Question

A network operations team manages 40 AWS accounts under a single AWS Organizations structure. They need to deploy an identical set of interface VPC endpoints (for SSM, EC2 Messages, and CloudWatch Logs) into a standard VPC in every account, and ensure that any newly created account automatically receives the same endpoints without manual intervention. The solution must minimize ongoing operational effort. Which approach best meets these requirements?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions, deploy it to the entire organization, and enable automatic deployment to accounts added to the target OU.

Answer

Write a Lambda function triggered by CloudTrail account-creation events that runs the AWS CLI to create the endpoints in each new account.

Answer

Create a single CloudFormation stack in the management account with cross-account IAM roles and reference each member VPC using nested stacks.

Answer

Use AWS RAM to share the interface endpoints from a central networking account to all member accounts so each account reuses the same endpoints.