Question

A company runs a centralized CI/CD pipeline in a dedicated Tools account within its AWS Organization. The pipeline must deploy CloudFormation stacks into more than 50 workload accounts spread across multiple OUs. Security requires that the pipeline never use long-lived credentials, that each workload account explicitly control which principal can deploy, and that the solution scale as new accounts are added by the Account Factory without manual credential distribution. Which approach best meets these requirements?

Accepted Answer

Deploy a standardized cross-account IAM role in every workload account via a CloudFormation StackSet with a trust policy allowing the Tools account pipeline role to assume it via sts:AssumeRole.

Answer

Create an IAM user with programmatic access keys in each workload account and store the keys in AWS Secrets Manager in the Tools account for the pipeline to retrieve at deploy time.

Answer

Use IAM Identity Center permission sets assigned to the pipeline execution role so it can federate into each workload account for deployments.

Answer

Enable AWS Resource Access Manager to share the Tools account pipeline role with all workload accounts so they can invoke deployments locally.