A healthcare startup builds Docker apps on EC2 and ECS from manually patched images, causing inconsistent CIS benchmarks and vulnerable packages in production. Builds must be repeatable, tested, and patched automatically. Which hardened image approach should the platform team implement to embed security controls consistently?

EC2 Image Builder provides versioned pipelines that apply hardening components, install security agents, run CIS and vulnerability tests, and distribute approved AMIs and container images with scheduled rebuilds, which creates repeatable embedded controls across EC2 and containers. Patching live instances with Systems Manager fails by concept because it corrects drift after deployment rather than producing standardized hardened images with pre-deployment validation. Manual AMI builds with ECR replication fails by concept because hand-built images lack pipeline versioning and automated tests, so inconsistencies persist despite secure distribution. User data scripts with public registry pulls fails by concept because boot-time scripting is fragile and unverified and public images bypass supply-chain control. Exam caveat is to associate Image Builder with image tests and distribution settings versus Systems Manager for operational patching, and practical check is to review pipeline test results and confirm only latest blessed AMI IDs are allowed by policy.