15-patch-baselines.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Create custom patch baselines so that Inspector CVE scans will be happy

Parameters:

  PatchApprovalDelayParam:
    Default: 7
    Description: How many days to delay before approving patches?
    Type: Number

Resources:

  AmazonLinuxPatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-AmazonLinux
      # Options: WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, and CENTOS
      OperatingSystem: AMAZON_LINUX
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      GlobalFilters:
        PatchFilters:
          - Key: PRODUCT
            Values:
              - "*"
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              PatchFilters:
                - Key: CLASSIFICATION
                  Values:
                    - Security
                    - Bugfix
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: false
      # ApprovedPatches:
      #   - String
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      # ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY
      # Sources : PatchSource

  AmazonLinux2PatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-AmazonLinux2
      # Options: WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, and CENTOS
      OperatingSystem: AMAZON_LINUX_2
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      GlobalFilters:
        PatchFilters:
          - Key: PRODUCT
            Values:
              - "*"
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              PatchFilters:
                - Key: CLASSIFICATION
                  Values:
                    - Security
                    - Bugfix
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: false
      # ApprovedPatches:
      #   - String
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY
      # GlobalFilters:
      #   PatchFilterGroup
      # Sources : PatchSource

  CentosPatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-Centos
      # Options: WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, and CENTOS
      OperatingSystem: CENTOS
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              # See https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html
              # PRODUCT | CLASSIFICATION | MSRC_SEVERITY | PATCH_ID | SECTION | PRIORITY | SEVERITY
              PatchFilters:
                - Key: PRODUCT
                  Values:
                    - "*"
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: true
      # ApprovedPatches:
      #   - String
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY
      # GlobalFilters:
      #   PatchFilterGroup
      # Sources : PatchSource

  OraclePatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-Oracle
      # Options: WINDOWS | AMAZON_LINUX | AMAZON_LINUX_2 | AMAZON_LINUX_2022 | UBUNTU | REDHAT_ENTERPRISE_LINUX | SUSE | CENTOS | ORACLE_LINUX | DEBIAN | MACOS | RASPBIAN | ROCKY_LINUX | ALMA_LINUX | AMAZON_LINUX_2023
      OperatingSystem: ORACLE_LINUX
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              # See https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html
              # PRODUCT | CLASSIFICATION | MSRC_SEVERITY | PATCH_ID | SECTION | PRIORITY | SEVERITY
              PatchFilters:
                - Key: PRODUCT
                  Values:
                    - "*"
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: true
      # ApprovedPatches:
      #   - String
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY
      # GlobalFilters:
      #   PatchFilterGroup
      # Sources : PatchSource

  RHELPatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-RHEL
      # Options: WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, and CENTOS
      OperatingSystem: REDHAT_ENTERPRISE_LINUX
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      GlobalFilters:
        PatchFilters:
          - Key: PRODUCT
            Values:
              - "*"
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              PatchFilters:
                - Key: CLASSIFICATION
                  Values:
                    - Security
                # This filter is in the AWS default for RHEL
                # - Key: SEVERITY
                #   Values:
                #     - Critical
                #     - Important
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: false
          - PatchFilterGroup:
              PatchFilters:
                - Key: CLASSIFICATION
                  Values:
                    - Bugfix
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: false
      # ApprovedPatches:
      #   - String
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY


  UbuntuPatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-Ubuntu
      OperatingSystem: UBUNTU
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      GlobalFilters:
        PatchFilters:
          - Key: PRODUCT
            Values:
              - "*"
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              PatchFilters:
                - Key: PRIORITY
                  Values:
                    - Required
                    - Required
                    - Important
                    - Standard
                    - Optional
                    - Extra
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: false
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY

  WindowsPatchBaseline:
    Type: "AWS::SSM::PatchBaseline"
    Properties:
      Name: cu-cit-cloud-team-patching-Windows
      # Options: WINDOWS, AMAZON_LINUX, AMAZON_LINUX_2, UBUNTU, REDHAT_ENTERPRISE_LINUX, SUSE, and CENTOS
      OperatingSystem: WINDOWS
      Description: "Patch baseline for use with https://github.com/cu-cit-clout-team/ct-patching-scanning"
      PatchGroups:
        - cu-cit-cloud-team-patching
      GlobalFilters:
        PatchFilters:
          - Key: PRODUCT
            Values:
              - "*"
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              PatchFilters:
                - Key: CLASSIFICATION
                  Values:
                    - CriticalUpdates
                    - SecurityUpdates
                - Key: MSRC_SEVERITY
                  Values:
                    - Critical
                    - Important
            ApproveAfterDays: !Ref PatchApprovalDelayParam
            ComplianceLevel: UNSPECIFIED
            EnableNonSecurity: false
      # ApprovedPatches:
      #   - String
      ApprovedPatchesComplianceLevel: UNSPECIFIED
      ApprovedPatchesEnableNonSecurity: false
      # RejectedPatches:
      #   - String
      RejectedPatchesAction: ALLOW_AS_DEPENDENCY
      # GlobalFilters:
      #   PatchFilterGroup
      # Sources : PatchSource