You are currently viewing How To Create AWS SSM Maintenance Windows

How To Create AWS SSM Maintenance Windows

How To Create AWS SSM Maintenance Windows

Hello Everyone

Welcome to CloudAffaire and this is Debjeet.

In the last blog post, we have discussed how to create AWS SSM Automation workflow.

In this blog post, we will discuss how to create AWS SSM Maintenance Windows.

What Is AWS SSM Maintenance Windows:

AWS Systems Manager Maintenance Windows let you define a schedule for when to perform potentially disruptive actions on your instances such as patching an operating system, updating drivers, or installing software or patches. Maintenance Windows also lets you schedule actions on numerous other AWS resource types, such as S3 buckets, SQS queues, KMS keys, and many more.

Each maintenance window has a schedule, a maximum duration, a set of registered targets, and a set of registered tasks. You can add tags to your maintenance windows when you create or update them. You can also specify dates that a maintenance window should not run before or after, and you can specify the international time zone on which to base the maintenance window schedule.

SSM Maintenance Windows Schedule:

When you create an AWS Systems Manager maintenance window or a State Manager association, you specify a schedule for when the window or the association should run. You can specify a schedule as either a time-based entry, called a cron expression, or a frequency-based entry, called a rate expression.

Cron Expression:

Cron expressions for Systems Manager have six required fields. A seventh field, the Seconds field (the first in a cron expression), is optional. Fields are separated by a space.

cron(Seconds Minutes Hours Day_of_month Month Day_of_week Year)

Supported Values:

Field Values Wildcards
Minutes 0-59 , – * /
Hours 0-23 , – * /
Day_of_month 1-31 , – * ? / L W
Month 1-12 or JAN-DEC , – * /
Day_of_week 1-7 or SUN-SAT , – * ? / L
Year 1970-2199 , – * /

Supported Wildcards:

Wildcard Description
, The , (comma) wildcard includes additional values. In the Month field, JAN,FEB,MAR would include January, February, and March.
The – (dash) wildcard specifies ranges. In the Day field, 1-15 would include days 1 through 15 of the specified month.
* The * (asterisk) wildcard includes all values in the field. In the Hours field, * would include every hour.
/ The / (forward slash) wildcard specifies increments. In the Minutes field, you could enter 1/10 to specify every tenth minute, starting from the first minute of the hour. So 1/10 specifies the first, 11th, 21st, and 31st minute, and so on.
? The ? (question mark) wildcard specifies one or another. In the Day-of-month field you could enter 7 and if you didn’t care what day of the week the 7th was, you could enter ? in the Day-of-week field.
L The L wildcard in the Day-of-month or Day-of-week fields specifies the last day of the month or week.
W The W wildcard in the Day-of-month field specifies a weekday. In the Day-of-month field, 3W specifies the day closest to the third weekday of the month.

Note: You cannot specify a value in the Day-of-month and in the Day-of-week fields in the same cron expression. The time is in UTC format.

Rate Expression:

Rate expressions have two fields, Value, and Unit. The value field is any positive number and the Unit field is either in minutes or hours or days.

rate(Value Unit)

Supported Values:

Field Values
Value positive number, such as 1 or 15
Unit minute


AWS SSM Maintenance Window Registered Task:

Tasks are the actions (Registered Tasks) performed on a resource (Registered Targets) during a maintenance window (Schedule) execution. Once you create a maintenance window by defining a schedule, you need to register one task to the maintenance windows which defined the actual action the maintenance will perform during its schedule execution. AWS SSM Maintenance Windows support below four type of tasks

  • Systems Manager Run Command commands
  • Systems Manager Automation workflows
  • AWS Lambda functions
  • AWS Step Functions tasks

AWS SSM Maintenance Window Registered Target:

Apart from a schedule and a task, you also need to define the target for your maintenance windows. The maintenance windows target can be an EC2 instance or an AWS Resource Group. You can register a target to the maintenance window by specifying your instance tags or selecting your instance manually or selecting a resource group.

How To Create AWS SSM Maintenance Windows:


AWS CLI installed and configured. You can follow the below blog post to install and configure AWS CLI.

Step 1: Create an EC2 SSM Managed Instance.

Step 2: Create a new SSM Maintenance Window.

Step 3: Register a new target to the SSM Maintenance Window.

Step 4: Register a new task for the SSM Maintenance Window.

Step 5: Update the SSM Maintenance Window Schedule.

Step 6: Get the Maintenance Window execution data.

Step 7: Cleanup.

Hope you have enjoyed this blog post, to get more details on AWS SSM, please refer below AWS documentation


Leave a Reply