Question

A DevOps team manages a security baseline (IAM roles and Config rules) across an AWS Organization using a service-managed CloudFormation StackSet deployed to an organizational unit (OU) containing 40 accounts. A regulatory change requires that a new set of resources be rolled out to only 3 specific accounts within that OU first, as a controlled pilot, before a full OU-wide rollout. The team must not deploy to the other 37 accounts yet, and must avoid manually removing accounts from the OU or creating a separate OU. Which approach accomplishes this with the least operational overhead?

Accepted Answer

Update the StackSet with a deployment target that specifies the OU as the organizational unit and set the account filter type to INTERSECTION (or DIFFERENCE), providing the 3 pilot account IDs so the stack instances deploy only to those accounts.

Answer

Create a new self-managed StackSet and manually add the 3 pilot account IDs and target region, using an administrator role in the management account and execution roles in each pilot account.

Answer

Move the 3 pilot accounts into a new temporary OU, deploy the StackSet to that OU, then move the accounts back after validation.

Answer

Enable automatic deployment on the StackSet and set the maximum concurrent accounts to 3 so that CloudFormation only rolls out to 3 accounts at a time.