StackSets across accounts and Regions: DOP-C02 study notes and practice questions
What to know about StackSets across accounts and Regions for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.
StackSets questions ask how to roll out the same baseline (roles, Config rules, alarms, logging) to every account, including future ones.
Permission models
Model
How
Self-managed
You create AWSCloudFormationStackSetAdministrationRole in the admin account and AWSCloudFormationStackSetExecutionRole in every target account
Service-managed
Uses AWS Organizations; StackSets creates the roles for you and targets OUs
Service-managed is the usual answer for organizations because it supports automatic deployment: when an account joins a target OU, StackSets deploys to it; when it leaves, stacks can be removed or retained.
Delegated administrator
Register a member account as a delegated administrator for StackSets so teams don’t need the management account.
Deployment options
Regions and their order.
Maximum concurrent accounts (number or percentage) controls speed.
Failure tolerance sets how many failures stop the operation in each Region.
Region concurrency: sequential or parallel.
Concurrency mode: strict failure tolerance or soft failure tolerance.
Updating the StackSet updates all its stack instances; you can override parameters per account or Region.
Drift detection runs across all instances.
Deleting requires removing stack instances first.
Typical uses
Organization-wide IAM roles, Config rules, CloudWatch alarms, logging buckets, GuardDuty or Security Hub setup (though many services have their own organization-wide setup through delegated admins).
Control Tower uses StackSets under the hood for its baselines.
Common traps
Self-managed permissions when the question wants automatic deployment to new accounts.
Running from the management account when a delegated administrator is preferred.
100% concurrency with zero failure tolerance stopping everything on one account’s error.
A regional bank has 180 AWS accounts in an AWS Organization, arranged in organizational units for retail, commercial and shared services. The security team needs a baseline IAM role and an audit logging stack in every account in three Regions.
New accounts are created every month by the bank's account vending process and must receive the baseline without anyone running a deployment by hand. The security team also needs each rollout to stop if too many accounts fail, so that a bad template does not reach the whole organization at once.
The bank wants the StackSets administrator to be a shared-services account, and it does not want to create roles in each member account by hand.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create the StackSet with service-managed permissions from the shared-services account as a delegated administrator, and enable automatic deployment to the organizational units so that new accounts receive the stacks.
BB. Create a self-managed StackSet and manually create the administrator and execution roles in each of the 180 accounts through a Lambda function that the account vending process runs.
CC. Deploy the baseline template through a CloudFormation stack in each account, and use a CodePipeline pipeline in the shared-services account to run the same stack in every account in sequence.
DD. Create one StackSet for each account and Region pair, so that a failure in one account cannot affect the others, and deploy each StackSet from the management account.
EE. Set the StackSet operation preferences to limit the maximum concurrent accounts and to set a failure tolerance, so that the operation stops in a Region once the failed accounts exceed the tolerance.
B. Wrong: Self-managed StackSets work, but the bank would have to build and maintain role creation in every account. The request was to avoid creating roles in member accounts by hand, and this approach adds that work back. Learn more: Grant self-managed permissions (opens in a new tab)
D. Wrong: This creates thousands of StackSets to manage, and it does not automate deployment for new accounts. Running the StackSets from the management account also goes against the bank's design.
E. Right: Correct. Maximum concurrent accounts limits how many accounts are updated at once, and failure tolerance sets how many stack failures per Region are allowed before CloudFormation stops the operation. A bad template then halts after a small number of accounts. Learn more: StackSets concepts (opens in a new tab)
Explanation
StackSets with service-managed permissions, run from a delegated administrator account, create the required roles in member accounts and can deploy automatically to accounts placed in target OUs. Operation preferences limit concurrency and failure tolerance so that a bad template stops early. Self-managed roles, separate stacks and per-pair StackSets each add work or miss an automation requirement.
Want more on StackSets across accounts and Regions? The 5 full-length practice sets have 7 more StackSets across accounts and Regions questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →