A company uses AWS Organizations with separate accounts per department. They need to regularly: update Linux AMIs with patches to build a golden image, install a new Chef agent version if available into that image, and provide the new AMIs to department accounts. Which approach minimizes operational overhead?

The correct approach leverages EC2 Image Builder's automation capabilities to minimize operational overhead. Image Builder pipelines can automatically apply patches, install software like the Chef agent via components, and create new AMIs. AWS Resource Access Manager (RAM) is the native and most efficient service for sharing AMIs across accounts within an AWS Organization. The scripting option requires manual management of instances, patching, and AMI creation, increasing overhead. Systems Manager Automation runbooks can update AMIs but lack the integrated component management and pipeline features of Image Builder for building and maintaining golden images. Storing AMI IDs in Parameter Store requires department accounts to actively retrieve and use them, whereas RAM provides direct access to the shared AMI.