For patch management particularly with EC2s, we use AWS Systems Manager Patch Manager.... fairly straightforward to setup once you configure a base image

obviously, it's not cloud-native... but if you are using AWS EC2 it works