AWS Automated Vulnerability Remediation System
Event-driven patching pipeline that turns AWS Inspector findings into applied fixes, with per-instance locking, pre-patch health checks, and automatic snapshots so nothing gets touched without consent.
The obvious Inspector, EventBridge, SSM pattern breaks the moment Inspector reports 15 findings on one instance and fires 15 EventBridge events at once. The first patch starts, the instance reboots, and the other fourteen operations race each other into partial patches and broken services.
I put a DynamoDB conditional-write lock in front of SSM so only the first vulnerability for an instance wins the patch run and the rest queue behind it. Around that: pre-patch health checks via SSM Run Command, automatic EBS snapshots before each run, a 2-6 AM UTC maintenance window, VPC endpoints so the Lambdas never touch the public internet, and an AutoPatch=true tag opt-in so nothing gets patched without consent.
Security automation that can break production creates more risk than it removes.
Patching runs itself inside the maintenance window without stepping on itself, and instances that fail a pre-patch check surface as alerts instead of half-patched boxes.
- DynamoDB conditional writes serialize overlapping Inspector findings per instance
- Pre-patch SSM health checks and EBS snapshots gate every run
- AutoPatch=true tag opt-in prevents any instance being touched by accident