SSM patching - no internet instances - who will download patches

Good question!

From AWS's Patch Manager Documentation: https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-prerequisites.html

The managed nodes must have access to the source patch repositories. On Linux, these are typically from the remote repos confirmed on the node unless a alternative patch source repo is specified.

As for who kicks off the patches, patch baselines include rules for auto-approving patches. Otherwise, you could either schedule patches in a maintenance window or use tags.

In this case, the private instances must have access to your private Repos (ex: private WSUS server or internal RedHat Satellite server). SSM patching in the end will call the "Windows Update" or "yum update" commands as usual - and they should be working.