Question

A platform team deploys a baseline security stack to 200 accounts using a service-managed CloudFormation StackSet targeting the entire organization. Recently, a bad template change caused the stack operation to succeed in the first several accounts before an IAM misconfiguration was noticed, requiring a painful manual cleanup across dozens of accounts. The team wants a way to automatically halt the StackSet operation early — before it reaches most accounts — if deployments start failing, while still allowing a small number of transient failures. Which configuration change should they make?

Accepted Answer

Set a low FailureTolerancePercentage (or FailureToleranceCount) combined with a low MaxConcurrentPercentage so the operation stops rolling out after only a few account failures.

Answer

Enable drift detection on the StackSet before every deployment so failing accounts are detected and skipped automatically.

Answer

Switch the StackSet permission model from service-managed to self-managed so each account validates the template with its own IAM role.

Answer

Add a stack policy to each stack instance that denies updates to IAM resources during the operation.