Skip to content
AWS for Query.Farm

aws.ssm.get_patch_baseline

Example SQL Queries

SELECT * FROM
aws.ssm.get_patch_baseline
WHERE
"baseline_id" = 'VALUE';

Description

Retrieves information about a patch baseline.

Table Definition

Column NameColumn Data Type
baseline_id Required Input Column

The ID of the retrieved patch baseline.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
approval_rules

A set of rules used to include patches in the baseline.

STRUCT(
    "patch_rules" STRUCT(
        "patch_filter_group" STRUCT(
            "patch_filters" STRUCT(
                "key" VARCHAR,
                "values" VARCHAR[]
            )[]
        ),
        "compliance_level" VARCHAR,
        "approve_after_days" BIGINT,
        "approve_until_date" VARCHAR,
        "enable_non_security" BOOLEAN
    )[]
)
Show child fields
approval_rules.patch_rules[]
Show child fields
approval_rules.patch_rules[].approve_after_days

The number of days after the release date of each patch matched by the rule that the patch is marked as approved in the patch baseline. For example, a value of 7 means that patches are approved seven days after they are released.

This parameter is marked as not required, but your request must include a value for either ApproveAfterDays or ApproveUntilDate.

Not supported for Debian Server or Ubuntu Server.

approval_rules.patch_rules[].approve_until_date

The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically.

Enter dates in the format YYYY-MM-DD. For example, 2021-12-31.

This parameter is marked as not required, but your request must include a value for either ApproveUntilDate or ApproveAfterDays.

Not supported for Debian Server or Ubuntu Server.

approval_rules.patch_rules[].compliance_level

A compliance severity level for all approved patches in a patch baseline.

approval_rules.patch_rules[].enable_non_security

For managed nodes identified by the approval rule filters, enables a patch baseline to apply non-security updates available in the specified repository. The default value is false. Applies to Linux managed nodes only.

approval_rules.patch_rules[].patch_filter_group

The patch filter group that defines the criteria for the rule.

Show child fields
approval_rules.patch_rules[].patch_filter_group.patch_filters[]
Show child fields
approval_rules.patch_rules[].patch_filter_group.patch_filters[].key

The key for the filter.

Run the DescribePatchProperties command to view lists of valid keys for each operating system type.

approval_rules.patch_rules[].patch_filter_group.patch_filters[].values[]
approved_patches

A list of explicitly approved patches for the baseline.

VARCHAR[]
Show child fields
approved_patches[]
approved_patches_compliance_level

Returns the specified compliance severity level for approved patches in the patch baseline.

VARCHAR
approved_patches_enable_non_security

Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes. The default value is false. Applies to Linux managed nodes only.

BOOLEAN
created_date

The date the patch baseline was created.

TIMESTAMP_S
description

A description of the patch baseline.

VARCHAR
global_filters

A set of global filters used to exclude patches from the baseline.

STRUCT(
    "patch_filters" STRUCT(
        "key" VARCHAR,
        "values" VARCHAR[]
    )[]
)
Show child fields
global_filters.patch_filters[]
Show child fields
global_filters.patch_filters[].key

The key for the filter.

Run the DescribePatchProperties command to view lists of valid keys for each operating system type.

global_filters.patch_filters[].values[]
modified_date

The date the patch baseline was last modified.

TIMESTAMP_S
name

The name of the patch baseline.

VARCHAR
operating_system

Returns the operating system specified for the patch baseline.

VARCHAR
patch_groups

Patch groups included in the patch baseline.

VARCHAR[]
Show child fields
patch_groups[]
rejected_patches

A list of explicitly rejected patches for the baseline.

VARCHAR[]
Show child fields
rejected_patches[]
rejected_patches_action

The action specified to take on patches included in the RejectedPatches list. A patch can be allowed only if it is a dependency of another package, or blocked entirely along with packages that include it as a dependency.

VARCHAR
sources

Information about the patches to use to update the managed nodes, including target operating systems and source repositories. Applies to Linux managed nodes only.

STRUCT(
    "name" VARCHAR,
    "products" VARCHAR[],
    "configuration" VARCHAR
)[]
Show child fields
sources[]
Show child fields
sources[].configuration

The value of the yum repo configuration. For example:

[main]

name=MyCustomRepository

baseurl=https://my-custom-repository

enabled=1

For information about other options available for your yum repository configuration, see dnf.conf(5).

sources[].name

The name specified to identify the patch source.

sources[].products[]