{
  "Provider": "aws",
  "CheckID": "ssm_managed_compliant_patching",
  "CheckTitle": "Check if EC2 instances managed by Systems Manager are compliant with patching requirements.",
  "CheckType": [],
  "ServiceName": "ssm",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:aws:ec2:region:account-id:instance/instance-id",
  "Severity": "high",
  "ResourceType": "AwsEc2Instance",
  "Description": "Check if EC2 instances managed by Systems Manager are compliant with patching requirements.",
  "Risk": "Without the most recent security patches your system is potentially vulnerable to cyberattacks. Even the best-designed software can not anticipate every future threat to cybersecurity. Poor patch management can leave an organizations data exposed subjecting them to malware and ransomware attacks.",
  "RelatedUrl": "https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-compliance-identify.html",
  "Remediation": {
    "Code": {
      "CLI": "",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "Consider using SSM in all accounts and services to at least monitor for missing patches on servers. Use a robust process to apply security fixes as soon as they are made available. Patch compliance data from Patch Manager can be sent to AWS Security Hub to centralize security issues.",
      "Url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-compliance-identify.html"
    }
  },
  "Categories": [],
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  },
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
