Question

A DevOps team manages a baseline security configuration (IAM roles, AWS Config rules, and a CloudTrail trail) across 40 accounts in an AWS Organization using a service-managed CloudFormation StackSet with automatic deployment enabled for new accounts. During a recent audit, the team discovered that engineers in several accounts had manually modified the deployed IAM roles directly in the console, weakening the intended permissions boundary. The team needs a repeatable, automated way to identify which stack instances no longer match the StackSet template and then restore them to the defined configuration with minimal manual effort. Which approach meets these requirements?

Accepted Answer

Run drift detection on the StackSet to identify DRIFTED stack instances, then perform a StackSet operation that redeploys the current template to the affected instances to bring resources back into alignment.

Answer

Enable termination protection on each stack instance and instruct engineers to stop making manual changes, then re-run the StackSet creation to overwrite existing resources.

Answer

Delete and recreate the entire StackSet with the RetainStacksOnAccountRemoval option so that all accounts receive a fresh copy of the template.

Answer

Configure an AWS Config aggregator to flag noncompliant IAM roles and rely on Config auto-remediation to reapply the CloudFormation template to each account.