Skip to content
AWS for Query.Farm

aws.ssm.describe_available_patches

Example SQL Queries

SELECT * FROM
aws.ssm.describe_available_patches;

Description

Lists all patches eligible to be included in a patch baseline.

Currently, DescribeAvailablePatches supports only the Amazon Linux 1, Amazon Linux 2, and Windows Server operating systems.

Table Definition

Column NameColumn Data Type
filters Input Column

Each element in the array is a structure containing a key-value pair.

Windows Server

Supported keys for Windows Server managed node patches include the following:

  • PATCH_SET

    Sample values: OS | APPLICATION

  • PRODUCT

    Sample values: WindowsServer2012 | Office 2010 | MicrosoftDefenderAntivirus

  • PRODUCT_FAMILY

    Sample values: Windows | Office

  • MSRC_SEVERITY

    Sample values: ServicePacks | Important | Moderate

  • CLASSIFICATION

    Sample values: ServicePacks | SecurityUpdates | DefinitionUpdates

  • PATCH_ID

    Sample values: KB123456 | KB4516046

Linux

When specifying filters for Linux patches, you must specify a key-pair for PRODUCT. For example, using the Command Line Interface (CLI), the following command fails:

aws ssm describe-available-patches --filters Key=CVE_ID,Values=CVE-2018-3615

However, the following command succeeds:

aws ssm describe-available-patches --filters Key=PRODUCT,Values=AmazonLinux2018.03 Key=CVE_ID,Values=CVE-2018-3615

Supported keys for Linux managed node patches include the following:

  • PRODUCT

    Sample values: AmazonLinux2018.03 | AmazonLinux2.0

  • NAME

    Sample values: kernel-headers | samba-python | php

  • SEVERITY

    Sample values: Critical | Important | Medium | Low

  • EPOCH

    Sample values: 0 | 1

  • VERSION

    Sample values: 78.6.1 | 4.10.16

  • RELEASE

    Sample values: 9.56.amzn1 | 1.amzn2

  • ARCH

    Sample values: i686 | x86_64

  • REPOSITORY

    Sample values: Core | Updates

  • ADVISORY_ID

    Sample values: ALAS-2018-1058 | ALAS2-2021-1594

  • CVE_ID

    Sample values: CVE-2018-3615 | CVE-2020-1472

  • BUGZILLA_ID

    Sample values: 1463241 

STRUCT(
    "key" VARCHAR,
    "values" VARCHAR[]
)[]
Show child fields
filters[]
Show child fields
filters[].key

The key for the filter.

filters[].values[]
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
advisory_ids

The Advisory ID of the patch. For example, RHSA-2020:3779. Applies to Linux-based managed nodes only.

VARCHAR[]
Show child fields
advisory_ids[]
arch

The architecture of the patch. For example, in example-pkg-0.710.10-2.7.abcd.x86_64, the architecture is indicated by x86_64. Applies to Linux-based managed nodes only.

VARCHAR
bugzilla_ids

The Bugzilla ID of the patch. For example, 1600646. Applies to Linux-based managed nodes only.

VARCHAR[]
Show child fields
bugzilla_ids[]
classification

The classification of the patch. For example, SecurityUpdates, Updates, or CriticalUpdates.

VARCHAR
content_url

The URL where more information can be obtained about the patch.

VARCHAR
cve_ids

The Common Vulnerabilities and Exposures (CVE) ID of the patch. For example, CVE-2011-3192. Applies to Linux-based managed nodes only.

VARCHAR[]
Show child fields
cve_ids[]
description

The description of the patch.

VARCHAR
epoch

The epoch of the patch. For example in pkg-example-EE-20180914-2.2.amzn1.noarch, the epoch value is 20180914-2. Applies to Linux-based managed nodes only.

BIGINT
id

The ID of the patch. Applies to Windows patches only.

This ID isn't the same as the Microsoft Knowledge Base ID.

VARCHAR
kb_number

The Microsoft Knowledge Base ID of the patch. Applies to Windows patches only.

VARCHAR
language

The language of the patch if it's language-specific.

VARCHAR
msrc_number

The ID of the Microsoft Security Response Center (MSRC) bulletin the patch is related to. For example, MS14-045. Applies to Windows patches only.

VARCHAR
msrc_severity

The severity of the patch, such as Critical, Important, or Moderate. Applies to Windows patches only.

VARCHAR
name

The name of the patch. Applies to Linux-based managed nodes only.

VARCHAR
product

The specific product the patch is applicable for. For example, WindowsServer2016 or AmazonLinux2018.03.

VARCHAR
product_family

The product family the patch is applicable for. For example, Windows or Amazon Linux 2.

VARCHAR
release

The particular release of a patch. For example, in pkg-example-EE-20180914-2.2.amzn1.noarch, the release is 2.amaz1. Applies to Linux-based managed nodes only.

VARCHAR
release_date

The date the patch was released.

TIMESTAMP_S
repository

The source patch repository for the operating system and version, such as trusty-security for Ubuntu Server 14.04 LTE and focal-security for Ubuntu Server 20.04 LTE. Applies to Linux-based managed nodes only.

VARCHAR
severity

The severity level of the patch. For example, CRITICAL or MODERATE.

VARCHAR
title

The title of the patch.

VARCHAR
vendor

The name of the vendor providing the patch.

VARCHAR
version

The version number of the patch. For example, in example-pkg-1.710.10-2.7.abcd.x86_64, the version number is indicated by -1. Applies to Linux-based managed nodes only.

VARCHAR