A company manages multiple AWS accounts with AWS Organizations. A central account publishes base Amazon Machine Images (AMIs) for Amazon EC2. The company uses AWS Systems Manager for software inventory and patching. A security engineer needs an organization-wide solution that detects EC2 instances missing a required corporate software package and automatically installs the software when it is absent. Which approach meets these requirements?

This solution effectively detects missing software and automates installation across the organization. AWS Config's ec2-managedinstance-applications-required rule identifies instances lacking the specified software. EventBridge then triggers a Lambda function upon detection, which uses Systems Manager Run Command to install the software, ensuring compliance. Publishing new AMIs and using SCPs is a proactive measure for new instances but doesn't address existing non-compliant instances. A custom patch baseline is for patching existing software, not for installing new, required applications. Systems Manager Distributor can deploy software, but it requires a separate mechanism to detect non-compliance and trigger the installation, which AWS Config and EventBridge provide in the chosen solution.