aws-RunPatchBaseline doesn´t install new packages through apt-get - amazon-web-services

Question

After running a few tests through AWS SSM Document aws-RunPatchBaseline, the content code used for Debian based OS like Ubuntu doesn´t truly install any required packages even setting this with "install" parameter and being executed. Is this something that needs to be fixed or why does this SSM document work this way without truly installing packages.
From documentation, please see below:
apt-get update downloads the package lists from the repositories and "updates" them to get information on the newest versions of packages and their dependencies. It will do this for all repositories and PPAs. From http://linux.die.net/man/8/apt-get:
Used to re-synchronize the package index files from their sources. The indexes of available packages are fetched from the location(s) specified in /etc/apt/sources.list(5). An update should always be performed before an upgrade or dist-upgrade.
apt-get upgrade will fetch new versions of packages existing on the machine if APT knows about these new versions by way of apt-get update.
From http://linux.die.net/man/8/apt-get:
Used to install the newest versions of all packages currently installed on the system from the sources enumerated in /etc/apt/sources.list(5). Packages currently installed with new versions available are retrieved and upgraded; under no circumstances are currently installed packages removed, nor are packages that are not already installed retrieved and installed. New versions of currently installed packages that cannot be upgraded without changing the install status of another package will be left at their current version. [Emphasis mine] An update must be performed first so that apt-get knows that new versions of packages are available.
Currently code content has this:
" apt-get update >/dev/null",
" fi",
"}",
¿Should I add a custom line or create a custom ssm with apt-get upgrade -y after apt-get update?, this document is supossed to work by installing packages, but so far on Ubuntu for example it just doesn´t do anything besides updating the package lists from repos (without installing any).

Answer 1

In my experience, on Ubuntu 20.04, it works. You can verify this by checking apt logs after you run AWS-RunPatchBaseline on such an instance. The logs are located in:
/var/log/apt/history.log
and
/var/log/apt/term.log
Since you have provided any details on what where your tests, which linux distribution did you use, nor provided any log output with possible errors of ssm agent or apt, it is difficult to speculate why it does not work for you.
The actual upgrade is performed by a python script, not the command you listed. You can inspect its code after you run AWS-RunPatchBaseline:
/var/log/amazon/ssm/patch-baseline-operations