{"question":{"id":39423,"htmlId":"question39423","kind":"SingleChoice","specVersion":null,"questionHtml":"

An organization with AWS Organizations wants every existing and future member account in two Regions to run a standard set of IAM roles and AWS Lambda functions. The CloudOps engineer must implement this once and have the stacks automatically appear in any new accounts that join the same organizational unit (OU). Which approach meets these requirements with the least ongoing operational effort?

","descriptionHtml":"

Using a service-managed CloudFormation StackSet that targets the desired OU meets all stated requirements. When trusted access is enabled, CloudFormation automatically assumes the required execution roles in each member account. By enabling the StackSet's auto-deployment feature, CloudFormation automatically creates stack instances in any account that is subsequently moved into or created within the target OU and deletes them if the account leaves the OU. Self-managed StackSets, manual scripts, or CDK pipelines would require manual additions or separate automation each time an account is created, resulting in higher operational overhead.

","answers":[{"id":2568416,"html":"

Create a self-managed CloudFormation StackSet in a delegated administrator account and manually add every member account ID to the target list when the account is created.

","isCorrect":false},{"id":2568415,"html":"

Create a service-managed CloudFormation StackSet in the management account, specify the two target Regions and the OU, and enable auto-deployment so that new accounts receive the stack automatically.

","isCorrect":true},{"id":2568418,"html":"

Instruct each member account to run an AWS Systems Manager Automation runbook that invokes cloudformation deploy for the required templates in both Regions.

","isCorrect":false},{"id":2568417,"html":"

Build an AWS CDK pipeline that deploys the stack to each account and Region, triggered by an EventBridge rule that detects new AWS Organizations accounts.

","isCorrect":false}],"textInput":null,"matching":null,"objectiveId":1916,"objectiveTitle":"Deployment, Provisioning, and Automation","nextQuestionUrl":"/study/questions/soa-c03/a-company-s-dev-account-runs-an-application-on-amazon-ec2-that-must-read-an/38096?HideScore=false&ObjectiveMode=RoundRobbinObjectives","questionUrl":"/study/questions/soa-c03/an-organization-with-aws-organizations-wants-every-existing-and-future/39423","followUpPrompts":[{"id":277914,"prompt":"What is a CloudFormation StackSet?","response":"A CloudFormation StackSet is a feature in AWS CloudFormation that enables you to deploy and manage stack instances across multiple AWS accounts and Regions. It allows centralized management of resources, ensuring consistent configurations for accounts within an AWS Organization. You can use service-managed StackSets, which automatically handle deployments for accounts in an organizational unit (OU), or self-managed StackSets, which require manual account management. StackSets simplify multi-account resource provisioning while reducing management overhead."},{"id":277915,"prompt":"What is the difference between service-managed and self-managed StackSets?","response":"Service-managed StackSets use AWS Organizations to manage resources across accounts in specified organizational units (OUs). With trusted access enabled, they automate StackSet deployment and maintain stack instances when accounts join or leave OUs. Self-managed StackSets require manual configuration of the target accounts for deployment and rely on user-provided credentials. Service-managed StackSets require less ongoing effort compared to self-managed ones due to their automation and integration with AWS Organizations."},{"id":277916,"prompt":"What is auto-deployment in a CloudFormation StackSet?","response":"Auto-deployment in a CloudFormation StackSet automatically creates, updates, or deletes stack instances in accounts within specified organizational units (OUs). When new accounts are added to an OU or moved between OUs, stack instances are deployed or removed without manual intervention. This feature is only available for service-managed StackSets and significantly reduces operational overhead by ensuring that resources are consistently provisioned as accounts change in the organization."}],"presentationMode":false,"hideFeedbackForm":false,"hideResponseBadges":false,"setId":null,"skipSaveResponse":false},"canVote":false,"streak":{"value":null,"title":null,"launchConfetti":false,"isRecord":false},"id":"crucial-react-a5bb602f67ff44359e4c7ea34e248921"}

AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

Report Issue