Question

A company manages a shared logging and monitoring baseline (CloudWatch log groups, IAM roles, and Config recorders) that must be deployed identically into 40 accounts across 3 OUs in AWS Organizations. New accounts are frequently created and must automatically receive the baseline within minutes of joining an OU, with no manual step and without creating administrator roles in each target account. Which approach best meets these requirements?

Accepted Answer

Use a service-managed CloudFormation StackSet targeting the OUs with automatic deployment (auto-deployment) enabled so new accounts in those OUs receive the baseline automatically.

Answer

Use a self-managed CloudFormation StackSet and pre-create the AWSCloudFormationStackSetExecutionRole and administration role in every current and future account via a bootstrap script.

Answer

Build a CDK Pipeline in the management account that runs 'cdk deploy' against each account, triggered by an EventBridge rule watching for new account creation events.

Answer

Create a single nested CloudFormation stack in the management account that references each target account's resources through cross-stack exports.