Install and use an OS-native patching service to manage the update frequency and release approval for all instances.

Use AWS Config to verify the OS state on each instance and report on any patch compliance issues.

Use AWS Systems Manager on all instances to manage patching. Test patches outside of production and then deploy

during a maintenance window with the appropriate approval.

Use AWS OpsWorks for Chef Automate to run a set of scripts that will iterate through all instances of a given type.

Issue the appropriate OS command to get and install updates on each instance, including any required restarts during the

maintenance window.

Migrate all applications to AWS OpsWorks and use OpsWorks automatic patching support to keep the OS up-to-date

following the initial installation. Use AWS Config to provide audit and compliance reporting.