Question

A company uses AWS Organizations with a central management account. The security team maintains a CloudFormation StackSet that deploys a baseline set of IAM roles and a logging configuration to all member accounts. New accounts are frequently created through Account Factory as teams onboard. The security team reports that new accounts do not automatically receive the baseline stack and must be manually added. They want new accounts in the targeted OUs to receive the baseline automatically, with no manual intervention. What is the MOST operationally efficient way to achieve this?

Accepted Answer

Recreate the StackSet with service-managed permissions and enable automatic deployment (auto-deployment), targeting the appropriate OUs so new accounts are enrolled automatically.

Answer

Keep the self-managed StackSet and create an EventBridge rule on CreateAccountResult that triggers a Lambda function to call CreateStackInstances for each new account.

Answer

Convert the StackSet to a nested stack and export the outputs so new accounts import the baseline values on creation.

Answer

Enable drift detection on the StackSet and schedule a daily remediation job that re-deploys stack instances to any accounts missing the baseline.