A security-hardened AMI pipeline is built with EC2 Image Builder on a recurring schedule. The DevOps engineer needs Auto Scaling groups to always launch instances with the newest AMI and to update launch templates accordingly. Which approach gives the most operational efficiency?

The most operationally efficient approach is to leverage AWS Image Builder's native integration with EC2 Launch Templates. By configuring Image Builder distribution settings to update launch templates with the latest AMI ID, you automate the entire process. Auto Scaling groups can then be configured to always use the newest version of the launch template, ensuring they launch instances with the most current AMI without manual intervention or custom code. The other options involve creating custom EventBridge rules and Lambda functions or SSM Run Command documents, which add unnecessary complexity and maintenance overhead. While functional, they require more development and management than using Image Builder's built-in capabilities. Storing the AMI ID in Parameter Store and updating it via Image Builder is a viable option but still requires configuring the launch template to reference Parameter Store, adding a layer of indirection compared to direct launch template updates by Image Builder.