Question

A DevOps team manages a service-managed CloudFormation StackSet that deploys a standardized VPC configuration across all accounts in an Organizational Unit. The base template defines a parameter 'CidrBlock' with a default value. During deployment to a new region, the team needs specific accounts in that region to use a different CIDR range than the default, without editing the base template or maintaining separate StackSets. What is the correct approach to achieve this?

Accepted Answer

Use parameter overrides when creating stack instances for the specific accounts/region, supplying the alternate CidrBlock value.

Answer

Create a separate StackSet for the accounts requiring a different CIDR and manage them independently.

Answer

Edit the base template to add a Mappings section keyed on account ID and region, then update the entire StackSet.

Answer

Enable drift detection on the StackSet and manually update the drifted stack instances with the new CIDR.