AWS SSM Association でマルチAZ環境のパッチ適用を自動化する構成設計｜State Manager活用

この記事のポイント

・SSM Association = State ManagerによるDocumentの定期実行設定
・AWS-RunPatchBaselineでマルチAZパッチ適用を自動化できる
・Rate Controlで同時適用を25%に絞りローリング適用が可能
・PatchGroupタグで環境ごとにターゲットを柔軟に絞り込める

# SSM Agent の起動確認
systemctl status amazon-ssm-agent

# 出力例
* amazon-ssm-agent.service - amazon-ssm-agent
   Loaded: loaded (/etc/systemd/system/amazon-ssm-agent.service; enabled)
   Active: active (running) since Sun 2026-10-06 01:00:03 UTC; 1h 12min ago
 Main PID: 1234 (amazon-ssm-agen)
   Status: "Agent is running and ready to receive commands"

# IAMロールの作成（EC2用信頼ポリシー）
aws iam create-role \
  --role-name SSM-EC2-Role \
  --assume-role-policy-document '{
    "Version":"2012-10-17",
    "Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]
  }'

# AmazonSSMManagedInstanceCore ポリシーをアタッチ
aws iam attach-role-policy \
  --role-name SSM-EC2-Role \
  --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

# インスタンスプロファイルを作成してロールを紐付け
aws iam create-instance-profile --instance-profile-name SSM-EC2-Profile
aws iam add-role-to-instance-profile \
  --instance-profile-name SSM-EC2-Profile \
  --role-name SSM-EC2-Role

# AZ-a の EC2 に PatchGroup タグを付与
aws ec2 create-tags \
  --resources i-0a1b2c3d4e5f67890 \
  --tags Key=PatchGroup,Value=prod-linux

# AZ-c の EC2 にも同じタグを付与
aws ec2 create-tags \
  --resources i-0f9e8d7c6b5a43210 \
  --tags Key=PatchGroup,Value=prod-linux

# Association の作成（毎週日曜 2:00 UTC に実行）
aws ssm create-association \
  --name "AWS-RunPatchBaseline" \
  --association-name "weekly-patch-prod" \
  --targets "Key=tag:PatchGroup,Values=prod-linux" \
  --schedule-expression "cron(0 2 ? * SUN *)" \
  --parameters "Operation=Install" \
  --max-concurrency "25%" \
  --max-errors "1" \
  --output-location "S3Location={BucketName=my-ssm-logs,KeyPrefix=patch-logs/}"

# 作成結果（AssociationId を控えておく）
{
    "AssociationDescription": {
        "Name": "AWS-RunPatchBaseline",
        "AssociationName": "weekly-patch-prod",
        "AssociationId": "a1b2c3d4-1234-5678-abcd-ef0123456789",
        "AssociationVersion": "1",
        "Date": "2026-10-06T01:30:00+00:00",
        "Targets": [{"Key": "tag:PatchGroup", "Values": ["prod-linux"]}],
        "ScheduleExpression": "cron(0 2 ? * SUN *)",
        "MaxConcurrency": "25%",
        "MaxErrors": "1"
    }
}

# 直近の実行履歴を確認
aws ssm list-association-executions \
  --association-id "a1b2c3d4-1234-5678-abcd-ef0123456789" \
  --max-results 5

# 出力例
{
    "AssociationExecutions": [
        {
            "AssociationId": "a1b2c3d4-1234-5678-abcd-ef0123456789",
            "AssociationVersion": "1",
            "ExecutionId": "b2c3d4e5-2345-6789-bcde-f01234567890",
            "Status": "Success",
            "DetailedStatus": "Success",
            "CreatedTime": "2026-10-06T02:00:01+00:00",
            "LastExecutionDate": "2026-10-06T02:18:47+00:00",
            "ResourceCountByStatus": "{Success=8,Failed=0}"
        }
    ]
}

# インスタンス単位の詳細を確認
aws ssm list-association-execution-targets \
  --association-id "a1b2c3d4-1234-5678-abcd-ef0123456789" \
  --execution-id "b2c3d4e5-2345-6789-bcde-f01234567890"

# ターゲットインスタンスがSSMに登録されているか確認
aws ssm describe-instance-information \
  --filters "Key=tag:PatchGroup,Values=prod-linux"

# 出力例（InstanceIdが表示されれば登録済み）
{
    "InstanceInformationList": [
        {
            "InstanceId": "i-0a1b2c3d4e5f67890",
            "PingStatus": "Online",
            "LastPingDateTime": "2026-10-06T01:55:12+00:00",
            "AgentVersion": "3.2.2086.0",
            "IsLatestVersion": true,
            "PlatformType": "Linux",
            "PlatformName": "Amazon Linux",
            "PlatformVersion": "2023"
        }
    ]
}