aws_ssm_patch_baseline cost estimation
An SSM patch baseline is free. It defines which patches are approved for your fleet, and cost comes from the instances that run the patching, not the baseline.
An aws_ssm_patch_baseline defines the rules that decide which patches are approved for a group of instances: approval rules by classification and severity, auto-approval delays, and explicit approve or reject lists. The baseline is free. There is no charge for defining it, for the number of baselines, or for the approval rules inside it. It is a policy document that Patch Manager consults; it has no meter.
The cost, such as it is, comes from applying the baseline, and it is mostly cost you already carry. Patch Manager runs through Run Command on your managed EC2 instances, which is free, so the patching operation uses compute on boxes you already rent by the hour rather than adding a new charge. The places cost can appear are indirect: scanning and installing patches uses instance CPU and can briefly raise utilization, patches are downloaded (from within AWS this is generally free), and if you patch hybrid on-premises servers on the advanced-instances tier, that tier bills per instance-hour. The baseline decides what gets patched; the instances are where any real cost sits.
There is nothing to optimize on the baseline itself. The useful practice is to scope baselines to patch groups so the right instances get the right approval rules, and to schedule patching in a tight maintenance window so it does not run longer than needed. c3x prices the instances patching runs on and any advanced-tier hybrid usage, and treats the patch baseline as the free policy it is.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_ssm_patch_baseline" "linux" {
name = "prod-linux-baseline"
operating_system = "AMAZON_LINUX_2"
approval_rule {
approve_after_days = 7
patch_filter {
key = "CLASSIFICATION"
values = ["Security", "Bugfix"]
}
patch_filter {
key = "SEVERITY"
values = ["Critical", "Important"]
}
}
}Pricing dimensions
What you actually pay for when you provision aws_ssm_patch_baseline.
| Dimension | Unit | What's being charged |
|---|---|---|
| Patch baseline | free | Defining a baseline, its approval rules, and patch groups has no charge. $0 |
| Instance patching | per instance-hour (already billed) | Patch Manager runs via Run Command on EC2 instances you already pay for by the hour; the action is free. Run Command: $0 |
| Advanced hybrid instances | per instance-hour | Patching on-premises servers on the advanced-instances tier is billed per managed instance per hour. ~$0.00695/hour per instance |
Optimization tips
Common ways to reduce aws_ssm_patch_baseline cost without changing the workload.
Scope baselines to patch groups
Assigning baselines to patch groups by tag ensures the right instances get the right approval rules, avoiding unnecessary patch installs and the compute they use on the wrong hosts.
Patch inside a tight maintenance window
Scheduling patching in a short SSM maintenance window keeps the operation from running long on your instances and bounds any Automation steps the run invokes.
Prefer standard managed instances
Avoids advanced-tier per-instance-hour chargesPatch Manager on standard EC2 managed instances is free. The advanced-instances tier for hybrid on-premises servers bills per hour, so use it only where you must patch non-EC2 hosts.
FAQ
Does an SSM patch baseline cost money?
No. Defining a patch baseline and its approval rules is free, and running patching through Run Command on managed EC2 instances is free too. The patching just uses compute on instances you already pay for.
What does patching actually cost?
On EC2, effectively nothing beyond the instance hours you already pay: Run Command is free and patch downloads within AWS are generally free. Cost appears only on the advanced-instances tier for hybrid on-premises servers, billed per instance-hour.
How do I patch a fleet without extra cost?
Scope baselines to patch groups so only the right instances patch, schedule runs in a tight maintenance window, and keep hosts on the standard managed-instances tier rather than the paid advanced hybrid tier.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_ssm_patch_baseline.