A security team requires that a set of IAM roles and a Config recorder be deployed to every existing and FUTURE account in an OU across 3 regions, with minimal effort. What should be used?
Show answer and explanation
Answer: A
Service-managed StackSets deploy through AWS Organizations directly into the target OU's accounts, across the regions you specify. With automatic deployment on, accounts joining that OU later receive the stack automatically — the requirement of covering future accounts with minimal effort is met by configuration, not code.
Why the other options are wrong
- B. A pipeline looping over account IDs only covers the accounts listed; every new account needs a pipeline change, and 3 regions multiply the work.
- C. Self-managed StackSets can deploy cross-account, but the target list is maintained by hand and future accounts still require action, plus IAM roles for the stack operations must be managed manually.
- D. Service Catalog shares an approved product, but each account must still provision it itself; nothing deploys automatically into existing or new accounts.