How do I use Quick Suite to manage and view the Systems Manager patch and association compliance data for all my accounts?

Resolution

Configure the prerequisite services

Before you use Quick Suite to manage and view compliance data, set up Inventory, a capability of AWS Systems Manager, and resource data sync in your AWS account.

You can use the resource data sync setup for multiple accounts and AWS Regions, and synchronize the data to a central Amazon Simple Storage Service (Amazon S3) bucket.

Systems Manager Inventory uses AWS Glue to aggregate the inventory data in the Amazon S3 bucket. AWS Glue uses the Amazon-GlueServiceRoleForSSM role to aggregate the data. If the S3 bucket is encrypted with AWS Key Management Service (AWS KMS) keys, then edit the Amazon-GlueServiceRoleForSSM role permissions to use AWS KMS keys. You must also configure your AWS Identity and Access Management (IAM) user for AWS KMS encryption.

By default, AWS Glue crawler aggregates the inventory data in the central S3 bucket twice daily. The AWS Glue crawler updates data based on this schedule. To modify the frequency, edit the AWS Glue crawler schedule.

Amazon Athena queries data that appears on the Detailed View page of the Systems Manager console. You can access this data only in Regions where Amazon Athena is available. To join multiple Amazon Athena tables, create a joined dataset in Quick Sight.

After you set up Systems Manager inventory, resource data sync, AWS Glue and Amazon Athena access, you can set up your Quick Suite account.

Set up a Quick Suite account

If you don't have a Quick Suite account, then complete the following steps:

1. Use an IAM identity that has Quick Suite permissions to sign in to the AWS Management Console.
2. In the navigation pane, choose Amazon Quick Suite, and then choose Sign up for Amazon Quick Suite.
3. Choose Enterprise or Enterprise + Q.
   -or-
   Choose Sign up for Standard Edition.
4. Enter the following information:
   Enter a name for the account.
   Enter an email address to receive notifications.
   Choose a Region for initial data storage capacity.
5. Choose Create account.
6. Choose Manage Quick Suite.
7. Select the appropriate IAM identity.
8. On the Quick Suite menu, under Permissions, choose AWS resources.
9. Under Allow access and autodiscovery for these resources, choose both Amazon Athena and Amazon S3.
10. For Select Amazon S3 buckets, select the target S3 bucket that contains your inventory data. To give write permission for Athena Workgroup, select strong>Write permission for Athena Workgroup.
11. Choose Finish, and then choose Save.

If you have an existing Quick Suite account, then complete the following steps:

1. Open the Quick Suite console.
2. Choose Manage Quick Suite.
3. On the Quick Suite menu, under Permissions, choose the AWS resources option.
4. Under Allow access and autodiscovery for these resources, choose Amazon Athena and Amazon S3.
5. For Select Amazon S3 buckets, select the target S3 bucket that contains your inventory data. To give write permission for Athena Workgroup, select Write permission for Athena Workgroup.
6. Choose Finish, and then choose Save.

Create a dataset in Quick Sight

To create datasets in Quick Sight, use Amazon Athena tables as the source. Each inventory metadata has a corresponding Amazon Athena table that AWS Glue creates. To create the dataset and analyze the data, use the aws_compliancesummary and aws_complianceitem tables.

Complete the following steps:

1. Open the Quick Suite console.
2. In the navigation pane, choose Datasets.
3. On the Datasets page, choose Create dataset.
4. From the Create dataset popup window, choose Create data source. Then, from the Create dataset popup window, select Athena as the data source, and then choose Next.
5. Enter the data source name and Athena workgroup.
6. Choose Create data source.
7. From the databases dropdown list, select the S3 bucket.
   Note: The database name is in the S3_bucket_name-region-database format.
8. From the list of tables, select aws_compliancesummary.
9. Choose Select.
10. Select Directly query your data.
11. Choose Edit/Preview data.
12. Choose Save and publish.

Repeat the preceding steps to create another dataset for the aws_complianceitem table.

Analyze the dataset

To use the aws_compliancesummary and aws_complianceitem datasets for data analysis, complete the following steps:

1. Open the Quick Suite console.
2. Choose Create analysis.
3. On the Create Analysis popup window, choose aws_compliancesummary, and then choose Select.
4. To add multiple datasets in the same analysis, choose Data.
5. In the dropdown list, choose Add dataset.
6. From the popup window, choose aws_complianceitem.
7. Choose Select.

Note: You can also add other datasets to the same analysis to create the visuals.

Add visuals

You can add a visual to your Amazon Quick Sight analysis based on the Quick Sight dataset. The dataset includes the tables from Amazon Athena that have the Systems Manager inventory data with compliance information.

Visuals for aws_compliancesummary

To view the number of resources based on patch compliance status, complete the following steps:

1. Open the Quick Suite console.
2. Choose the analysis that you want to add a visual to.
3. On the Analysis page, choose the dataset that you want to use.
4. Choose Visualize.
5. On the Visualize pane, choose Add, and then choose Add visual.
6. Choose Visual types.
7. On the Visual types pane, select Donut chart.
8. From the Fields list, choose Status to add it to Group/Color dimension.
9. Under Value, drag and drop Resourceid.
10. To count distinct values, next to the resourceid field, choose the arrow.
11. Choose Aggregate: Count.
12. Choose Count distinct.
13. Select the graph.
14. Choose Format Visual icon.
15. Under Data labels, choose Show metric.

To view the compliant or non-compliant instances by Region, complete the following steps:

1. Choose the preceding visual.
2. Choose the More options icon on the chart.
3. Choose Duplicate visual to.
4. Under Field wells, in the Group/Color dimension dropdown list, choose Region.
5. Choose Filter.
6. Choose ADD FILTER.
7. Select Status.
8. Select COMPLIANT or NON-COMPLIANT.
9. Choose Apply.

To view the account information for all accounts in a multi-account setup, use the preceding visual. Under Fields wells, in the Group/Color dimension, select accountid.

Visuals for aws_complianceitem dataset

To view the list of missing patches by instances, complete the following steps:

1. Open the Quick Suite console.
2. Choose Visualize.
3. In the Visualize pane, choose Visual types.
4. In the Visual types pane, select Donut chart.
5. In Visual types, select Pivot table.
6. Under Rows, add the following values:
   Region
   resourceid
   patchstate
   id
   title
7. Under Values, add id.
8. To count distinct values, choose the arrow next to id.
9. Choose Aggregate: Count.
10. Choose Count distinct.
11. Choose Filter.
12. In Filter, choose Add Filter.
13. Choose Patchstate.
14. Select Missing.
15. Choose Apply.

To view the list of instances by compliance status, complete the following steps:

1. Open the Quick Suite console.
2. Choose Create Analysis.
3. On the Create Analysis pop-up window, choose aws_complianceitem, and then choose Select.
4. Choose Add.
5. Choose Add visual.
6. In Visual types, select Pivot table.
7. Under Rows, add the following values:
   Region
   resourceid
   patchstate
   id
   title
8. Under Values, add id.
9. To count distinct values, choose the arrow next to id.
10. Choose Aggregate: Count.
11. Choose Count distinct.

To get information about all accounts, under Rows, add accountid.

Add filters

You can also add filters to filter the data based on compliance type, such as patch compliance and association compliance.

To add filters, complete the following steps:

1. Open the Quick Suite console.
2. In the navigation pane, choose Filter.
3. Under Filters, choose Add filter.
4. Select Compliance type.
5. To include only patch compliance, choose Patch from the list.
6. From the Applied to options list, select Single sheet and All visuals.
7. Choose Apply.

Publish a dashboard

After you add all the visuals, publish all the visuals as a dashboard to share with other users.

Complete the following steps:

1. In the application bar, under the Edit menu, choose Themes.
2. Select the appropriate theme.
3. Choose Publish.
4. Enter a name for the dashboard.
5. Choose Publish dashboard.