A city web fleet must apply security baselines without SSH patching live instances. Which immutable infrastructure approach fits?

Baking golden AMIs and replacing instances through Auto Scaling instance refresh—rather than SSH patching long-lived hosts—implements immutable infrastructure for a city web fleet that must apply security baselines consistently. The approach works because a verified AMI captures OS packages, agents, and hardening once; Auto Scaling then terminates and launches instances from that AMI so every host matches the baseline. Instance refresh (or blue/green replacement) rolls the fleet without snowflake configuration drift from ad-hoc SSH sessions. For municipal compliance, the golden image becomes the auditable artifact, and recovery simply launches more of the same known-good build.

SSH into each production instance nightly to apply packages in place with no AMI updates fails by concept because in-place mutation creates drift, unreproducible state, and weak disaster recovery when you cannot recreate what was patched by hand. Disabling Auto Scaling and keeping one hand-managed EC2 instance patched by console clicks fails because a single mutable host is both an availability and configuration-integrity risk. Storing OS packages only in S3 and hoping running instances self-update without a launch template change fails because hope is not a controlled rollout mechanism; without AMI/launch-template updates and replacement, fleets diverge silently.

Exam caveat: immutable replacement still needs careful userdata/secrets injection and session draining so citizen traffic is not cut mid-request during refresh. Operational check: pipeline AMI builds on CIS/baseline changes, update the launch template, run instance refresh in waves, and verify SSM inventory shows uniform AMI IDs across the web Auto Scaling group.