A Patch Baseline That Says It Patches Nothing By Itself
An OOS patch baseline: which updates are acceptable on one operating system. A baseline is a policy and an OOS task has to run it, which the module reports rather than letting the word imply a schedule. ALLOW_AS_DEPENDENCY makes a rejection advisory - the patch installs anyway when something approved needs it - so BLOCK is the default.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-15 · how we verify
Use it from the registry
terraform · opentofumodule "patch_manager" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-patch-manager/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-patch-manager
A patch baseline on Alibaba Cloud OOS. Works with Terraform and OpenTofu
(>= 1.6), alicloud provider >= 1.0, < 2.0.
A baseline patches nothing. It is the policy for which updates are acceptable; an OOS patch task or maintenance window has to run against it. patches_anything_on_its_own says false so the word baseline does not imply a schedule.
ALLOW_AS_DEPENDENCY makes a rejection advisory. A patch on the rejected list still installs whenever something approved depends on it, and nothing reports that your exclusion was overridden. The module defaults to BLOCK and asks before the other, and rejections_are_enforced reports which you got.
approval_rules is JSON that Terraform cannot read. It is the actual policy - how many days after release, which severities, which product - and a rule broader than you meant auto-approves things nobody reviewed. The module checks it parses and counts the rules; it cannot check they say what you intended.
One baseline is one operating system, and operation_system is ForceNew - a mixed fleet needs one baseline each.
Approving non-security updates is a separate switch, off by default, because a baseline that quietly covers ordinary updates is not what most people think they configured.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-image
An Alibaba Cloud custom image captured from an ECS instance into an image family, so instances and scaling groups that name the family get the newest image (no family has to be accepted by name). The snapshots the capture created are deleted with the image. Build the source clean and stop it first.
alicloud-ecs-instance
An ECS instance in your vSwitch with login by key pair and no password, no public address unless bandwidth above zero is accepted by name, the system disk encrypted with your KMS key (the service key by name), the metadata service on IMDSv2 only with a hop limit of one, the Security Center agent on, and deletion protection. Pay-as-you-go.
aws-ssm-patch-manager
A patch baseline that approves security patches after a delay, the patch group that binds instances to it by tag, and a maintenance window that runs AWS-RunPatchBaseline on a schedule with the output in CloudWatch. Install rather than Scan (scan-only by name), RebootIfNeeded, and unapproved security updates counted as non-compliant so the approval delay shows on the dashboard.
gcp-os-config-patch
An instance filter that matches nothing patches nothing - the deployment runs on schedule, reports success and touches no host - and reboot_config NEVER installs the kernel and keeps running the old one. Refuses an empty filter, makes all-instances a stated choice because it includes the databases, reboots when the packages need it, and caps the share of a zone patched at once.
azure-update-manager
A maintenance configuration is a schedule and a filter; a machine follows it only through an assignment, and one with no assignment appears scheduled and touches no host. reboot Never installs the kernel and runs the old one; a VM on image-default patching is assigned and skipped. Machines or a dynamic scope come with it; IfRequired reboots; the patch mode every VM needs is an output.
oci-os-management-patching
An OS Management Hub scheduled job that installs every available update (security-only and the other partial operations by name) on the managed instance groups or compartments you name, weekly by an RRULE from a first run you set in the future, with a reboot window per instance and retries. Instances have to run the agent and be registered with a software source to be seen.