Question

A company originally deployed a CloudFormation StackSet using the self-managed permission model across 40 member accounts, manually creating the AWSCloudFormationStackSetExecutionRole in each account. The company has now enabled trusted access between AWS Organizations and CloudFormation and wants to switch the StackSet to the service-managed permission model so that new accounts joining the organization automatically receive the stacks. A DevOps engineer attempts to update the existing StackSet's permission model in place but the operation fails. What is the correct approach to achieve automatic deployment to new accounts?

Accepted Answer

Create a new service-managed StackSet with automatic deployment enabled targeting the organization or specific OUs, and import or redeploy the stack instances there, because the permission model of an existing StackSet cannot be changed between self-managed and service-managed.

Answer

Update the existing self-managed StackSet and set AutoDeployment to Enabled, which converts it to service-managed once trusted access is active.

Answer

Delete the manually created AWSCloudFormationStackSetExecutionRole in each account so CloudFormation falls back to organization-managed roles automatically.

Answer

Add the organization root ID as a deployment target on the existing self-managed StackSet, which enables auto-deployment for new accounts without changing the permission model.