SOA-C03 practice question: StackSets and resource sharing (1 of 2)

Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A regional bank uses AWS Organizations, with about 60 member accounts in a Workloads organizational unit (OU). Every account in the OU must have the same CloudWatch alarms and an SNS topic for operations alerts, including accounts created in the future. The team does not want to create or maintain IAM roles in each account for the deployment. What should a CloudOps engineer do?

Choose one answer.

A. Create a CloudFormation StackSet with self-managed permissions and add each new account to the stack set manually when it is created.
B. Share one CloudFormation stack from the management account with the OU by using AWS Resource Access Manager.
C. Deploy the alarms and topic with an AWS Config conformance pack, which applies to every account in the OU.
D. Create a CloudFormation StackSet with service-managed permissions that targets the Workloads OU, with automatic deployment turned on for new accounts.

Show the answer and explanation

Answer: D

A. Wrong: Self-managed permissions require an administration role and an execution role in every target account. New accounts would also need manual steps, which the team wants to avoid. Learn more: Grant self-managed permissions (opens in a new tab)
B. Wrong: CloudFormation stacks cannot be shared through AWS RAM. Each account needs its own stack instance to own its alarms and topic. Learn more: What is AWS Resource Access Manager? (opens in a new tab)
C. Wrong: Conformance packs deploy AWS Config rules and remediation actions. They are not a general way to deploy CloudWatch alarms and SNS topics. Learn more: Conformance packs (opens in a new tab)
D. Right: Correct. Service-managed permissions use Organizations to create the roles StackSets needs. Automatic deployment adds the stack to any account that joins the OU and can remove it when an account leaves. Learn more: Create a stack set with service-managed permissions (opens in a new tab)

Explanation

StackSets deploy one template to many accounts and Regions. With service-managed permissions, StackSets works through AWS Organizations, so no roles have to be built by hand, and automatic deployment keeps new accounts in the target OU covered. Self-managed permissions need roles and manual updates in each account.

SOA-C03 practice question: StackSets and resource sharing (1 of 2)

Explanation

Study

Keep practicing