Question

A DevOps team manages a service-managed CloudFormation StackSet with automatic deployment enabled, targeting an entire Organizational Unit (OU) that contains 40 production accounts. Each stack deploys a baseline security configuration including IAM roles and a CloudTrail trail. The security team needs to move one account out of the target OU into a separate 'quarantine' OU for investigation, but they require that the baseline security stack (including CloudTrail logging) REMAINS active in that account after the move so evidence continues to be collected. What is the correct approach?

Accepted Answer

Before moving the account, use the StackSet 'automatic deployment' setting configured to retain stacks on OU removal, then move the account to the quarantine OU.

Answer

Move the account to the quarantine OU; with automatic deployment, StackSets will retain the stack instance by default when an account leaves the target OU.

Answer

Disable automatic deployment on the entire StackSet, then move the account to the quarantine OU to prevent any stack instance removal.

Answer

Move the account, then immediately re-add the quarantine OU as an additional deployment target so the stack instance is re-created.