A company runs a critical application on Amazon EC2 instances.

The key requirements are daily patching, zero downtime, and least operational overhead. The most operationally efficient way to achieve frequent patch compliance in an Auto Scaling environment is to adopt an immutable infrastructure approach: bake patches into a new AMI and then roll the fleet to that AMI in a controlled, health-checked manner. AWS Systems Manager Automation can orchestrate patching steps reliably and repeatedly, producing a patched AMI on a schedule without engineers manually logging into instances. After the AMI is created, updating the Auto Scaling group launch template ensures that all newly launched instances use the patched image.

Auto Scaling instance refresh then performs the rollout across the group with guardrails: it replaces instances gradually, can respect minimum healthy percentages, and works with load balancer health checks so traffic remains served while instances are rotated. This satisfies “no downtime” because capacity stays available and requests are routed only to healthy instances during the replacement process.

Option B introduces unnecessary complexity by combining CloudFormation provisioning with patching and then relying on AWS Config to replace instances. AWS Config is a compliance and configuration tracking service, not a primary fleet-replacement mechanism for daily patching. Option C increases operational overhead by requiring custom Lambda logic and manual initiation of the rolling update, which is explicitly more work and more error-prone than a managed instance refresh workflow. Option D again uses AWS Config to replace instances, which does not align well with least overhead or the standard operational model for controlled rolling updates in Auto Scaling groups.

Therefore, the lowest-overhead, highly reliable solution is to use Systems Manager Automation to create a patched AMI, update the launch template, and run an Auto Scaling instance refresh.

=================