A library still patches a tagged Linux fleet by copying one SSH script onto every instance. Patching should run only inside an approved window and should select instances by tag. Which approach meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
A shared SSH script is one person walking the halls with a toolbox. You want a crew that shows up on a schedule and only visits machines with the right tag. Patch Manager, a baseline, and a maintenance window are that crew.
Full Explanation
Patch Manager applies a patch baseline to instances, and a maintenance window runs that work on a schedule you define. Targeting the window by tag selects the fleet without a shared SSH script or a copied key. That satisfies both constraints: an approved window, and selection by tag. A bastion cron that pushes one SSH script still depends on inbound SSH, a shared credential, and a bastion that has to be up. It is the process being replaced. Baking a new AMI each night can roll a patched image forward, and it does not patch the running tagged fleet inside a window. Opening port 22 so a laptop can push the script publishes SSH and still has no maintenance window. Caveat: the instances need the Systems Manager agent and an instance profile that allows patching, or the window will list targets it cannot reach. A scan alone shows missing patches. The maintenance window is what installs them during the approved hours. Operational check: run the window once in a test account and confirm the execution targeted the tag and the instances report compliant with the baseline.