PCI Requirement 6.2 calls out the need to use security patches to protect system components from known vulnerabilities and develop a risk-ranking process for patching. In an AWS environment, compliance with PCI Requirement 6.2 looks like monitoring security updates and deploying security patches on your operating systems and applications running within your EC2 instances. By utilizing Patch Manager, you can simplify compliance with this requirement. Patch Manager is a component of AWS Systems Manager that automates the security patching process for operating systems and applications. The key features of Patch Manager include:  

To learn more about automating security patching, visit the User Guide for AWS Systems Manager Patch Manager. 

The PCI Requirement 6.2 requires that you have a way in your AWS environment to protect your EC2 instances against known vulnerabilities. You have to have a way to monitor for security updates that are released for not only operating systems, but applications that you have running within your instances. By monitoring these vulnerabilities as they’re released, it’s your responsibility to evaluate the criticality of those vulnerabilities because the requirement states that anything ranked as “critical” must be applied within one month of release. Other things that are not “critical” can be applied during an appropriate, reasonable timeframe as can be determined, but typically this is considered to be done within three months. So, as you are managing your AWS EC2 instances, you would use something like AWS Systems Manager’s Patch Manager in order to manage the application of any patches that have been released. If you have a vendor or a partner who is helping you manage your AWS environment, it’s still your responsibility to ensure that they are aware of the vulnerabilities that are released and ensure that they are applying those patches in a timely fashion.