How to check if the Windows updates are finished on EC2?

Question

I am looking for a way to determine that a Windows update is complete on on an AWS EC2 instance.

I have a python sktipt with boto3 that is supposed to update a Windows instance and then run some tests. However, the tests fail because the Windows updates are not finished yet.

For the updates I use ssm.send_command with the document name AWS-InstallWindowsUpdates .

import boto3

ssm = boto3.client('ssm', region_name='eu-central-1')
ssm.send_command(InstanceIds=['i-XXXX'], DocumentName='AWS-InstallWindowsUpdates')

Now how can I make sure that all updates are installed and I can start testing?

I tried with Get-WUInstallerStatus command from PowerShell in a loop until the output IsBusy = False comes.

Get-WUInstallerStatus | Select-Object IsBusy | Format-List

The command does return IsBusy = False. However, a restart still occur in a few minutes.

Answer 1

send_command is a process that can be monitored through AWS API - get_command_invocation so you can check the status of the execution.

After the update process, you can execute AWS-InstallWindowsUpdates again with action parameter set to Scan to ensure that the update ends successfully.

In the case that a process on your Ec2 instance needs to know, if an SSM command is currently running, for Linux instances I check running processes ( ps -aux ).