Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Issue in EC2 patch release through AWS Patch Manager in STG and Prod account.

0

In our project we do EC2 patching with Patch Manager.

In STG Account:

Patch now ran on : 31st July 2026

"Approve until date" at EC2 patch baseline : 9th July 2026.

kernel version installed: 6.1.175-219.357.amzn2023.x86_64

Package release version: system-release.noarch 2023.12.20260727-0.amzn2023

In Prod Account:

Patch now ran on : 6th August 2026

"Approve until date" at EC2 patch baseline: 9th July 2026.

kernel version installed: 6.1.174-217.345.amzn2023.x86_64

Package release version: system-release.noarch 2023.12.20260803-0.amzn2023

Both STG and Prod uses same AWS Linux 2023 OS and both account has the exactly same Patch Baseline configuration. Though Prod has the updated package release version but has older Kernel version installed but in STG the older package release version has the latest kernel version , what is the reason behind that?

Topics
Compute
Tags
Amazon Linux 2023
Language
English

asked a month ago99 views

2 Answers
1
Accepted Answer

To pinpoint the exact reason, you need to rule out external factors. The "Approve until date" of July 9th should have prevented kernel 6.1.175 from installing on the STG instance, since that kernel was released later in July. Check the following details for both the STG and Prod instances:

  • The base AMI IDs (or initial kernel versions) prior to the patch execution.
  • The output of dnf history to confirm whether any manual updates were executed outside of Patch Manager.
  • The SSM Patch Manager execution logs (located at /var/log/amazon/ssm/patch-baseline-operations/).

Once these variables are clarified, you can accurately determine why the baseline behavior diverged.

EXPERT

answered a month ago

EXPERT

reviewed a month ago

0

In STG Attaching the image here, as the image file could not be uploaded in the comment section. The date shown in the dnf history output for the kernel corresponds to the date when "Patch Now" was triggered in the STG environment. AMI ID: ami-00cf59bc9978eb266 dnf history

SSM Patch Manager execution logs

answered a month ago

EXPERT

reviewed a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content