Question

A CloudOps engineer must deploy a standardized IAM role and a logging configuration to 40 AWS accounts spread across three Regions. The accounts are all members of an AWS Organizations organization. The engineer wants a repeatable, centrally managed way to deploy and update these resources across all accounts and Regions with the least ongoing administrative effort. Which approach should the engineer use?

Accepted Answer

Create a CloudFormation StackSet with service-managed permissions and deploy to the organization's organizational units, enabling automatic deployment to accounts as they join.

Answer

Create a single CloudFormation stack in the management account and use nested stacks that reference each member account's resources.

Answer

Write an AWS Systems Manager Automation runbook that assumes a role in each account and creates the resources sequentially.

Answer

Manually launch the same CloudFormation template in each account and Region, then enable drift detection on every stack.