A cloud engineering team plans to deploy a fleet of identical Linux web servers using an auto-scaling group that launches new instances from a single base machine image whenever load increases. The security team is asked to make a recommendation that ensures every newly launched instance already meets the organization's security standard the moment it comes online, without manual intervention after boot. Which recommendation best meets this need?