A fleet of managed EC2 Linux instances must receive approved operating-system patches during a weekly maintenance window. The team also needs patch compliance reporting. Which combination is the best fit?

1. Use a baseline but omit any scheduled execution, expecting baseline creation to patch every instance.
2. Run a Patch Manager scan only and treat a compliance report as proof that missing patches were installed.
3. Reboot every instance weekly without invoking a patch-management operation.
4. Use Systems Manager Patch Manager with a patch baseline and schedule patch installation through a Maintenance Window.