A CloudOps engineer manages a fleet of 200 EC2 instances that run a monitoring agent. The security team requires that the agent's configuration file always match an approved baseline. Occasionally, administrators manually edit the file during troubleshooting, causing configuration drift that goes unnoticed for weeks. The engineer needs an automated, ongoing mechanism that continuously reapplies the approved configuration to all current and future instances without manual intervention. Which AWS Systems Manager capability best meets this requirement?