Question

A company manages its AWS accounts through AWS Organizations. The CloudOps team uses a CloudFormation StackSet with service-managed permissions to deploy a baseline security configuration (IAM roles, Config rules, and a logging bucket) to all accounts in a specific organizational unit (OU). New accounts are frequently created and added to this OU. The team wants the baseline StackSet to be deployed automatically to any new account added to the OU, without manual intervention. Which action meets this requirement?

Accepted Answer

Enable automatic deployment on the StackSet so that stack instances are created automatically when accounts are added to the target OU.

Answer

Create an EventBridge rule that triggers a Lambda function to run create-stack-instances whenever a new account joins the OU.

Answer

Switch the StackSet to self-managed permissions and share the template through AWS RAM with the new accounts.

Answer

Enable drift detection on the StackSet so that missing stack instances in new accounts are automatically remediated.