# Patch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install)

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/patch-and-vulnerability-remediation

Recipe id: `patch-and-vulnerability-remediation` · cadence daily · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-CMT-VTD`
- KSI `KSI-SCR-MON`
- control `si-2`
- control `ra-5`

## Collection

Kind: `cli`

```sh
# ec2-managedinstance-patch-compliance-status-check
aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-patch-compliance-status-check --compliance-types NON_COMPLIANT
# describe-instance-patch-states
aws ssm describe-instance-patch-states --instance-ids i-0123456789abcdef0 --query 'InstancePatchStates[].{Node:InstanceId,Baseline:BaselineId,Missing:MissingCount,Failed:FailedCount,CriticalNonCompliant:CriticalNonCompliantCount,SecurityNonCompliant:SecurityNonCompliantCount,Operation:Operation,EndTime:OperationEndTime}'
# batch-get-account-status
aws inspector2 batch-get-account-status --account-ids <ACCOUNT_ID>
# list-coverage
aws inspector2 list-coverage --filter-criteria '{"resourceType":[{"comparison":"EQUALS","value":"AWS_EC2_INSTANCE"}]}'
```

## Expected output

An EvaluationResults array with an empty NON_COMPLIANT set (every SSM patch-compliance record reads COMPLIANT), InstancePatchStates showing MissingCount/FailedCount/CriticalNonCompliantCount/SecurityNonCompliantCount at zero with a recent OperationEndTime, an account status whose resourceState.ec2/ecr/lambda read ENABLED, and coveredResources whose scanStatus.statusCode is ACTIVE with a recent lastScannedAt. Managed rule identifier: EC2_MANAGEDINSTANCE_PATCH_COMPLIANCE_STATUS_CHECK

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS Config, Systems Manager, and Amazon Inspector are available in AWS GovCloud (US-East) and (US-West); instance and finding ARNs use partition arn:aws-us-gov. Two GovCloud differences to record: Lambda code scanning is not available, and the Inspector plugin for Linux deep inspection is not FIPS compliant.

## Notes

This proves flaws are detected and shows exactly what is still missing and when patching last ran — it does not prove the remediation clock was met. Whether an open finding sits inside your SI-02 timeframe, or carries an approved deviation or POA&M entry, is a judgement joined against your risk-acceptance record, not an API result. Substitute your real instance ids and account id; describe-instance-patch-states requires --instance-ids (use describe-instance-patch-states-for-patch-group to sweep a patch group). Note also that patch compliance data is a point-in-time snapshot and each successful scan overwrites the previous one, so capture the output at collection time rather than reconstructing history later.

## References

- {"title":"AWS Config managed rule: ec2-managedinstance-patch-compliance-status-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-patch-compliance-status-check.html"}
- {"title":"AWS CLI: ssm describe-instance-patch-states","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-patch-states.html"}
- {"title":"Systems Manager Patch Manager: working with patch compliance reports","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-compliance-reports.html"}
- {"title":"AWS CLI: inspector2 batch-get-account-status","url":"https://docs.aws.amazon.com/cli/latest/reference/inspector2/batch-get-account-status.html"}
- {"title":"AWS CLI: inspector2 list-coverage","url":"https://docs.aws.amazon.com/cli/latest/reference/inspector2/list-coverage.html"}
- {"title":"Amazon Inspector in AWS GovCloud (US)","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-inspector2.html"}