AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

CloudFormation StackSets with service-managed permissions integrate directly with AWS Organizations. By registering the shared-services account as a delegated administrator, the network team can create and manage StackSets without access to the management or member accounts. Targeting an OU and enabling automatic deployments causes stacks to be created in every existing account in the OU and in any future accounts as they are added. The StackSet automatically handles deployment to the specified Regions (us-east-1 and us-west-2).

The other options fall short:

• Self-managed StackSets require an IAM administration role in every account and do not automatically include new accounts, so manual scripting would be needed.
• Creating individual stacks and sharing resources through AWS RAM does not satisfy the requirement for automatic deployment to future accounts and adds operational overhead.
• Separate CDK pipelines in each account introduce unnecessary complexity and still require onboarding for future accounts; they also fail to centralize management in the shared-services account.