Question

A SysOps administrator manages an AWS Organizations environment with three organizational units (OUs): Dev, Staging, and Production. The security team wants to deploy a standardized IAM configuration and a CloudTrail baseline to every existing and future account in the Production OU. The administrator wants the deployments to happen automatically when new accounts are added to the OU, with minimal ongoing manual effort. Which approach meets these requirements?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions and enable automatic deployment targeting the Production OU.

Answer

Create a CloudFormation StackSet with self-managed permissions and manually add each account's stack instance as new accounts join.

Answer

Use a single CloudFormation stack in the management account and reference each member account with cross-account IAM roles.

Answer

Write an EventBridge rule that triggers a Lambda function to run a CreateStack API call in each new account of the Production OU.