Flash card
AWS CloudFormation StackSets: deploying one template across many accounts and regions from a single operation.
- A StackSet manages stack instances across accounts and regions; updating the StackSet rolls the change to every instance.
- Self-managed permissions use IAM roles you create in the administrator and target accounts; service-managed permissions integrate with AWS Organizations and need no per-account role.
- Service-managed StackSets support automatic deployment, so an account joining a target OU gets the stack without anyone running anything.
- Operation preferences control the blast radius: concurrent account count, failure tolerance, and region order.
- Drift detection works at StackSet level, reporting which stack instances no longer match the template.
Pick it when
Pick it over nested stacks when the axis is accounts and regions rather than composition. Nested stacks break one large template into reusable pieces within a single stack; StackSets take one template to many places.
It's the wrong answer when
It is the wrong answer when everything lives in one account and one region, where it adds an administration layer for nothing. It is also the wrong answer for enforcing a restriction: a StackSet deploys a resource, and an account administrator can delete or change what it deployed. Preventing that is an SCP.