Your company uses AWS platform to host most of its applications and services. As an AWS administrator, you have managed a large number of AWS resources to meet the business needs. Sometimes, you have to create, update or delete similar resources in many AWS regions and accounts. For example, you need to configure an AWS Config rule to determine if CloudTrail was enabled in all accounts. Which way is the best for you to implement such kind of configurations across multiple regions or accounts in a single operation?

Answer options:

A.Prepare CloudFormation templates and create CloudFormation stacks using the templates in various regions and accounts.
B.Create Lambda functions to use AWS SDK to create AWS resources. Run the Lambda functions in different regions and accounts.
C.Configure an AWS CodePipeline to deploy AWS resources in a deployment stage via CodeDeploy. Execute the pipeline in different regions and accounts.
D.Create CloudFormation StackSets using templates. Specify regions and accounts depending on the requirements for the StackSets.

Correct Answer – D
The key of the question is that AWS resources need to be configured or maintained across different regions and accounts in a single operation. CloudFormation StackSets should be considered first as it can easily provision CloudFormation stacks for selected target accounts across specified regions. Refer to the document in https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html.
Option A is incorrect: Because single CloudFormation stack cannot meet the need. CloudFormation StackSets should be used.
Option B is incorrect: Because Lambda functions have to be maintained in different regions/accounts. This approach is less efficient.
Option C is incorrect: Users cannot execute pipelines in one single operation across regions and accounts.
Option D is CORRECT: Regions and accounts can be selected for a single CloudFormation StackSets. Refer to the below screenshot: