You create a “maintenance window” resource You attach targets You schedule tasks (RunDocument, automation, lambda, step functions) You’ll need to have a service role that ssm assumes That gets executed on these windows