Question

A company runs a shared services account that hosts a CodePipeline pipeline. The pipeline must deploy a CloudFormation stack into three separate target accounts (dev, staging, prod) that belong to the same AWS Organization. The DevOps team wants prod deployment to occur only after a security engineer explicitly approves, and they want to minimize the number of pipelines to maintain. Which approach best meets these requirements while following least-privilege cross-account practices?

Accepted Answer

Create a single pipeline in the shared services account with separate deploy stages for each target account. Use CloudFormation deployment actions that assume a per-account deployment role via the action's RoleArn, and add a manual approval action before the prod deploy stage.

Answer

Create three independent pipelines, one in each target account, and trigger each downstream pipeline with an EventBridge rule when the previous stage completes.

Answer

Create a single pipeline that uses a CodeBuild project running the AWS CLI with long-lived IAM access keys stored in the pipeline for each target account, and gate prod with a Lambda invoke action.

Answer

Use CloudFormation StackSets with automatic deployment to the entire organizational unit, relying on StackSet drift detection to prevent unapproved prod changes.