Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-141381,185842.7 KB

Creates a patch baseline.

For information about valid key-value pairs in PatchFilters for each supported operating system type, see PatchFilter.

post/#X-Amz-Target=AmazonSSM.CreatePatchBaseline

Headers

X-Amz-Target'AmazonSSM.CreatePatchBaseline' required

Request body

OperatingSystem'WINDOWS' | 'AMAZON_LINUX' | 'AMAZON_LINUX_2' | 'AMAZON_LINUX_2022' | 'UBUNTU' | 'REDHAT_ENTERPRISE_LINUX' | 'SUSE' | 'CENTOS' | 'ORACLE_LINUX' | 'DEBIAN' | 'MACOS' | 'RASPBIAN' | 'ROCKY_LINUX' | 'ALMA_LINUX' | 'AMAZON_LINUX_2023'

Defines the operating system the patch baseline applies to. The default value is <code>WINDOWS</code>.

Namestring required

The name of the patch baseline.

ApprovedPatchesPatchId[]
<p>A list of explicitly approved patches for the baseline.</p> <p>For information about accepted formats for lists of approved patches and rejected patches, see <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html">About package name formats for approved and rejected patch lists</a> in the <i>Amazon Web Services Systems Manager User Guide</i>.</p>
ApprovedPatchesComplianceLevel'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFORMATIONAL' | 'UNSPECIFIED'

Defines the compliance level for approved patches. When an approved patch is reported as missing, this value describes the severity of the compliance violation. The default value is <code>UNSPECIFIED</code>.

ApprovedPatchesEnableNonSecurityboolean

Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes. The default value is <code>false</code>. Applies to Linux managed nodes only.

RejectedPatchesPatchId[]
<p>A list of explicitly rejected patches for the baseline.</p> <p>For information about accepted formats for lists of approved patches and rejected patches, see <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html">About package name formats for approved and rejected patch lists</a> in the <i>Amazon Web Services Systems Manager User Guide</i>.</p>
RejectedPatchesAction'ALLOW_AS_DEPENDENCY' | 'BLOCK'
<p>The action for Patch Manager to take on patches included in the <code>RejectedPackages</code> list.</p> <ul> <li> <p> <b> <code>ALLOW_AS_DEPENDENCY</code> </b>: A package in the <code>Rejected</code> patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as <code>InstalledOther</code>. This is the default action if no option is specified.</p> </li> <li> <p> <b> <code>BLOCK</code> </b>: Packages in the <code>RejectedPatches</code> list, and packages that include them as dependencies, aren't installed under any circumstances. If a package was installed before it was added to the Rejected patches list, it is considered non-compliant with the patch baseline, and its status is reported as <code>InstalledRejected</code>.</p> </li> </ul>
Descriptionstring

A description of the patch baseline.

ClientTokenstring

User-provided idempotency token.

Response

Success

BaselineIdstring

The ID of the created patch baseline.