DOP-C02 practice question: StackSets across accounts and Regions
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional bank has 180 AWS accounts in an AWS Organization, arranged in organizational units for retail, commercial and shared services. The security team needs a baseline IAM role and an audit logging stack in every account in three Regions.
New accounts are created every month by the bank's account vending process and must receive the baseline without anyone running a deployment by hand. The security team also needs each rollout to stop if too many accounts fail, so that a bad template does not reach the whole organization at once.
The bank wants the StackSets administrator to be a shared-services account, and it does not want to create roles in each member account by hand.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create the StackSet with service-managed permissions from the shared-services account as a delegated administrator, and enable automatic deployment to the organizational units so that new accounts receive the stacks.
BB. Create a self-managed StackSet and manually create the administrator and execution roles in each of the 180 accounts through a Lambda function that the account vending process runs.
CC. Deploy the baseline template through a CloudFormation stack in each account, and use a CodePipeline pipeline in the shared-services account to run the same stack in every account in sequence.
DD. Create one StackSet for each account and Region pair, so that a failure in one account cannot affect the others, and deploy each StackSet from the management account.
EE. Set the StackSet operation preferences to limit the maximum concurrent accounts and to set a failure tolerance, so that the operation stops in a Region once the failed accounts exceed the tolerance.
B. Wrong: Self-managed StackSets work, but the bank would have to build and maintain role creation in every account. The request was to avoid creating roles in member accounts by hand, and this approach adds that work back. Learn more: Grant self-managed permissions (opens in a new tab)
D. Wrong: This creates thousands of StackSets to manage, and it does not automate deployment for new accounts. Running the StackSets from the management account also goes against the bank's design.
E. Right: Correct. Maximum concurrent accounts limits how many accounts are updated at once, and failure tolerance sets how many stack failures per Region are allowed before CloudFormation stops the operation. A bad template then halts after a small number of accounts. Learn more: StackSets concepts (opens in a new tab)
Explanation
StackSets with service-managed permissions, run from a delegated administrator account, create the required roles in member accounts and can deploy automatically to accounts placed in target OUs. Operation preferences limit concurrency and failure tolerance so that a bad template stops early. Self-managed roles, separate stacks and per-pair StackSets each add work or miss an automation requirement.
Want more on StackSets across accounts and Regions? The 5 full-length practice sets have 7 more StackSets across accounts and Regions questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →