### Terratest for SSM Patch Manager Example

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

This Go test uses Terratest to deploy the complete SSM Patch Manager example, verify outputs, and clean up resources. Ensure Go, Terraform, and Atmos are installed before running.

```go
package test

import (
    "math/rand"
    "strconv"
    "testing"
    "time"

    "github.com/gruntwork-io/terratest/modules/terraform"
    "github.com/stretchr/testify/assert"
)

func TestExamplesComplete(t *testing.T) {
    t.Parallel()

    rand.Seed(time.Now().UnixNano())
    randID := strconv.Itoa(rand.Intn(100000))

    terraformOptions := &terraform.Options{
        TerraformDir: "../../examples/complete",
        Upgrade:      true,
        VarFiles:     []string{"fixtures.us-east-2.tfvars"},
        Vars: map[string]interface{}{
            "attributes": []string{randID},
        },
    }
    defer terraform.Destroy(t, terraformOptions)

    terraform.InitAndApply(t, terraformOptions)

    installPatchGroupId := terraform.Output(t, terraformOptions, "install_patch_group_id")
    // Asserts the patch group name "TOPATCH" is present in the output
    assert.Contains(t, installPatchGroupId, "TOPATCH")
}
```

--------------------------------

### Run All Terraform Tests with Atmos

Source: https://github.com/cloudposse/terraform-aws-ssm-patch-manager/blob/main/README.md

Execute all defined Terraform tests using the Atmos command-line tool. Ensure Atmos and Go are installed.

```bash
atmos test run
```

--------------------------------

### Basic SSM Patch Manager Setup

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Sets up the SSM Patch Manager with a specified operating system. Ensure Terraform version is >= 1.3 and AWS provider is >= 4.0.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  operating_system = "AMAZON_LINUX_2"
}
```

--------------------------------

### Deploy SSM Patch Manager Module

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Deploy the SSM Patch Manager module with default configurations. This example assumes the `null-label` context is already established. The module automatically creates necessary resources like maintenance windows and an S3 log bucket.

```hcl
module "ssm_patch_manager" {
  source = "cloudposse/ssm-patch-manager/aws"
  # version = "x.x.x"

  context = module.this.context

  # Expected outputs after `terraform apply`:
  # install_patch_group_id               = "pb-0abc...,TOPATCH"
  # scan_maintenance_window_task_id      = "mw-task-0abc..."
  # install_maintenance_window_task_id   = "mw-task-0def..."
  # ssm_patch_log_s3_bucket_id           = "eg-ue2-test-ssm-patch"
}
```

--------------------------------

### Configure Post-Install Reboot Behavior

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Control whether instances reboot after patches are installed. Set to 'NoReboot' to skip automatic reboots and manage them separately.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  reboot_option = "NoReboot"   # Prevent automatic reboots; manage separately
}
```

--------------------------------

### SSM Patch Manager with Custom Schedules

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Defines custom cron schedules for scan and install maintenance windows. Allows configuration of duration and cutoff times for each window.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  # Scan every Sunday at 02:00 UTC
  scan_maintenance_window_schedule    = "cron(0 0 2 ? * SUN *)"
  scan_maintenance_window_duration    = 2
  scan_maintenance_window_cutoff      = 1

  # Install every Sunday at 05:00 UTC
  install_maintenance_window_schedule = "cron(0 0 5 ? * SUN *)"
  install_maintenance_window_duration = 3
  install_maintenance_window_cutoff   = 1
}
```

--------------------------------

### Run Automated Tests with Atmos

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Execute the automated tests for the SSM Patch Manager module using the Atmos CLI. This command assumes Atmos, Go, and Terraform/OpenTofu are installed and configured.

```sh
# Install Atmos, Go 1.24+, and Terraform/OpenTofu first, then:
atmos test run      # runs TestExamplesComplete against us-east-2
atmos test clean    # destroys any leftover test resources
```

--------------------------------

### Basic SSM Patch Manager Module Usage

Source: https://github.com/cloudposse/terraform-aws-ssm-patch-manager/blob/main/README.md

This is a basic example of how to include the SSM Patch Manager module in your Terraform configuration. Ensure you replace 'xxxx' with the actual version number of the module you intend to use. For production environments, pinning to a specific version is strongly recommended.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "xxxx"
  name = "test"
}
```

--------------------------------

### Configure Patch Group Targeting

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Define lists of patch group names to enroll EC2 instances. Instances tagged with 'Patch Group: <name>' are targeted. Defaults are 'TOSCAN' for scanning and 'TOPATCH' for installation.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  scan_patch_groups    = ["TOSCAN", "WEBSERVERS"]
  install_patch_groups = ["TOPATCH", "WEBSERVERS"]
}

# The EC2 instance must carry the matching tag:
resource "aws_instance" "web" {
  # ...
  tags = {
    "Patch Group" = "WEBSERVERS"
  }
}
```

--------------------------------

### Access All Module Outputs

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Demonstrates how to access all available outputs from the SSM Patch Manager module for use in other resources or for verification.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"
}

# Available outputs:
output "patch_baseline_arn" {
  value = module.ssm_patch_manager.patch_baseline_arn
  # e.g. "arn:aws:ssm:us-east-1:123456789012:patchbaseline/pb-0abc1234def56789"
}

output "install_maintenance_window_id" {
  value = module.ssm_patch_manager.install_maintenance_window_id
  # e.g. "mw-0abc1234def56789a"
}

output "install_maintenance_window_task_id" {
  value = module.ssm_patch_manager.install_maintenance_window_task_id
}

output "install_maintenance_window_target_id" {
  value = module.ssm_patch_manager.install_maintenance_window_target_id
}

output "install_patch_group_id" {
  value = module.ssm_patch_manager.install_patch_group_id
  # e.g. "pb-0abc1234def56789,TOPATCH"
}

output "scan_maintenance_window_task_id" {
  value = module.ssm_patch_manager.scan_maintenance_window_task_id
}

output "scan_maintenance_window_target_id" {
  value = module.ssm_patch_manager.scan_maintenance_window_target_id
}

output "scan_patch_group_id" {
  value = module.ssm_patch_manager.scan_patch_group_id
}

output "ssm_patch_log_s3_bucket_id" {
  value = module.ssm_patch_manager.ssm_patch_log_s3_bucket_id
  # e.g. "eg-prod-primary-patch"
}

output "ssm_patch_log_s3_bucket_arn" {
  value = module.ssm_patch_manager.ssm_patch_log_s3_bucket_arn
  # e.g. "arn:aws:s3:::eg-prod-primary-patch"
}
```

--------------------------------

### Explore Atmos Test Options

Source: https://github.com/cloudposse/terraform-aws-ssm-patch-manager/blob/main/README.md

View available options and commands for running Terraform tests with Atmos. Use this to understand advanced configurations and parameters.

```bash
atmos test --help
```

--------------------------------

### Advanced Instance Targeting with Maintenance Windows

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Override default tag targeting for fine-grained instance selection using 'key' and 'values' lists. This allows targeting without relying on the 'Patch Group' tag.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  scan_maintenance_windows_targets = [
    {
      key    = "tag:Environment"
      values = ["prod", "staging"]
    }
  ]

  install_maintenance_windows_targets = [
    {
      key    = "tag:Environment"
      values = ["prod"]
    }
  ]
}
```

--------------------------------

### SSM Patch Manager with Approval Rules

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Configures patch approval rules to automatically approve patches based on specified criteria. Supports up to 10 rules, each with filters for product, classification, and severity.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace        = "eg"
  environment      = "prod"
  stage            = "primary"
  name             = "patch"
  operating_system = "AMAZON_LINUX_2"

  patch_baseline_approval_rules = [
    {
      approve_after_days  = 7
      compliance_level    = "HIGH"
      enable_non_security = true
      patch_baseline_filters = [
        { name = "PRODUCT",        values = ["AmazonLinux2", "AmazonLinux2.0"] },
        { name = "CLASSIFICATION", values = ["Security", "Bugfix", "Recommended"] },
        { name = "SEVERITY",       values = ["Critical", "Important", "Medium"] }
      ]
    }
  ]
}
```

--------------------------------

### Configure EC2 Instance with SSM Patch Manager

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Enable SSM Patch Manager for an EC2 instance and specify an S3 bucket for logs. This requires the instance to be launched within a VPC and have appropriate security group configurations.

```hcl
module "ec2_instance" {
  source  = "cloudposse/ec2-instance/aws"
  version = "2.0.0"

  vpc_id          = module.vpc.vpc_id
  subnet          = module.subnets.private_subnet_ids[0]
  security_groups = [module.vpc.vpc_default_security_group_id]
  ami             = "ami-0beaa649c482330f7"
  ami_owner       = "amazon"
  ssh_key_pair    = ""
  instance_type   = "t3.micro"

  ssm_patch_manager_enabled       = true
  ssm_patch_manager_s3_log_bucket = format(
    "%s-%s-%s-%s",
    module.this.namespace,
    module.this.environment,
    module.this.stage,
    module.this.name
  )

  tags    = { "Patch Group" = "TOPATCH" }
  context = module.this.context
}
```

--------------------------------

### Configure S3 Log Storage

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Enable S3 logging for patch command output. The module can create a new private, versioned S3 bucket or use an existing one specified by 'bucket_id'.

```hcl
# Option A: let the module create the bucket
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  s3_log_output_enabled       = true
  ssm_bucket_versioning_enable = true
  s3_bucket_prefix_scan_logs   = "scanning"
  s3_bucket_prefix_install_logs = "install"
}
```

```hcl
# Option B: supply an existing bucket
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  s3_log_output_enabled = true
  bucket_id             = ["my-existing-ssm-log-bucket"]
}
```

--------------------------------

### Enable CloudWatch Logs Output for SSM Patch Manager

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Configure the module to send SSM Run Command output to CloudWatch Logs. Specify a custom log group name or let SSM auto-create one. Set `s3_log_output_enabled` to `false` if only CloudWatch logging is desired.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  cloudwatch_log_output_enabled = true
  cloudwatch_log_group_name     = "/aws/ssm/patch-manager"

  s3_log_output_enabled = false  # Disable S3 logging when using CloudWatch only
}
```

--------------------------------

### Toggle Module Creation with `enabled` Variable

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Control the creation of AWS resources managed by the module using the `enabled` variable. Setting it to `false` disables resource creation while keeping the configuration intact, useful for feature flags.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "dev"
  stage       = "primary"
  name        = "patch"

  enabled = var.enable_patch_manager  # Toggle via tfvars or workspace variable
}
```

--------------------------------

### Custom S3 Bucket Policy for SSM Logs

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Override the default S3 bucket policy for patch command output logs. Useful for configuring cross-account access or additional principals.

```hcl
data "aws_iam_policy_document" "custom_ssm_policy" {
  statement {
    effect  = "Allow"
    actions = ["s3:GetObject", "s3:PutObject", "s3:PutObjectAcl", "s3:GetEncryptionConfiguration"]
    resources = [
      "arn:aws:s3:::my-ssm-log-bucket",
      "arn:aws:s3:::my-ssm-log-bucket/*",
    ]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::123456789012:root"]
    }
  }
}

module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  bucket_id         = ["my-ssm-log-bucket"]
  ssm_bucket_policy = data.aws_iam_policy_document.custom_ssm_policy.json
}
```

--------------------------------

### SSM Patch Manager with Explicit Patches

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Overrides approval rules by explicitly listing patches to be approved or rejected. Useful for pinning specific versions or blocking problematic patches.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace        = "eg"
  environment      = "prod"
  stage            = "primary"
  name             = "patch"
  operating_system = "AMAZON_LINUX_2"

  approved_patches = ["KB4557957", "kernel-4.14.336-257.562.amzn2.x86_64"]
  rejected_patches = ["kernel-4.14.200-116.320.amzn2.x86_64"]

  approved_patches_compliance_level = "CRITICAL"
}
```

--------------------------------

### Clean Up Terraform Test Artifacts with Atmos

Source: https://github.com/cloudposse/terraform-aws-ssm-patch-manager/blob/main/README.md

Remove temporary files and artifacts generated during Terraform test runs. This command helps maintain a clean testing environment.

```bash
atmos test clean
```

--------------------------------

### Configure SNS Notifications for Patch Command Status

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Enable SNS notifications for patch command status changes. Customize notification events and type. Ensure `notification_arn` and `sns_notification_role_arn` are correctly set.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  scan_sns_notification_enabled    = true
  install_sns_notification_enabled = true

  notification_arn      = "arn:aws:sns:us-east-1:123456789012:patch-notifications"
  sns_notification_role_arn = "arn:aws:iam::123456789012:role/ssm-sns-role"
  notification_events   = ["Failed", "TimedOut"]
  notification_type     = "Invocation"
}
```

--------------------------------

### Configure Execution Throttling

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Set limits for parallel patching operations and maximum errors to control execution. 'max_concurrency' caps simultaneous patches, and 'max_errors' stops scheduling after a threshold.

```hcl
module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  max_concurrency = 10   # Patch at most 10 instances simultaneously
  max_errors      = 5    # Abort after 5 errors
}
```

--------------------------------

### Specify Maintenance Window Service Role ARN

Source: https://context7.com/cloudposse/terraform-aws-ssm-patch-manager/llms.txt

Assign a custom IAM role for SSM to assume when executing maintenance window tasks. If omitted, SSM uses its service-linked role.

```hcl
resource "aws_iam_role" "ssm_maintenance" {
  name               = "SSMMaintenanceWindowRole"
  assume_role_policy = data.aws_iam_policy_document.ssm_assume.json
}

module "ssm_patch_manager" {
  source  = "cloudposse/ssm-patch-manager/aws"
  version = "x.x.x"

  namespace   = "eg"
  environment = "prod"
  stage       = "primary"
  name        = "patch"

  service_role_arn = aws_iam_role.ssm_maintenance.arn
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.