文件 AWS 開發套件範例 GitHub 儲存庫中有更多可用的 [AWS SDK 範例](https://github.com/awsdocs/aws-doc-sdk-examples)。 本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。 # 搭配使用 `CreatePatchBaseline` 與 CLI 下列程式碼範例示範如何使用 `CreatePatchBaseline`。 ------ #### [ CLI ] **AWS CLI** **範例 1：建立具有自動核准的修補基準** 下列 `create-patch-baseline` 範例示範建立 Windows Server 修補基準，該基準會在 Microsoft 發行適用於生產環境的修補程式七天之後對它們進行核准。 ``` aws ssm create-patch-baseline \ --name "Windows-Production-Baseline-AutoApproval" \ --operating-system "WINDOWS" \ --approval-rules "PatchRules=[{PatchFilterGroup={PatchFilters=[{Key=MSRC_SEVERITY,Values=[Critical,Important,Moderate]},{Key=CLASSIFICATION,Values=[SecurityUpdates,Updates,UpdateRollups,CriticalUpdates]}]},ApproveAfterDays=7}]" \ --description "Baseline containing all updates approved for Windows Server production systems" ``` 輸出： ``` { "BaselineId": "pb-045f10b4f3EXAMPLE" } ``` **範例 2：建立具有核准截止日期的修補基準** 下列 `create-patch-baseline` 範例示範建立 Windows Server 修補基準，該基準會對 2020 年 7 月 7 日 (含) 之前發布的適用於生產環境的所有修補程式進行核准。 ``` aws ssm create-patch-baseline \ --name "Windows-Production-Baseline-AutoApproval" \ --operating-system "WINDOWS" \ --approval-rules "PatchRules=[{PatchFilterGroup={PatchFilters=[{Key=MSRC_SEVERITY,Values=[Critical,Important,Moderate]},{Key=CLASSIFICATION,Values=[SecurityUpdates,Updates,UpdateRollups,CriticalUpdates]}]},ApproveUntilDate=2020-07-07}]" \ --description "Baseline containing all updates approved for Windows Server production systems" ``` 輸出： ``` { "BaselineId": "pb-045f10b4f3EXAMPLE" } ``` **範例 3：建立核准規則存放在 JSON 檔案中的修補基準** 下列 `create-patch-baseline` 範例示範建立 Amazon Linux 2017.09 修補基準，該基準會在適用於生產環境的修補程式發布 7 天後對它們進行核准、指定修補基準的核准規則，以及指定修補程式的自訂儲存庫。 ``` aws ssm create-patch-baseline \ --cli-input-json file://my-amazon-linux-approval-rules-and-repo.json ``` `my-amazon-linux-approval-rules-and-repo.json` 的內容： ``` { "Name": "Amazon-Linux-2017.09-Production-Baseline", "Description": "My approval rules patch baseline for Amazon Linux 2017.09 instances", "OperatingSystem": "AMAZON_LINUX", "Tags": [ { "Key": "Environment", "Value": "Production" } ], "ApprovalRules": { "PatchRules": [ { "ApproveAfterDays": 7, "EnableNonSecurity": true, "PatchFilterGroup": { "PatchFilters": [ { "Key": "SEVERITY", "Values": [ "Important", "Critical" ] }, { "Key": "CLASSIFICATION", "Values": [ "Security", "Bugfix" ] }, { "Key": "PRODUCT", "Values": [ "AmazonLinux2017.09" ] } ] } } ] }, "Sources": [ { "Name": "My-AL2017.09", "Products": [ "AmazonLinux2017.09" ], "Configuration": "[amzn-main] \nname=amzn-main-Base\nmirrorlist=http://repo./$awsregion./$awsdomain//$releasever/main/mirror.list //nmirrorlist_expire=300//nmetadata_expire=300 \npriority=10 \nfailovermethod=priority \nfastestmirror_enabled=0 \ngpgcheck=1 \ngpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-amazon-ga \nenabled=1 \nretries=3 \ntimeout=5\nreport_instanceid=yes" } ] } ``` **範例 4：建立將指定已核准和遭拒的修補程式的修補基準** 下列 `create-patch-baseline` 範例明確指定作為預設核准規則例外狀況要核准和拒絕的修補程式。 ``` aws ssm create-patch-baseline \ --name "Amazon-Linux-2017.09-Alpha-Baseline" \ --description "My custom approve/reject patch baseline for Amazon Linux 2017.09 instances" \ --operating-system "AMAZON_LINUX" \ --approved-patches "CVE-2018-1234567,example-pkg-EE-2018*.amzn1.noarch" \ --approved-patches-compliance-level "HIGH" \ --approved-patches-enable-non-security \ --tags "Key=Environment,Value=Alpha" ``` 如需詳細資訊，請參閱《AWS Systems Manager 使用者指南》**中的 [Create a Custom Patch Baseline](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-patch-baseline-console.html)。 + 如需 API 詳細資訊，請參閱《AWS CLI 命令參考》**中的 [CreatePatchBaseline](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ssm/create-patch-baseline.html)。 ------ #### [ PowerShell ] **Tools for PowerShell V4** **範例 1：此範例示範針對在生產環境中執行 Windows Server 2019 的受管執行個體建立修補基準，該修補基準在 Microsoft 發行修補程式七天後對修補程式進行核准。** ``` $rule = New-Object Amazon.SimpleSystemsManagement.Model.PatchRule $rule.ApproveAfterDays = 7 $ruleFilters = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilterGroup $patchFilter = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilter $patchFilter.Key="PRODUCT" $patchFilter.Values="WindowsServer2019" $severityFilter = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilter $severityFilter.Key="MSRC_SEVERITY" $severityFilter.Values.Add("Critical") $severityFilter.Values.Add("Important") $severityFilter.Values.Add("Moderate") $classificationFilter = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilter $classificationFilter.Key = "CLASSIFICATION" $classificationFilter.Values.Add( "SecurityUpdates" ) $classificationFilter.Values.Add( "Updates" ) $classificationFilter.Values.Add( "UpdateRollups" ) $classificationFilter.Values.Add( "CriticalUpdates" ) $ruleFilters.PatchFilters.Add($severityFilter) $ruleFilters.PatchFilters.Add($classificationFilter) $ruleFilters.PatchFilters.Add($patchFilter) $rule.PatchFilterGroup = $ruleFilters New-SSMPatchBaseline -Name "Production-Baseline-Windows2019" -Description "Baseline containing all updates approved for production systems" -ApprovalRules_PatchRule $rule ``` **輸出：** ``` pb-0z4z6221c4296b23z ``` + 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V4)》**中的 [CreatePatchBaseline](https://docs.aws.amazon.com/powershell/v4/reference)。 **Tools for PowerShell V5** **範例 1：此範例示範針對在生產環境中執行 Windows Server 2019 的受管執行個體建立修補基準，該修補基準在 Microsoft 發行修補程式七天後對修補程式進行核准。** ``` $rule = New-Object Amazon.SimpleSystemsManagement.Model.PatchRule $rule.ApproveAfterDays = 7 $ruleFilters = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilterGroup $patchFilter = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilter $patchFilter.Key="PRODUCT" $patchFilter.Values="WindowsServer2019" $severityFilter = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilter $severityFilter.Key="MSRC_SEVERITY" $severityFilter.Values.Add("Critical") $severityFilter.Values.Add("Important") $severityFilter.Values.Add("Moderate") $classificationFilter = New-Object Amazon.SimpleSystemsManagement.Model.PatchFilter $classificationFilter.Key = "CLASSIFICATION" $classificationFilter.Values.Add( "SecurityUpdates" ) $classificationFilter.Values.Add( "Updates" ) $classificationFilter.Values.Add( "UpdateRollups" ) $classificationFilter.Values.Add( "CriticalUpdates" ) $ruleFilters.PatchFilters.Add($severityFilter) $ruleFilters.PatchFilters.Add($classificationFilter) $ruleFilters.PatchFilters.Add($patchFilter) $rule.PatchFilterGroup = $ruleFilters New-SSMPatchBaseline -Name "Production-Baseline-Windows2019" -Description "Baseline containing all updates approved for production systems" -ApprovalRules_PatchRule $rule ``` **輸出：** ``` pb-0z4z6221c4296b23z ``` + 如需 API 詳細資訊，請參閱《AWS Tools for PowerShell Cmdlet 參考 (V5)》**中的 [CreatePatchBaseline](https://docs.aws.amazon.com/powershell/v5/reference)。 ------