How to use the scheduled fix feature in patch management of CloudOps Orchestration Service-CloudOps Orchestration Service(OOS)-阿里云帮助中心

To prevent security attacks, we recommend that you fix system vulnerabilities promptly. You can use the patch management feature of OOS to keep software packages updated, scan for or install patches, and manage custom patch baselines. This feature helps you quickly fix vulnerabilities to ensure system security and stability. This topic describes how to use the patch management feature of OOS to schedule vulnerability fixes.

Patching modes

CloudOps Orchestration Service (OOS) provides the following three patch management modes:

Warning

If you select the allow instance restart option when you install patches, the system automatically determines whether to restart the instance based on the patch requirements.

scan: Checks ECS instances for system vulnerabilities.
install without restart: Fixes system vulnerabilities without restarting the ECS instance.
install with restart: Fixes system vulnerabilities and restarts the ECS instance if required by a patch.

Permissions required

Patch management requires the following permissions:

{
    "Policy": {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "ecs:RebootInstance",
                    "ecs:DescribeInvocationResults",
                    "ecs:DescribeCloudAssistantStatus",
                    "ecs:DescribeInstances",
                    "ecs:DescribeInvocations",
                    "ecs:RunCommand"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
             },
             {
                 "Action": [
                     "oos:ListInstancePatchStates"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
              }
      ]
   }
}

You can configure these permissions in the Alibaba Cloud Resource Access Management (RAM) console.

Procedure

Log on to the CloudOps Orchestration Service console. In the left-side navigation pane, choose Quick Setup.
On the Quick Setup page, find the Patch Management section and click Create.
Select a schedule type: Executed Once at the Specified Time or Executed Periodically.
- Once: Runs the task once at a specified time.
- Recurring: Runs the task on a recurring schedule that you define.
Select an operation: Scan and Install or Scan Only. If you select Scan and Install, you can allow the instance to restart and create a snapshot.
Select the instances that you want to patch.
Click Create. In the confirmation dialog box, click OK.
After you create the task, you can view the fix status by choosing Server Management > Patch Management from the left-side navigation pane.