AWS › IaC (CloudFormation)

How do CloudFormation StackSets support deploying the same infrastructure template consistently across multiple AWS accounts and regions simultaneously?

Advanced

Answer

CloudFormation StackSets let you define a template once and deploy it consistently as individual stacks across many different AWS accounts and regions from a single central operation, which is invaluable for enforcing consistent baseline infrastructure, such as a required logging configuration or security guardrail, across an entire AWS Organization, without needing to manually deploy and maintain a separate stack in every individual account and region.

aws cloudformation create-stack-set --stack-set-name baseline-security --template-body file://baseline.yaml --permission-model SERVICE_MANAGED --auto-deployment Enabled=true

Real-world example A large enterprise uses a StackSet to automatically deploy a mandatory CloudTrail logging configuration across all fifty accounts in its AWS Organization, and any newly created account automatically receives that same baseline configuration through the StackSet's auto deployment feature.

Common follow-ups: What is the difference between self managed and service managed permission models for StackSets?;How do you handle a StackSet deployment failure in one specific target account without affecting the others?

AWS Organizations & Multi Account Strategy;AWS CloudTrail & Auditing