What problem does it solve? PROD patching with AWS SSM Patch Manager and Quick Setup often fails through baseline drift, accidental reboots, oversized evidence dumps, and vague install approvals. This Skill enforces a repeatable scan-first workflow that proves patch compliance safely against TRUST AL2/AL2023 baselines. ## Core Features & Use Cases - Baseline Drift Detection and Repair: Verifies Quick Setup selects the TRUST baselines (AL2-TRUST, AL2023-TRUST) instead of AWS predefined baselines before any scan. - Safe Execution Pattern: Runs scan-only validation first, then gated install pilots with RebootOption=NoReboot, explicit target guards, and reboot as a separate approval decision. - Compact Evidence Discipline: Records command ids, target counts, and before/after missing/failed/pending-reboot counts, uploading only compact summaries to S3 instead of raw command output. - Worker Delegation: Delegates patching tasks to PAT-style tmux workers using short prompt files with concrete approval boundaries. - Use Case: An operator needs to close VA findings on PROD Amazon Linux hosts. The Skill repairs Quick Setup baseline selection, runs a scan-only pass, executes a small NoReboot install pilot, then plans a reboot/rescan closure with compact S3 evidence. ## Quick Start Use the ssm-patch-quicksetup-prod skill to run a scan-only patch validation across all PROD EC2 instances against the TRUST baselines and summarize missing and failed patches.
