You must install antivirus software on every Amazon Linux EC2 instance in an account. The solution must discover all instances and use a Systems Manager document to install the software when it’s absent. Which implementation satisfies the requirements?

The correct solution uses Systems Manager State Manager, which is designed for configuring and maintaining the desired state of instances. By creating an association targeted to all managed nodes and including the antivirus installation as a Systems Manager document, State Manager automatically ensures the software is installed on all current and future instances that meet the target criteria. AWS Config can detect non-compliance, but its remediation capabilities are better suited for simpler, more immediate fixes, not complex software installations across many instances. Amazon Inspector is for vulnerability management and compliance auditing, not for installing software. EventBridge can react to RunInstances calls, but integrating it with Inventory and then triggering a Systems Manager document for installation is overly complex and less direct than State Manager for continuous state enforcement.