A patch baseline in Patch Manager defines the patches that should and should not be installed on EC2 instances, specifying approval rules for security updates, other updates, and exclusions. This ensures controlled and compliant patching. The WGU Cloud Deployment and Operations Study Guide (Section 5.2, Patch Manager) states, 'A patch baseline specifies which patches are approved for installation and which are excluded, allowing customization of patch deployment (e.g., approving only critical security updates).' Options A, B, and D misrepresent the baseline's role, as it does not auto-install, assign IAM roles, or notify Config directly.