A baseline IAM role and Config recorder must deploy identically across 200 accounts in 3 regions, and stay consistent as new accounts join the org. Which CloudFormation feature?
A.Nested stacks in a single template
Nested stacks organize within a stack — not cross-account replication.
B.StackSets with service-managed (Organizations) deployment
StackSets + Organizations = fleet-wide deployment. Correct.
C.A Lambda that loops over accounts
Custom Lambda duplicates what StackSets already does.
D.Change sets per region
Change sets preview changes — not multi-account distribution.
Why this answer
StackSets deploy a template across accounts AND regions from one operation; service-managed mode integrates with Organizations — auto-deploys to new accounts as they join (auto-deployment), the enterprise baseline-provisioning pattern.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation