dan-farmer / ssm-patching-setup Goto Github PK

At the moment, ssm_patching_cleanup.py only checks whether a Patch Baseline is set as default, and attempts to delete it if not. In situations where a custom baseline has been created and set as default, one or more of the AWS-managed baselines will be set as "DefaultBaseline": false. The script will attempt to delete it and fail (because it is owned by another account).

Cleanup should therefore also check owner of the baseline before attempting deletion. On a quick first look, it seems this is only available by string matching in the BaselineId (e.g. pb-00123456789abcdef vs arn:aws:ssm:eu-central-1:416089608788:patchbaseline/pb-0f40e1898bd7e2eca).