CloudFormation StackSets for Multi-Account

AWS CloudFormation StackSets extend the capabilities of CloudFormation stacks by allowing you to deploy a single template across multiple accounts and regions in a single operation. A StackSet is a container that holds a template and a set of parameters. From that container, the service creates stack instances—individual stacks—in specified target accounts and regions. The StackSet ensures that all stack instances are consistent with the template. When you update the StackSet, the service automatically updates all stack instances. This eliminates the need to manually run CloudFormation in each account or region or to use custom automation scripts.

In a multi-account AWS environment (e.g., using AWS Organizations), you often need to deploy baseline infrastructure—like AWS Config rules, VPCs, or IAM roles—across all accounts. Doing this manually is error-prone and time-consuming. StackSets provide a native, auditable, and scalable solution. They integrate with AWS Organizations to automatically deploy to accounts as they are added or removed. The exam tests your understanding of this use case: governance and compliance deployments at scale.

A StackSet operates through the following mechanism:

- Administrator Account: The account that owns the StackSet. Cannot be a target account unless you explicitly include it. - Target Accounts: Account IDs where stacks are deployed. You can use AWS Organizations to automatically include all current and future accounts. - Regions: A list of region names (e.g., us-east-1, eu-west-1). Stack instances are created in each region for each target account. - StackSet Name: Must be unique in the administrator account. Can contain alphanumeric characters and hyphens. - Template: A CloudFormation template (JSON or YAML) stored locally, in an S3 bucket, or as an Amazon S3 URL. - Parameters: Template parameters specific to the StackSet. You can override parameters per target account or region using parameter overrides. - Execution Role Name: The name of the IAM role in the target account that the administrator account assumes. Default is AWSCloudFormationStackSetExecutionRole. - Administration Role Name: The IAM role in the administrator account that grants permissions to assume the execution role. Default is AWSCloudFormationStackSetAdministrationRole. - Operation Preferences: - Failure Tolerance: The number of stack instance failures (absolute or percentage) that can occur before the operation stops. Default: 0. - Max Concurrent Accounts: The maximum number of target accounts in which the operation is performed simultaneously. Default: 1. - Region Concurrency: Can be SEQUENTIAL or PARALLEL. Default: SEQUENTIAL. - Retain Stacks: When deleting a stack instance, you can choose to retain the stack and its resources. Default: delete. - Stack Instance Status: CURRENT, OUTDATED, INOPERABLE, FAILED, DELETED, SUSPENDED. - StackSet Status: ACTIVE, DELETED.

To create a StackSet using the AWS CLI:

aws cloudformation create-stack-set \
    --stack-set-name my-stackset \
    --template-body file://template.yaml \
    --parameters ParameterKey=KeyPair,ParameterValue=my-key \
    --capabilities CAPABILITY_NAMED_IAM \
    --administration-role-arn arn:aws:iam::111111111111:role/AWSCloudFormationStackSetAdministrationRole \
    --execution-role-name AWSCloudFormationStackSetExecutionRole

To create stack instances:

aws cloudformation create-stack-instances \
    --stack-set-name my-stackset \
    --accounts 222222222222 333333333333 \
    --regions us-east-1 eu-west-1

To update a StackSet:

aws cloudformation update-stack-set \
    --stack-set-name my-stackset \
    --template-body file://new-template.yaml \
    --parameters ParameterKey=KeyPair,UsePreviousValue=true

To list stack instances:

aws cloudformation list-stack-instances \
    --stack-set-name my-stackset

To describe a stack instance:

aws cloudformation describe-stack-instance \
    --stack-set-name my-stackset \
    --stack-instance-account 222222222222 \
    --stack-instance-region us-east-1

A financial services company uses AWS Organizations with over 200 accounts. They need to enforce AWS Config rules for mandatory encryption across all accounts. They create a StackSet with a template that includes AWS Config rules for S3 bucket encryption, EBS volume encryption, and RDS encryption. Using service-managed permissions, they target the root OU so that all current and future accounts automatically get the rules. The StackSet is updated quarterly to add new rules. The team monitors stack instance statuses via CloudWatch Events. A common issue is that some accounts have service control policies (SCPs) that block creation of certain resources, causing stack instance failures. The team must troubleshoot by checking CloudTrail logs in the target accounts.

A global e-commerce company needs to deploy a standardized VPC with subnets, NAT gateways, and route tables in three regions (us-east-1, eu-west-1, ap-southeast-1) across 10 accounts. They use a StackSet with a template that takes parameters like VPC CIDR and subnet CIDRs. They create stack instances per account and region. To handle regional differences (e.g., different AMI IDs), they use parameter overrides at the region level. The StackSet ensures all VPCs are identical except for CIDR ranges. A problem arises when a new region is added: they must update the StackSet to include the new region and then create stack instances for all accounts in that region. They use automatic deployment via Organizations to simplify this.

A consulting firm manages multiple client accounts. They need to deploy a set of IAM roles that allow their engineers to access resources. They create a StackSet with a template that defines IAM roles and policies. They target each client account individually. Since the roles require a trust policy that references the administrator account, they must ensure the execution role has permissions to create IAM roles. They use self-managed permissions and manually create the execution role in each target account. A common misconfiguration is forgetting to update the trust policy in the execution role when the administrator account changes. The StackSet deployment fails with access denied errors.