(Execution Timeout) Boto3 register_task_with_maintenance_window

Question

I am currently using an AWS Lambda to initiate a maintenance window, but have found that the Execution Timeout is default set to 3600 (1hour), when this is used on a larger scale 1 hour tends to drag on a bit. I am attempted to lower the timeout to 900 (15mins), but although executionTimeout: ["900"] is accepted when I run the lambda, The maintenance window is created and I get the error in the execution tasks: FAILED: "The specified parameters are incomplete or invalid."

here is the snippet of code I am attempting:

        reg_taskmw_res = ssm_client.register_task_with_maintenance_window(
    WindowId=window_id,
    Targets=[
        {
            'Key': 'WindowTargetIds',
            'Values': [
                reg_targetmw_res['WindowTargetId']
            ]
        },
    ],
    TaskArn='AWS-RunPatchBaseline',
    TaskType='RUN_COMMAND',

    TaskInvocationParameters={
        'RunCommand': {
            'DocumentHash': DocHash,
            'DocumentHashType': 'Sha256',
            'Parameters': {
                'Operation': ['Scan'],
                'executionTimeout': ['900']
                },
            'TimeoutSeconds': 60
            },
        },
    Priority=123,
    MaxConcurrency='3',
    MaxErrors='3'
)

If I don't use the executionTimeout the maintenance window works, but with a 3600 timeout. I have tried multiple ways of doing this and search for ages to no avail. Thanks for all your help!

Shawn · Accepted Answer · 2019-12-03T17:59:25.107

It turns out the built-in AWS-RunPatchBaseline document doesn't allow you to configure a custom execution timeout at this time (surprisingly). The timeout it does allow you to configure is the delivery timeout, but the execution timeout is hard coded and you can't alter it. So to use a different execution timeout, you have to make your own custom document which allows you to set this. I asked the same question to AWS support and got this answer:

The AWS-provided AWS-RunPatchBaseline document doesn't have executionTimeout built-in as a configurable parameter, and is hardcoded with 7200 minutes:

[AWS-RunPatchBaseline ## Line 34-37 ##] "action": "aws:runPowerShellScript", "name": "PatchWindows", "inputs": { "timeoutSeconds": 7200,

What you can do here is create your own custom document and add the parameter yourself, which will allow you to configure an Execution Timeout in addition to the Delivery Timeout which is what the console entry is used for. To do this, you can create a new custom document based on the existing one [1], then add the following modifications:

Insert this at line 5:
  "executionTimeout": {
  "type": "String",
  "default": "900",
  "description": "(Optional) The time in seconds for a command to complete before it is considered to have failed. Default is 900 (15 mins). Maximum is 172800 (48 hours).",
  "allowedPattern": "([1-9][0-9]{0,4})|(1[0-6][0-9]{4})|(17[0-1][0-9]{3})|(172[0-7][0-9]{2})|(172800)"
},
Replace the timeoutSeconds input:

Existing:
  "action": "aws:runPowerShellScript",
  "name": "PatchWindows",
  "inputs": {
    "timeoutSeconds": 7200,
New
  "action": "aws:runPowerShellScript",
  "name": "PatchWindows",
  "inputs": {
    "timeoutSeconds": "{{executionTimeout}}",
I tested this and it accepts the executionTimeout parameter. I hope this helps!

References: [1] Copy a Document - https://docs.aws.amazon.com/systems-manager/latest/userguide/copy-document.html

I thought that might be the case, and have done this. But I was unsure of how this may be in future updates to the document. Incase AWS change the original AWS-RunPatchBaseline. I suppose by then Id hope they add in the ability to change the executionTimout with a parameter. Thanks for your help Shawn, saved me the time in trying to relocate where I need to put everything! (and confirm I was doing the right thing!) Best Regards, Gary. — Gary A, Dec 04 '19 at 11:18
Just incase anyone else comes across this: - There is two sections, one for windows one for linux. - You can leave the default to 7200 if you wish, as the method Shawn has given, allows you to add the parameter to your lambda to change what you want. (This has to be under TaskInvocationParameters -> RunCommand -> Parameters, its the same place as Operation: ['Install']) - Lastly for those wanting to INCREASE the time, this is also possible up to 172800 (I believe) I hope this helps people as much as it did me! Once again, thanks @Shawn — Gary A, Dec 04 '19 at 11:56

(Execution Timeout) Boto3 register_task_with_maintenance_window

1 Answers1

Insert this at line 5:

Replace the timeoutSeconds input:

Existing:

New