Question

A company manages infrastructure across an AWS Organization with 200 accounts. The cloud platform team, which does not have access to the Organization management account, needs to deploy and manage service-managed CloudFormation StackSets that automatically deploy to new accounts as they join specific OUs. The security team requires that the management account not be used for day-to-day StackSet operations. How should the platform team be enabled to perform these StackSet operations?

Accepted Answer

Register the platform team's member account as a delegated administrator for CloudFormation StackSets in the Organization, then create service-managed StackSets from that account with automatic deployment enabled.

Answer

Grant the platform team an IAM role in the management account with AWSCloudFormationStackSetAdministrator permissions and have them assume it for each deployment.

Answer

Use self-managed StackSets and manually create the AWSCloudFormationStackSetExecutionRole in every current and future member account via a bootstrap script.

Answer

Create the StackSets in the management account with service-managed permissions and share them to the platform account using AWS Resource Access Manager (RAM).