Hardening Endpoints and Patch Manager

Secure access is not enough; the instances themselves must stay hardened and patched. AWS Systems Manager (SSM) provides Patch Manager and related tools to keep an entire fleet up to date and configured correctly. Endpoint hygiene at scale is a recurring SCS-C02 theme, since unpatched systems are a leading breach cause.

Most successful attacks exploit known vulnerabilities that a patch would have fixed. In a large fleet, manually tracking which instance needs which update is impossible. Automating patch management closes the window between a vulnerability's disclosure and its remediation, directly reducing risk across every workload.

Patch Manager automates patching of operating systems and supported applications across EC2 and on-premises servers. It scans instances for missing patches, reports compliance, and installs approved updates on a schedule. It works for Linux and Windows and integrates with the rest of Systems Manager.

A patch baseline defines which patches are approved for installation, often by severity, classification, and an auto-approval delay (for example, approve critical patches seven days after release). Baselines let you balance security with stability, ensuring only vetted updates roll out to sensitive environments.

Patching runs during maintenance windows, scheduled periods when SSM may install updates and reboot instances. This contains disruptive operations to safe times, so production workloads are patched predictably rather than at random, balancing security needs against availability.

Patch groups use tags to apply different baselines to different sets of instances. For example, a "Critical-Servers" group might use a conservative baseline with longer delays, while a "Dev" group patches aggressively. Tag-driven grouping scales patch policy across a large, varied fleet cleanly.

Patch Manager reports each instance's patch compliance state, and these results flow into AWS Config and Security Hub. You get a fleet-wide view of which systems are out of date, turning patch status into a measurable, auditable security metric the exam expects you to track.

Beyond patches, State Manager keeps instances in a desired configuration state, for example ensuring an antivirus agent runs or a setting stays enforced. It continuously applies and re-applies configuration, preventing drift so hardened baselines do not erode over time.

SSM Inventory collects metadata about installed software, network config, and more across the fleet. Combined with Patch Manager and State Manager, it gives security teams full visibility into what is running where, essential for spotting unauthorized software and confirming hardening standards are met.

To find vulnerabilities that need patching, Amazon Inspector continuously scans EC2 instances and container images against known CVEs (Common Vulnerabilities and Exposures). Inspector relies on the SSM Agent to assess instances, then feeds prioritized findings into Security Hub, closing the loop: Inspector identifies the risk and Patch Manager remediates it.

Endpoint hardening at scale uses Patch Manager with patch baselines, maintenance windows, and tag-based patch groups to keep systems updated, reporting compliance into Config and Security Hub. State Manager prevents configuration drift and Inventory provides fleet-wide visibility, together keeping the whole fleet hardened automatically.

Test endpoint hardening.

Keeping the fleet hardened uses Patch Manager with patch baselines (approval rules), maintenance windows (when to patch), and tag-based patch groups (which baseline applies). Compliance reports flow into AWS Config and Security Hub. State Manager stops configuration drift and Inventory gives fleet-wide visibility into installed software and settings.