A company runs a fleet of 200 EC2 instances across multiple accounts. The operations team wants a managed service to automate operating system patching, run commands remotely, and store configuration parameters without installing third-party tools. Which AWS service should they use?