AWS自定義Windows AMI - 如何處理更新？

Question

我目前正在使用AWS，目的是擁有一個自動縮放Windows系統。 我有一個腳本可以從GIT Repo中獲取最新的代碼 - 但是我想知道人們如何處理Windows更新，因為AMI必須定期更新最新的Windows更新（這是正確的） ？）所以我很好奇人們如何升級Windows，創建新的AMI以及頻率如何？

謝謝

Answer 1

您接受Windows更新的頻率以及此后需要進行多少測試才能仔細考慮您的服務器暴露和關鍵性。 您對執行Windows Update的風險的估計也相當可觀。

你不必預烘AMI與軟件的最新更新，包括操作系統（OS）軟件。 以下是使用PowerShell模塊運行Windows Update的方法 。

Answer 2

將Systems Manager RunCommand功能與AWS-InstallWindowsUpdates文檔一起使用。 在下載，安裝，重新啟動並再次檢查所有Windows更新之前，此循環不會完成。 請參閱下面的日志，了解其包含的操作類型

$InstanceId=?????
$runPSCommand=Send-SSMCommand -InstanceId @($instanceid) -DocumentName AWS-InstallWindowsUpdates -Comment 'Run Windows Updates whilst baking an AMI' -Parameter @{'Action'='Install'}

Write-Host "Waiting for Windows Updates to complete..."
do {
   Sleep -Seconds 10
   $CmdStatus = Get-SSMCommandInvocation -InstanceId $instanceid -CommandId $runPSCommand.CommandId
} Until ($CmdStatus.Status -eq "Success")
Write-Host "Windows Updates complete"

這是一些示例輸出，顯示重新啟動並重新檢查是否有更多要安裝的更新

04/10/2017 06:24:51 UTC | Info | Start of Install-AwsUwiWindowsUpdates
04/10/2017 06:24:51 UTC | Info | Searching for Windows Updates.
04/10/2017 06:27:10 UTC | Info | Found 4 available Windows Updates.
04/10/2017 06:27:10 UTC | Info | Update for Windows Server 2012 R2 (KB3052480)
04/10/2017 06:27:10 UTC | Info | Windows Malicious Software Removal Tool for Windows 8, 8.1, 10 and Windows Server 2012, 2012 R2, 2016 x64 Edition - March 2017 (KB890830)
04/10/2017 06:27:10 UTC | Info | March, 2017 Security Monthly Quality Rollup for Windows Server 2012 R2 (KB4012216)
04/10/2017 06:27:10 UTC | Info | March, 2017 Preview of Monthly Quality Rollup for Windows Server 2012 R2 (KB4012219)
04/10/2017 06:27:10 UTC | Info | Downloading Windows Updates.
04/10/2017 06:27:35 UTC | Info | Successfully Downloaded: Update for Windows Server 2012 R2 (KB3052480)
04/10/2017 06:27:36 UTC | Info | Successfully Downloaded: Windows Malicious Software Removal Tool for Windows 8, 8.1, 10 and Windows Server 2012, 2012 R2, 2016 x64 Edition - March 2017 (KB890830)
04/10/2017 06:28:32 UTC | Info | Successfully Downloaded: March, 2017 Security Monthly Quality Rollup for Windows Server 2012 R2 (KB4012216)
04/10/2017 06:29:34 UTC | Info | Successfully Downloaded: March, 2017 Preview of Monthly Quality Rollup for Windows Server 2012 R2 (KB4012219)
04/10/2017 06:29:34 UTC | Info | 4 Windows Updates will be installed.
04/10/2017 06:29:34 UTC | Info | Installed: Update for Windows Server 2012 R2 (KB3052480)
04/10/2017 06:30:15 UTC | Info | Installed: Windows Malicious Software Removal Tool for Windows 8, 8.1, 10 and Windows Server 2012, 2012 R2, 2016 x64 Edition - March 2017 (KB890830)
04/10/2017 06:30:29 UTC | Info | Installed: March, 2017 Security Monthly Quality Rollup for Windows Server 2012 R2 (KB4012216)
04/10/2017 06:30:44 UTC | Info | Installed: March, 2017 Preview of Monthly Quality Rollup for Windows Server 2012 R2 (KB4012219)
04/10/2017 06:30:44 UTC | Info | Windows requires a reboot.  Sending reboot request to SSM Agent.
04/10/2017 06:33:44 UTC | Info | Start of Install-AwsUwiWindowsUpdates
04/10/2017 06:33:44 UTC | Info | Searching for Windows Updates.
04/10/2017 06:36:29 UTC | Info | Found 0 available Windows Updates.

您可以將此作為腳本的一部分來烘焙AMI，或者重新啟動AMI。

您也可以使用-Target而不是-InstanceId，並指定帶有標記的過濾器以更新與過濾器匹配的所有實例。