You are a DevOps engineer in a company. An AWS Organization is configured to manage a large number of AWS accounts and the Organization uses several Organizational Units (OUs) to help group AWS accounts together. You need to deploy a CloudFormation stack to enable customized AWS Config rules for all AWS accounts under one Organizational Unit. Which approach would you choose to provision the stack?

Answer options:

A.Create an IAM role that has permissions to create AWS Config rules in AWS accounts of the Organization Unit. Use the IAM role to configure a CodeDeploy task that deploys CloudFormation stacks in all AWS accounts.
B.Configure an AWS CodePipeline task that has a source stage to select the template and a deploy stage to launch the CloudFormation stack in all AWS accounts of the OU.
C.Ensure the CloudFormation template has parameters of AWS accounts and regions. Use the root AWS account to deploy the CloudFormation stack in all AWS accounts.
D.Configure a CloudFormation StackSet using the CloudFormation template. Choose the Organization Unit in the StackSet and specify the regions to deploy the stack.

Correct Answer – D
You can use a CloudFormation StackSet to deploy a stack in different AWS accounts under one Organizational Unit (OU). Check how to work with CloudFormation StackSets in https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html.
Option A is incorrect: This approach is not as simple as CloudFormation StackSet as you have to maintain the CodeDeploy task.
Option B is incorrect: In the deploy stage of AWS CodePipeline, you cannot choose other AWS accounts for the deployment.
Option C is incorrect: It is not easy to create CloudFormation stacks for other AWS accounts even if there are parameters of AWS accounts and regions.
Option D is CORRECT: With CloudFormation StackSet, you can specify the Organizational Unit as the target and the CloudFormation stack will be deployed in all AWS members: