Ubuntu servers, use one of the following formats for Configuration:

For HTTP:

deb http://security.ubuntu.com/ubuntu jammy main

For HTTPS:

deb https://security.ubuntu.com/ubuntu jammy main

For Debian servers, use the following format for Configuration:

For HTTP:

deb http://site.example-url.com/debian distribution example-component1 example-component2 example-component3

For HTTPS:

deb https://site.example-url.com/debian distribution example-component1 example-component2 example-component3

Note: Replace site.example-url.com with your website URL. Replace example-component with your components. You can enter as many components as you require. You must specify repo information for Ubuntu Server repositories in a single line. For more examples and information, see jammy (5) sources.list.5.gz on the Ubuntu Server Manuals website and sources.list format on the Debian Wiki.

For more information about how Patch Manager installs patches on a different OS, see How patches are installed.

Related information

How can I see the patches that Patch Manager will install on my Amazon EC2 instance?

Troubleshooting Patch Manager

PatchSource