Question

A DevOps engineer needs to deploy a baseline security stack to 40 existing AWS accounts using CloudFormation StackSets. The organization does NOT use AWS Organizations trusted access, and the accounts were onboarded before StackSets was configured. The engineer must deploy the stack across these accounts with the least ongoing operational effort while working within these constraints. Which approach correctly enables the deployment?

Accepted Answer

Use the SELF_MANAGED permission model, creating an AWSCloudFormationStackSetAdministrationRole in the admin account and an AWSCloudFormationStackSetExecutionRole in each target account that trusts the administration role.

Answer

Use the SERVICE_MANAGED permission model and enable automatic deployment so new accounts in the organization are automatically included.

Answer

Enable trusted access for CloudFormation StackSets in AWS Organizations, then deploy using the SERVICE_MANAGED model targeting the organization root.

Answer

Deploy individual CloudFormation stacks in each target account via a cross-account CodePipeline, since StackSets requires AWS Organizations.