Ask HN: Recommended way of doing patch management

I have a few hundred EC2 servers running. How do I do patch management across those servers? I am looking for an alternative to AWS Systems Manager. I also am looking for a way to execute other commands in these instances at scale (updating firewall rules for example). Is ansible a good tool for this?