A CloudOps engineer needs to ensure that a specific security agent is installed and continuously running on all EC2 instances in a fleet of 200 servers. Instances are frequently launched and terminated by an Auto Scaling group. The engineer wants the configuration automatically reapplied on a recurring schedule and on newly launched instances, without manually triggering the process each time. Which AWS Systems Manager capability best meets this requirement?