> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Beanstalk managed platform updates remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure Managed Platform Updates Are Enabled For Elastic Beanstalk Environment" in AWS using AWS console, follow the below steps:

        1. Login to AWS Management Console.
        2. Navigate to Elastic Beanstalk service.
        3. Select the environment for which you want to enable the managed platform updates.
        4. Click on the "Configuration" option from the left-hand menu.
        5. Scroll down to the "Managed platform updates" section and click on "Edit".
        6. Select the "Enable managed platform updates" checkbox.
        7. Choose the "All platform updates" option from the dropdown.
        8. Click on the "Apply" button to save the changes.
        9. Wait for the environment to update with the latest platform version.

        By following the above steps, you will be able to remediate the misconfiguration "Ensure Managed Platform Updates Are Enabled For Elastic Beanstalk Environment" for AWS using AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure Managed Platform Updates Are Enabled For Elastic Beanstalk Environment" for AWS using AWS CLI, follow the below steps:

        1. Open the terminal and install the AWS CLI if it is not already installed.

        2. Configure the AWS CLI using the `aws configure` command by providing the Access Key ID, Secret Access Key, Default region name, and output format.

        3. Execute the below command to enable managed platform updates for the Elastic Beanstalk environment:

        ```
        aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:managedactions,OptionName=ManagedActionsEnabled,Value=true
        ```

        Note: Replace `<environment-name>` with the name of the Elastic Beanstalk environment for which you want to enable managed platform updates.

        4. Verify the changes by executing the below command:

        ```
        aws elasticbeanstalk describe-environments --environment-names <environment-name> --query "Environments[*].OptionSettings[?Namespace=='aws:elasticbeanstalk:managedactions' && OptionName=='ManagedActionsEnabled'].Value" --output text
        ```

        Note: Replace `<environment-name>` with the name of the Elastic Beanstalk environment for which you have enabled managed platform updates.

        The output of the above command should be `true`, which indicates that managed platform updates are enabled for the Elastic Beanstalk environment.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure Managed Platform Updates Are Enabled For Elastic Beanstalk Environment" for AWS using Python, you can use the AWS SDK for Python (Boto3) to enable managed platform updates for your Elastic Beanstalk environment. Here are the step-by-step instructions:

        1. Install Boto3:

        ```
        pip install boto3
        ```

        2. Import the Boto3 library and create an Elastic Beanstalk client:

        ```
        import boto3

        eb_client = boto3.client('elasticbeanstalk')
        ```

        3. Retrieve the list of environments in your account:

        ```
        response = eb_client.describe_environments()
        environments = response['Environments']
        ```

        4. Loop through the list of environments and enable managed platform updates for each one:

        ```
        for environment in environments:
            environment_name = environment['EnvironmentName']
            environment_id = environment['EnvironmentId']
            environment_settings = eb_client.describe_configuration_settings(
                ApplicationName='your_application_name',
                EnvironmentName=environment_name
            )
            for setting in environment_settings['ConfigurationSettings'][0]['OptionSettings']:
                if setting['OptionName'] == 'ManagedActionsEnabled':
                    if setting['Value'] == 'false':
                        eb_client.update_environment(
                            EnvironmentId=environment_id,
                            OptionSettings=[
                                {
                                    'Namespace': 'aws:elasticbeanstalk:managedactions',
                                    'OptionName': 'ManagedActionsEnabled',
                                    'Value': 'true'
                                }
                            ]
                        )
                        print(f"Managed platform updates enabled for environment {environment_name}")
        ```

        This code will loop through all the Elastic Beanstalk environments in your account, check if managed platform updates are already enabled, and enable them if they are not. Note that you will need to replace `your_application_name` with the name of your Elastic Beanstalk application.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_elastic_beanstalk_environment" "EB_ENVIRONMENT" {
          name                = "ENVIRONMENT_NAME"          # e.g. "my-app-prod"
          application         = aws_elastic_beanstalk_application.EB_APP.name
          solution_stack_name = "SOLUTION_STACK_NAME"       # e.g. "64bit Amazon Linux 2 v3.6.2 running Docker"

          # ...any other existing settings...

          # Enable managed platform updates (immutable updates)
          setting {
            namespace = "aws:elasticbeanstalk:managedactions"
            name      = "ManagedActionsEnabled"
            value     = "true"
          }

          # Apply minor (and patch) platform updates automatically
          setting {
            namespace = "aws:elasticbeanstalk:managedactions"
            name      = "UpdateLevel"
            value     = "minor"
          }

          # Preferred maintenance window for managed updates (UTC, Day:HH:MM)
          setting {
            namespace = "aws:elasticbeanstalk:managedactions"
            name      = "PreferredStartTime"
            value     = "Sun:10:00" # CHANGE to your maintenance window
          }
        }

        resource "aws_elastic_beanstalk_application" "EB_APP" {
          name        = "APP_NAME"                         # e.g. "my-app"
          description = "DESCRIPTION_OF_APP"
        }
        ```

        Updating these `setting` blocks changes the environment in place (no Terraform resource replacement), but AWS will perform an environment update which may cause downtime depending on your deployment policy.

        Verification: `terraform plan` should show `setting` entries being added or updated with `namespace = "aws:elasticbeanstalk:managedactions"` and `name`/`value` pairs `ManagedActionsEnabled = true`, `UpdateLevel = minor`, and `PreferredStartTime = Sun:10:00` for the target environment.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>