Patch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install)
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-patch-compliance-status-check --compliance-types NON_COMPLIANT$ aws ssm describe-instance-patch-states --instance-ids i-0123456789abcdef0 --query 'InstancePatchStates[].{Node:InstanceId,Baseline:BaselineId,Missing:MissingCount,Failed:FailedCount,CriticalNonCompliant:CriticalNonCompliantCount,SecurityNonCompliant:SecurityNonCompliantCount,Operation:Operation,EndTime:OperationEndTime}'$ aws inspector2 batch-get-account-status --account-ids <ACCOUNT_ID>$ aws inspector2 list-coverage --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_EC2_INSTANCE"}]}'Expected output
An EvaluationResults array with an empty NON_COMPLIANT set (every SSM patch-compliance record reads COMPLIANT), InstancePatchStates showing MissingCount/FailedCount/CriticalNonCompliantCount/SecurityNonCompliantCount at zero with a recent OperationEndTime, an account status whose resourceState.ec2/ecr/lambda read ENABLED, and coveredResources whose scanStatus.statusCode is ACTIVE with a recent lastScannedAt. Managed rule identifier: EC2_MANAGEDINSTANCE_PATCH_COMPLIANCE_STATUS_CHECK
Map — what it proves
- recipe2
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:SI 10/35 →RA 1/13 →
GovCloud
AWS Config, Systems Manager, and Amazon Inspector are available in AWS GovCloud (US-East) and (US-West); instance and finding ARNs use partition arn:aws-us-gov. Two GovCloud differences to record: Lambda code scanning is not available, and the Inspector plugin for Linux deep inspection is not FIPS compliant.
Notes & assertions
This proves flaws are detected and shows exactly what is still missing and when patching last ran — it does not prove the remediation clock was met. Whether an open finding sits inside your SI-02 timeframe, or carries an approved deviation or POA&M entry, is a judgement joined against your risk-acceptance record, not an API result. Substitute your real instance ids and account id; describe-instance-patch-states requires --instance-ids (use describe-instance-patch-states-for-patch-group to sweep a patch group). Note also that patch compliance data is a point-in-time snapshot and each successful scan overwrites the previous one, so capture the output at collection time rather than reconstructing history later.
References
- AWS Config managed rule: ec2-managedinstance-patch-compliance-status-check https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-patch-compliance-status-check.html
- AWS CLI: ssm describe-instance-patch-states https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-patch-states.html
- Systems Manager Patch Manager: working with patch compliance reports https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-compliance-reports.html
- AWS CLI: inspector2 batch-get-account-status https://docs.aws.amazon.com/cli/latest/reference/inspector2/batch-get-account-status.html
- AWS CLI: inspector2 list-coverage https://docs.aws.amazon.com/cli/latest/reference/inspector2/list-coverage.html
- Amazon Inspector in AWS GovCloud (US) https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-inspector2.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Change Management run (7)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under CMT, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialPatch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install)you are heredailypatch-and-vulnerability-remediationAWS Config · AWS Systems Manager Patch Manager · Amazon Inspector
- partialWho changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approvalweeklycloudtrail-config-change-historyAWS CloudTrail · AWS Config · AWS Systems Manager Change Manager
- partialConfig compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to readmonthlyconfig-least-functionalityAWS Config · AWS Systems Manager Inventory · Amazon EC2
- partialEvery running instance built from an image you never approved and every node carrying denylisted software, together with proof that an automated action was configured for those findings and a record of what it did when one firedcontinuousunauthorized-component-detection-and-responseAWS Config · AWS Systems Manager Automation · AWS Systems Manager Inventory · Amazon EC2
- partialThe enforced half of who may change what: the service control policy type actually enabled in the organization root, the customer-authored SCPs and the roots, OUs and accounts each one is attached to, and the permissions boundary carried by every principal your own tagging marks as a change authoritycontinuouschange-authority-restrictions-and-enforcementAWS Organizations · AWS IAM
- partialFor every change that reached the assessed branch, the automated verification that ran against it — which workflows ran, on which commit, and what each concluded — together with the two things that decide whether those runs were a condition of the change or merely adjacent to it: the rule that made the checks required, and the platform's own per-push record of whether that rule held, failed, or was bypassed. The runs alone are activity; the rule and the per-push record are what make them a gate.weeklychange-verification-status-checks-and-run-recordsGitHub Actions · GitHub repository rulesets
- partialThe rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when.continuoussecurity-representative-change-approvalGitHub code owners · GitHub repository rulesets · GitHub pull requests