A company must continuously keep Amazon Linux EC2 instances compliant with OS and application patches; application patches are stored in a custom repository. The engineer wants to automate patching using both the default OS repository and the custom repository with minimal effort. Which solution meets this need?

The correct answer leverages AWS Systems Manager Patch Manager, which is designed for this exact scenario. You can create a custom patch baseline that specifies both the default OS repositories and your custom application repositories. The AWS-RunPatchBaseline document, executed via Run Command, then uses this combined baseline to scan and install patches from all specified sources. The BaselineOverride API is not directly used to apply the baseline; rather, the patch baseline is associated with the instances or instance groups within Patch Manager itself, or specified as an override parameter when running AWS-RunPatchBaseline. Incorrect options: AWS Direct Connect is for network connectivity, not for managing software repositories or patching. Amazon EventBridge can trigger actions but doesn't handle the patching logic itself. While yum-config-manager is used to configure repositories on Linux, this option describes a manual, per-instance configuration, not an automated, scalable solution for continuous compliance across many instances. Creating two separate patch baselines and trying to combine them with BaselineOverride is not how Patch Manager works. A single patch baseline can define multiple repository configurations.