When running MarkLogic Server on Amazon Linux 2023 (AL2023) AMIs, users may need to automate operating system security updates and ensure patch compliance across their deployments.

Unlike Amazon Linux 2, AL2023 uses a deterministic update model that does not automatically apply updates when instances are launched.

This article describes how to automate patch management and compliance monitoring for MarkLogic environments using AWS Systems Manager Patch Manager and Compliance tools.

MarkLogic AMIs built on Amazon Linux 2023 are version-locked at the time of image creation. This ensures consistent environments for MarkLogic clusters but requires administrators to explicitly manage or schedule OS updates.

Using AWS Systems Manager, users can:

• Automate patching across all MarkLogic nodes.

• Maintain update consistency across clustered deployments.

• Monitor patch compliance and security posture centrally.

Amazon Linux 2023 AMIs are version-locked at the time of creation. This ensures consistency across deployments but prevents automatic installation of newer packages or security patches unless explicitly configured.

1. Schedule Regular Security Updates Using AWS Systems Manager Patch Manager

AWS Systems Manager Patch Manager automates the process of applying OS updates, including security patches, to Amazon EC2 instances running MarkLogic on AL2023.

It is recommended to schedule patching operations during planned MarkLogic maintenance windows to avoid service interruption.

Step 1: Ensure Prerequisites

Before configuring automated patching, verify:

• SSM Agent is installed and running on all MarkLogic nodes.
• Instances have internet access or configured VPC endpoints for Systems Manager.
• Instances are assigned an IAM role with sufficient SSM and EC2 permissions.

For reference, see Patch Manager prerequisites.

Step 2: Create a Patch Baseline

1. Open AWS Systems Manager Console → Patch Manager → Create patch baseline.
2. Configure the following:
   • Name: MarkLogic-AL2023-Security-Updates
   • Operating System: Amazon Linux 2023
   • Include: Security updates (Critical/Important)
   • Auto-approval delay: (e.g., 7 days for staged rollout testing)

Step 3: Set Up Patch Groups

1. Tag your MarkLogic instances with a Patch Group tag (for example, marklogic-prod or marklogic-dev).
2. Associate this patch group with the created patch baseline:
   Actions → Modify patch groups.

Tip: For MarkLogic clusters, use consistent patch group tagging across all nodes to ensure synchronized OS update behavior.

Step 4: Create a Maintenance Window

1. Navigate to Systems Manager → Maintenance Windows → Create maintenance window.
2. Configure schedule details:
   • Name: MarkLogic-Weekly-Security-Updates
   • Schedule:  0 0 23 ? * SUN *  (Every Sunday at 11 PM local time)
   • Duration: 2 hours
   • Time zone: Set according to your deployment region

Schedule the maintenance window during a MarkLogic cluster maintenance period to minimize downtime or rebalancing overhead.

Step 5: Register Targets and Tasks

• Register target instances using the Patch Group tag.
• Create a new patch task:
  • Document: AWS-RunPatchBaseline
  • Priority: 1
  • Targets: MarkLogic node patch group

Step 6: Monitor and Verify

• Check Patch Manager → Compliance to verify patch completion.
• Review Maintenance Window execution history for success or failure logs.

Step 7: Review and Adjust

• Evaluate patching results and adjust schedules as necessary.
• Update patch baselines if AWS releases new AL2023 patch levels.
• Test new AL2023 versions in a MarkLogic staging environment before applying in production.

Best Practices for MarkLogic Environments

• Testing: Apply updates to a non-production cluster first to validate stability.
• Backups: Create MarkLogic forest and configuration backups or EBS snapshots before applying updates.
• Consistency: Ensure all cluster nodes are on the same AL2023 release to maintain compatibility.

For more details, see Creating and managing maintenance windows.

2. Set Up Monitoring for Security Update Compliance

AWS Systems Manager Compliance provides centralized monitoring of patch compliance across managed MarkLogic nodes.

Step 1: Configure Compliance

• Open Systems Manager → Compliance.
• Review compliance status by patch baseline and patch group.
• Identify nodes with missing security updates.

Step 2: Monitor Compliance Reports

• Use the Compliance Dashboard to view summary data for MarkLogic instances.
• Schedule regular reviews of compliance status across regions and environments.

Step 3: Remediate Non-Compliant Instances

• Use Run Command → AWS-RunPatchBaseline to apply missing patches.
• Verify that compliance status updates after remediation.

Step 4: Continuous Monitoring and Integration

• Enable automated patching through Maintenance Windows.
• Configure CloudWatch Logs for patch execution tracking.
• Use AWS Security Hub to aggregate patch and compliance data across all MarkLogic deployments.

For more information, see Compliance Overview.

If Systems Manager automation is unavailable, users can manually update the AL2023 OS on MarkLogic instances using DNF commands:

dnf check-update
dnf upgrade --security

Manual updates should be performed during MarkLogic maintenance windows to avoid data rebalancing or node failover.

References to Other Documentation: 

MarkLogic on AWS Overview 

https://docs.progress.com/bundle/marklogic-server-on-aws-12/page/topics/overview-of-marklogic-server-on-aws.html

MarkLogic Support Matrix 

https://developer.marklogic.com/products/support-matrix/

AWS Systems Manager Patch Manager

https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html

Patch Manager Prerequisites

https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-prerequisites.html

Create and Manage Maintenance Windows

https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-working.html

Quick Setup Patch Policy Configuration

https://docs.aws.amazon.com/systems-manager/latest/userguide/quick-setup-patch-manager.html

Compliance Overview

https://docs.aws.amazon.com/systems-manager/latest/userguide/compliance-about.html