A company is using AWS Organizations. They want to ensure that any new EC2 instance launched in any account automatically has the AWS Systems Manager (SSM) Agent installed and is managed by SSM. They also want to automatically apply critical OS patches every weekend. What is the MOST operationally efficient way to achieve this?

Create a custom AMI with the SSM Agent installed. Enforce its use via SCP.

Use Default Host Management Configuration (DHMC) in Systems Manager to automatically manage all instances. Configure SSM Patch Manager with a maintenance window.

Deploy an AWS Config rule to detect unmanaged instances and trigger a Lambda function to attach an IAM role.

Use AWS CloudFormation StackSets to deploy an IAM instance profile to all accounts and attach it manually to instances.