A central account must deploy an identical VPC baseline into 50 accounts across 4 Regions, including accounts created later. Which CloudFormation capability fits best?
Show answer and explanation
Answer: A
Service-managed StackSets use the organization's accounts and organizational units as targets, so the central account does not need a role in every member. Automatic deployment adds new accounts to the relevant stack instances as they join a targeted OU. Updates roll out to every instance from the same template.
Why the other options are wrong
- B. A custom Lambda per account reimplements targeting, retries, and reporting that StackSets already handles.
- C. Nested stacks organize templates within one stack. They cannot create stacks in other accounts or Regions.
- D. A CDK pipeline can deploy an app, but it is a CI/CD construct rather than the native multi-account targeting mechanism.
Exam tip. Multi-account, multi-Region templates mean service-managed StackSets.