Nimbus Retail needs to patch 500 Amazon Linux and Windows EC2 instances across Dev and Prod. Requirements: Dev auto-approves all security patches immediately; Prod auto-approves only Critical/Important patches after 7 days and excludes kernel packages; Instances are targeted by tags; Compliance must be reported centrally. What is the BEST configuration?

This option correctly leverages AWS Systems Manager Patch Manager capabilities. Creating separate patch baselines for Dev and Prod allows for distinct auto-approval rules (immediate for Dev, 7-day delay for Prod Critical/Important, and kernel exclusion for Prod). Tagging instances and associating these tags with specific patch baselines (Patch Groups) ensures the correct baseline is applied to the right environment. Using Maintenance Windows schedules the patching process, and Patch Compliance reports provide central visibility. Using Amazon Inspector is incorrect because it is a vulnerability scanning service, not a patching service. A single default Patch Baseline is insufficient as it cannot differentiate between Dev and Prod requirements, and excluding kernel packages via Run Command parameters is not how baselines are configured for this level of granularity. Building a CodePipeline with shell scripts is overly complex, less robust, and lacks integrated compliance reporting compared to Patch Manager.