[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-multi-account-provisioning-resource-sharing-with-aws-ram-en":4,"next-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-multi-account-provisioning-resource-sharing-with-aws-ram-en":1099,"lesson-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-multi-account-provisioning-resource-sharing-with-aws-ram-en":1111},null,{"locked":5,"reason":3,"meta":6,"item":20},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"CloudFormation StackSets","Deploying one template to many accounts and Regions from a single operation: stack sets and stack instances, self-managed versus service-managed permissions, deployment targets and account filters, concurrency and failure tolerance, drift, and the failures that hide behind a SUCCEEDED status.",true,30,"intermediate",[13,14,15,16,17,18,19],"Distinguish a stack set, a stack instance, and a stack, and explain why a stack instance can exist without a stack","Choose between self-managed and service-managed permissions, and name the roles each model requires","Target an organization, specific OUs, or filtered accounts, and predict which accounts receive a stack","Set failure tolerance, maximum concurrent accounts, and Region concurrency to match a deployment's risk","Interpret stack set and stack instance status codes, including OUTDATED and INOPERABLE","Explain how StackSets drift detection differs from stack-level drift detection","Diagnose the common StackSet failures, including an operation that reports SUCCEEDED while stacks failed",{"id":21,"title":7,"body":22,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":993,"infographics":994,"isFree":9,"learningObjectives":1009,"meta":1010,"navigation":9,"path":1011,"quiz":1012,"seo":1096,"stem":1097,"__hash__":1098},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/03-multi-account-provisioning/01-cloudformation-stacksets.md",{"type":23,"value":24,"toc":983},"minimark",[25,34,37,40,45,48,68,78,84,89,92,137,141,144,150,174,181,187,275,278,284,290,327,334,338,341,344,399,440,445,449,452,458,468,482,496,509,532,535,545,549,574,577,603,615,618,647,745,753,757,764,783,809,812,830,833,837,840,910,916,919,923,973,976,979],[26,27,28,29,33],"p",{},"A security team needs an IAM read-only role, a Config recorder, and a log-shipping rule in 40 accounts across 4 Regions. That is 160 stacks. The scripted version is a loop that assumes a role in each account and calls ",[30,31,32],"code",{},"create-stack",", which works until account 23 hits a service quota, the loop keeps going, and nobody notices for three weeks that four accounts have no Config recorder.",[26,35,36],{},"The problem is not the loop. It is that the loop has no memory. Nothing records that those 160 stacks are supposed to be the same thing, so nothing can tell you which ones are current, which ones failed, and which ones someone edited by hand.",[26,38,39],{},"StackSets is that memory. You define the template once, name the accounts and Regions, and CloudFormation tracks every resulting stack as part of one managed set.",[41,42,44],"h2",{"id":43},"stack-set-stack-instance-stack","Stack set, stack instance, stack",[26,46,47],{},"Three words that sound interchangeable and are not.",[26,49,50,51,55,56,59,60,63,64,67],{},"A ",[52,53,54],"strong",{},"stack set"," is the container: one template, one set of parameters, and the deployment configuration. It lives in the ",[52,57,58],{},"administrator account",", and it is a Regional resource. Create a stack set in ",[30,61,62],{},"eu-west-1"," and you will not see it when the console is switched to ",[30,65,66],{},"us-east-1",", which surprises people who assume a multi-Region feature must itself be global.",[26,69,50,70,73,74,77],{},[52,71,72],{},"stack instance"," is a reference to a stack in one ",[52,75,76],{},"target account"," within one Region. Three accounts across two Regions gives you 6 stack instances, and each one carries its own status.",[26,79,50,80,83],{},[52,81,82],{},"stack"," is the ordinary CloudFormation stack that actually holds resources, sitting in the target account.",[85,86],"infographic",{"alt":87,"slug":88},"A stack set holding one template fans out into a grid of stack instances, one per target account and Region, each with its own status.","stacksets-instance-matrix",[26,90,91],{},"The split between instance and stack looks like bookkeeping pedantry until the first failure. A stack instance can exist without a stack: if the create failed, there is no stack, but the instance survives and holds the reason. That is what makes a failed rollout diagnosable instead of invisible.",[93,94,99],"pre",{"className":95,"code":96,"language":97,"meta":98,"style":98},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","aws cloudformation list-stack-instances --stack-set-name org-baseline \\\n  --filters Name=DETAILED_STATUS,Values=FAILED\n","bash","",[30,100,101,128],{"__ignoreMap":98},[102,103,106,110,114,117,121,124],"span",{"class":104,"line":105},"line",1,[102,107,109],{"class":108},"sbgvK","aws",[102,111,113],{"class":112},"s_sjI"," cloudformation",[102,115,116],{"class":112}," list-stack-instances",[102,118,120],{"class":119},"stzsN"," --stack-set-name",[102,122,123],{"class":112}," org-baseline",[102,125,127],{"class":126},"s_hVV"," \\\n",[102,129,131,134],{"class":104,"line":130},2,[102,132,133],{"class":119},"  --filters",[102,135,136],{"class":112}," Name=DETAILED_STATUS,Values=FAILED\n",[41,138,140],{"id":139},"two-permission-models-one-real-choice","Two permission models, one real choice",[26,142,143],{},"Deploying into another account means assuming a role there. StackSets gives you two ways to arrange that, and the exam tests which one a scenario forces.",[26,145,146,149],{},[52,147,148],{},"Self-managed permissions"," means you build the trust chain yourself, with two roles whose names matter:",[151,152,153,168],"ul",{},[154,155,156,159,160,163,164,167],"li",{},[30,157,158],{},"AWSCloudFormationStackSetAdministrationRole"," in the administrator account. Its trust policy allows ",[30,161,162],{},"cloudformation.amazonaws.com"," to assume it, and its permissions policy allows ",[30,165,166],{},"sts:AssumeRole"," on the execution role in the targets.",[154,169,170,173],{},[30,171,172],{},"AWSCloudFormationStackSetExecutionRole"," in every target account, trusting the administrator account. This role needs full CloudFormation permissions plus permission for everything the template creates.",[26,175,176,177,180],{},"Use those exact names and StackSets picks them up automatically. Use custom names and every operation has to name them explicitly. The sample templates AWS publishes for these roles grant ",[30,178,179],{},"\"Action\": \"*\""," on the execution role, which is fine for a first test and wrong for anything permanent. Scope the execution role down to the resource types your template actually creates, because that role is the ceiling on what any stack set operation can do in that account.",[26,182,183,186],{},[52,184,185],{},"Service-managed permissions"," hands the role problem to CloudFormation. You activate trusted access between CloudFormation and AWS Organizations, and from then on CloudFormation creates and maintains the roles in member accounts for you. You target OUs instead of listing account IDs, and you get automatic deployment.",[188,189,190,205],"table",{},[191,192,193],"thead",{},[194,195,196,199,202],"tr",{},[197,198],"th",{},[197,200,201],{},"Self-managed",[197,203,204],{},"Service-managed",[206,207,208,220,231,242,253,264],"tbody",{},[194,209,210,214,217],{},[211,212,213],"td",{},"Target accounts",[211,215,216],{},"Any account where you can create a role",[211,218,219],{},"Only accounts in your organization",[194,221,222,225,228],{},[211,223,224],{},"Role setup",[211,226,227],{},"You create both roles",[211,229,230],{},"CloudFormation creates them",[194,232,233,236,239],{},[211,234,235],{},"Targets specified as",[211,237,238],{},"Account IDs",[211,240,241],{},"Organization root or OU IDs",[194,243,244,247,250],{},[211,245,246],{},"New account joins the OU",[211,248,249],{},"Nothing happens",[211,251,252],{},"Automatic deployment adds a stack",[194,254,255,258,261],{},[211,256,257],{},"Runs from",[211,259,260],{},"Any account",[211,262,263],{},"Management account, or a delegated administrator",[194,265,266,269,272],{},[211,267,268],{},"Nested stacks, macros, transforms",[211,270,271],{},"Supported",[211,273,274],{},"Not supported",[26,276,277],{},"Two constraints on the service-managed model are worth memorizing because they contradict what people assume.",[26,279,280,283],{},[52,281,282],{},"The management account never receives a stack."," Target the whole organization and CloudFormation still skips it. If the management account needs the same baseline, it gets its own stack or its own self-managed stack set.",[26,285,286,289],{},[52,287,288],{},"Delegated administrators cannot be scoped."," The management account can register up to 5 member accounts as delegated administrators, so a central platform team can run organization-wide stack sets without holding management account credentials. But a delegated administrator has full reach across every account in the organization. There is no \"this team may only deploy to the Sandbox OU\" setting.",[93,291,293],{"className":95,"code":292,"language":97,"meta":98,"style":98},"aws organizations register-delegated-administrator \\\n  --service-principal member.org.stacksets.cloudformation.amazonaws.com \\\n  --account-id 444455556666\n",[30,294,295,307,317],{"__ignoreMap":98},[102,296,297,299,302,305],{"class":104,"line":105},[102,298,109],{"class":108},[102,300,301],{"class":112}," organizations",[102,303,304],{"class":112}," register-delegated-administrator",[102,306,127],{"class":126},[102,308,309,312,315],{"class":104,"line":130},[102,310,311],{"class":119},"  --service-principal",[102,313,314],{"class":112}," member.org.stacksets.cloudformation.amazonaws.com",[102,316,127],{"class":126},[102,318,320,323],{"class":104,"line":319},3,[102,321,322],{"class":119},"  --account-id",[102,324,326],{"class":325},"srdBf"," 444455556666\n",[26,328,329,330,333],{},"From the delegated administrator account, every command carries ",[30,331,332],{},"--call-as DELEGATED_ADMIN",". Leave it off and the CLI looks for self-managed stack sets in the member account itself, finds nothing, and returns an empty list that looks like a permissions problem.",[41,335,337],{"id":336},"choosing-what-gets-a-stack","Choosing what gets a stack",[26,339,340],{},"With service-managed permissions, deployment targets are the organization root or a list of OU IDs. Targeting a parent OU automatically includes its children, which is the behavior you want for a security baseline and the behavior that surprises you when a nested sandbox OU picks up a production policy.",[26,342,343],{},"By default, every account in a targeted OU receives a stack. Account filters narrow that:",[188,345,346,356],{},[191,347,348],{},[194,349,350,353],{},[197,351,352],{},"Filter type",[197,354,355],{},"Meaning",[206,357,358,369,379,389],{},[194,359,360,366],{},[211,361,362,365],{},[30,363,364],{},"NONE"," (default)",[211,367,368],{},"Every account in the listed OUs",[194,370,371,376],{},[211,372,373],{},[30,374,375],{},"INTERSECTION",[211,377,378],{},"Only the listed accounts, and only if they are in the listed OUs",[194,380,381,386],{},[211,382,383],{},[30,384,385],{},"DIFFERENCE",[211,387,388],{},"Every account in the listed OUs except the listed accounts",[194,390,391,396],{},[211,392,393],{},[30,394,395],{},"UNION",[211,397,398],{},"Every account in the listed OUs, plus the listed accounts",[93,400,402],{"className":95,"code":401,"language":97,"meta":98,"style":98},"aws cloudformation create-stack-instances --stack-set-name org-baseline \\\n  --deployment-targets OrganizationalUnitIds=ou-rcuk-1x5j1lwo,Accounts=111122223333,AccountFilterType=DIFFERENCE \\\n  --regions eu-west-1 us-east-1\n",[30,403,404,419,429],{"__ignoreMap":98},[102,405,406,408,410,413,415,417],{"class":104,"line":105},[102,407,109],{"class":108},[102,409,113],{"class":112},[102,411,412],{"class":112}," create-stack-instances",[102,414,120],{"class":119},[102,416,123],{"class":112},[102,418,127],{"class":126},[102,420,421,424,427],{"class":104,"line":130},[102,422,423],{"class":119},"  --deployment-targets",[102,425,426],{"class":112}," OrganizationalUnitIds=ou-rcuk-1x5j1lwo,Accounts=111122223333,AccountFilterType=DIFFERENCE",[102,428,127],{"class":126},[102,430,431,434,437],{"class":104,"line":319},[102,432,433],{"class":119},"  --regions",[102,435,436],{"class":112}," eu-west-1",[102,438,439],{"class":112}," us-east-1\n",[26,441,442,444],{},[30,443,385],{}," is the one that earns its place in practice. A baseline applies to the whole Workloads OU except the one legacy account that would break, and you express that exception in the deployment rather than by pulling the account out of its OU.",[41,446,448],{"id":447},"concurrency-and-failure-tolerance","Concurrency and failure tolerance",[26,450,451],{},"Pushing a template to 160 places at once is a good way to break 160 places at once. Four settings control the blast radius, and they interact.",[26,453,454,457],{},[52,455,456],{},"Maximum concurrent accounts"," caps how many target accounts an operation touches at the same time, as a count or a percentage. Percentages round down: 25 percent of 10 accounts is 2, not 3.",[26,459,460,463,464,467],{},[52,461,462],{},"Failure tolerance"," is the number or percentage of failures allowed ",[52,465,466],{},"per Region"," before CloudFormation stops. It also rounds down.",[26,469,470,473,474,477,478,481],{},[52,471,472],{},"Region concurrency"," is ",[30,475,476],{},"SEQUENTIAL"," (the default, one Region at a time in your specified deployment order) or ",[30,479,480],{},"PARALLEL"," (all Regions at once).",[26,483,484,487,488,491,492,495],{},[52,485,486],{},"Concurrency mode"," decides what happens to concurrency when failures start. ",[30,489,490],{},"STRICT_FAILURE_TOLERANCE"," keeps maximum concurrent accounts at no more than failure tolerance plus 1, and slows down as failures accumulate. ",[30,493,494],{},"SOFT_FAILURE_TOLERANCE"," holds your concurrency level regardless.",[26,497,498,499,501,502,504,505,508],{},"Walk one operation through. You deploy to 10 accounts in ",[30,500,62],{},", ",[30,503,66],{},", and ",[30,506,507],{},"ap-southeast-2",", in that deployment order, with failure tolerance 20 percent, maximum concurrent accounts 50 percent, and sequential Regions.",[510,511,512,515,520],"ol",{},[154,513,514],{},"20 percent of 10 rounds down to 2 allowed failures per Region. 50 percent of 10 is 5 accounts at a time.",[154,516,517,519],{},[30,518,62],{}," runs 5 accounts, then the other 5. Two fail. That is exactly the tolerance, so the Region finishes and the operation moves on.",[154,521,522,524,525,528,529,531],{},[30,523,66],{}," runs and a third account fails in that Region. Tolerance is exceeded there, so the operation status becomes ",[30,526,527],{},"FAILED"," and ",[30,530,507],{}," is cancelled entirely.",[26,533,534],{},"Failure tolerance resets per Region. That is what makes sequential deployment a useful safety mechanism: a template that is broken everywhere fails in the first Region and never reaches the rest.",[26,536,537,538,528,541,544],{},"The default settings are deliberately timid, ",[30,539,540],{},"MaxConcurrentCount=1",[30,542,543],{},"FailureToleranceCount=0"," in the CLI examples, which means one account at a time and a stop at the first failure. For a first rollout of a new template, that is the right choice. Raise it once the template has proven itself.",[41,546,548],{"id":547},"statuses-and-the-one-that-lies","Statuses, and the one that lies",[26,550,551,552,501,555,501,558,501,560,501,563,566,567,570,571,573],{},"Stack set operations report ",[30,553,554],{},"RUNNING",[30,556,557],{},"SUCCEEDED",[30,559,527],{},[30,561,562],{},"QUEUED",[30,564,565],{},"STOPPING",", or ",[30,568,569],{},"STOPPED",". ",[30,572,562],{}," shows up with automatic deployment: move an account between OUs and StackSets runs a delete for the old OU's stack and queues a create for the new one.",[26,575,576],{},"Stack instances carry their own statuses, and two of them mean work is waiting for you:",[151,578,579,587],{},[154,580,581,586],{},[52,582,583],{},[30,584,585],{},"OUTDATED"," means the stack is not current with the stack set, almost always because a create or update failed there, or because the operation stopped before reaching it.",[154,588,589,594,595,598,599,602],{},[52,590,591],{},[30,592,593],{},"INOPERABLE"," means a delete-instances operation failed and left the stack in an unstable state. Instances in this state are ",[52,596,597],{},"excluded from further stack set updates",", so they silently stop receiving your changes. Recovering means deleting the instance with ",[30,600,601],{},"RetainStacks"," set to true, then cleaning up the stack by hand.",[26,604,605,606,611,612,614],{},"Now the misconception that costs people real coverage. ",[52,607,50,608,610],{},[30,609,557],{}," operation does not mean every stack succeeded."," It means the failure tolerance was never exceeded. Set failure tolerance to 10 across 10 accounts and an operation in which every single stack fails still returns ",[30,613,557],{},", because you told CloudFormation that many failures were acceptable.",[26,616,617],{},"The number you actually want is in the status details:",[93,619,621],{"className":95,"code":620,"language":97,"meta":98,"style":98},"aws cloudformation describe-stack-set-operation \\\n  --stack-set-name org-baseline --operation-id 5550e62f-c822-4331-88fa-21c1d7bafc60\n",[30,622,623,634],{"__ignoreMap":98},[102,624,625,627,629,632],{"class":104,"line":105},[102,626,109],{"class":108},[102,628,113],{"class":112},[102,630,631],{"class":112}," describe-stack-set-operation",[102,633,127],{"class":126},[102,635,636,639,641,644],{"class":104,"line":130},[102,637,638],{"class":119},"  --stack-set-name",[102,640,123],{"class":112},[102,642,643],{"class":119}," --operation-id",[102,645,646],{"class":112}," 5550e62f-c822-4331-88fa-21c1d7bafc60\n",[93,648,652],{"className":649,"code":650,"language":651,"meta":98,"style":98},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"StackSetOperation\": {\n    \"Status\": \"SUCCEEDED\",\n    \"StatusDetails\": { \"FailedStackInstancesCount\": 3 }\n  }\n}\n","json",[30,653,654,660,679,703,733,739],{"__ignoreMap":98},[102,655,656],{"class":104,"line":105},[102,657,659],{"class":658},"sP7_E","{\n",[102,661,662,666,670,673,676],{"class":104,"line":130},[102,663,665],{"class":664},"s39Yj","  \"",[102,667,669],{"class":668},"sseR_","StackSetOperation",[102,671,672],{"class":664},"\"",[102,674,675],{"class":658},":",[102,677,678],{"class":658}," {\n",[102,680,681,684,688,690,692,696,698,700],{"class":104,"line":319},[102,682,683],{"class":664},"    \"",[102,685,687],{"class":686},"sZMiF","Status",[102,689,672],{"class":664},[102,691,675],{"class":658},[102,693,695],{"class":694},"sjJ54"," \"",[102,697,557],{"class":112},[102,699,672],{"class":694},[102,701,702],{"class":658},",\n",[102,704,706,708,711,713,715,718,720,723,725,727,730],{"class":104,"line":705},4,[102,707,683],{"class":664},[102,709,710],{"class":686},"StatusDetails",[102,712,672],{"class":664},[102,714,675],{"class":658},[102,716,717],{"class":658}," {",[102,719,695],{"class":664},[102,721,722],{"class":325},"FailedStackInstancesCount",[102,724,672],{"class":664},[102,726,675],{"class":658},[102,728,729],{"class":325}," 3",[102,731,732],{"class":658}," }\n",[102,734,736],{"class":104,"line":735},5,[102,737,738],{"class":658},"  }\n",[102,740,742],{"class":104,"line":741},6,[102,743,744],{"class":658},"}\n",[26,746,747,749,750,752],{},[30,748,557],{}," with a non-zero ",[30,751,722],{}," is the signature of a partially deployed baseline. Treat that field, not the operation status, as the definition of done.",[41,754,756],{"id":755},"drift-across-a-stack-set","Drift across a stack set",[26,758,759,760,763],{},"Drift detection at the stack set level runs stack-level drift detection on every stack instance and rolls the answers up. One drifted resource makes its stack drifted, one drifted stack makes its instance drifted, and one drifted instance makes the entire stack set ",[30,761,762],{},"DRIFTED",".",[93,765,767],{"className":95,"code":766,"language":97,"meta":98,"style":98},"aws cloudformation detect-stack-set-drift --stack-set-name org-baseline\n",[30,768,769],{"__ignoreMap":98},[102,770,771,773,775,778,780],{"class":104,"line":105},[102,772,109],{"class":108},[102,774,113],{"class":112},[102,776,777],{"class":112}," detect-stack-set-drift",[102,779,120],{"class":119},[102,781,782],{"class":112}," org-baseline\n",[26,784,785,786,789,790,501,793,501,796,501,799,801,802,805,806,763],{},"The operation returns an ID because it is long running, and ",[30,787,788],{},"describe-stack-set-operation"," reports the counts as it progresses: ",[30,791,792],{},"DriftedStackInstancesCount",[30,794,795],{},"InSyncStackInstancesCount",[30,797,798],{},"InProgressStackInstancesCount",[30,800,722],{},", out of ",[30,803,804],{},"TotalStackInstancesCount",". Only one drift detection operation can run on a given stack set at a time, and you can stop it with ",[30,807,808],{},"stop-stack-set-operation",[26,810,811],{},"Two boundaries decide how much a clean result is worth:",[151,813,814,824],{},[154,815,816,819,820,823],{},[52,817,818],{},"Changes made through CloudFormation are never drift."," Update one target account's stack directly to a different template and drift detection still reports ",[30,821,822],{},"IN_SYNC",", because the stack matches its own expected configuration. That stack is now inconsistent with its siblings, which is a genuine problem, and drift detection is not the tool that finds it.",[154,825,826,829],{},[52,827,828],{},"Stack-level detection does not roll up."," Run detection on an individual stack in a target account and those results never appear on the StackSets console page. Start detection at the stack set level or the stack set's drift status stays stale.",[26,831,832],{},"Parameter overrides are handled correctly: because detection runs per stack, an instance with overridden parameter values is compared against its own overridden expectations, not the stack set default.",[41,834,836],{"id":835},"when-operations-fail","When operations fail",[26,838,839],{},"The failures cluster into a short list, and the status reason usually names the cause directly.",[188,841,842,852],{},[191,843,844],{},[194,845,846,849],{},[197,847,848],{},"Symptom",[197,850,851],{},"Cause",[206,853,854,864,872,880,888,896],{},[194,855,856,861],{},[211,857,858],{},[30,859,860],{},"should have 'AWSCloudFormationStackSetExecutionRole' role with trust relationship...",[211,862,863],{},"Self-managed trust chain missing or misnamed in the target",[194,865,866,869],{},[211,867,868],{},"Failure in one account, template fine elsewhere",[211,870,871],{},"Insufficient permissions on the execution role for a resource type in that account",[194,873,874,877],{},[211,875,876],{},"Failures across many accounts on a global name",[211,878,879],{},"The template creates a globally unique resource, such as an S3 bucket with a fixed name",[194,881,882,885],{},[211,883,884],{},"A quota error in some accounts only",[211,886,887],{},"The target account already holds the maximum of a resource the template creates, such as IAM roles",[194,889,890,893],{},[211,891,892],{},"Delete fails on one stack",[211,894,895],{},"Termination protection is enabled on that stack",[194,897,898,904],{},[211,899,900,901,903],{},"Instance stuck ",[30,902,593],{}," after an import",[211,905,906,907,909],{},"The import failed; delete the instance with ",[30,908,601],{},", fix, retry",[26,911,912,913,915],{},"Retrying is not a special API. You fix the underlying cause, then run an update on the stack set with the same or a corrected template, and the ",[30,914,585],{}," instances catch up.",[26,917,918],{},"The quotas that matter at scale: 1,000 stack sets per administrator account, 100,000 stack instances per stack set, and 10,000 stack instance operations running at once per Region per administrator account across all stack sets. Hitting the last one is what makes a large rollout mysteriously slow rather than failed.",[41,920,922],{"id":921},"exam-tips","Exam tips",[151,924,925,928,931,939,942,945,953,956,964,970],{},[154,926,927],{},"\"Deploy the same template to many accounts and Regions from one place\" is StackSets. An answer describing a script that loops over accounts is wrong even when it would work.",[154,929,930],{},"\"Accounts managed by AWS Organizations\" plus \"new accounts should get it automatically\" is service-managed permissions with automatic deployment. \"Accounts outside the organization\" or \"no organization\" forces self-managed.",[154,932,933,935,936,938],{},[30,934,158],{}," lives in the administrator account, ",[30,937,172],{}," in every target. A status reason naming the execution role is a self-managed trust problem, never a trusted access problem.",[154,940,941],{},"The management account never gets a service-managed stack instance. Watch for scenarios where the missing account is the management account.",[154,943,944],{},"Failure tolerance is per Region and rounds down. Exceeding it in one Region cancels the remaining Regions.",[154,946,947,948,950,951,763],{},"An operation status of ",[30,949,557],{}," with missing resources means failure tolerance absorbed the failures. Look at ",[30,952,722],{},[154,954,955],{},"Retain stacks keeps the resources and drops the stack set association. It does not delete anything.",[154,957,958,960,961,963],{},[30,959,585],{}," means a failed or skipped operation. ",[30,962,593],{}," means the instance is excluded from future updates until you delete it.",[154,965,966,967,763],{},"Service-managed stack sets do not support nested stacks, macros, or transforms, including ",[30,968,969],{},"AWS::Serverless",[154,971,972],{},"Drift detection on a stack set never treats a CloudFormation-made change as drift.",[26,974,975],{},"Carry one rule out of this lesson: with StackSets, \"deployed\" is a per-instance fact, not a per-operation one. Before you call a rollout complete, look at the instance statuses and the failed instance count, because the operation status is designed to tell you something narrower than what you want to know.",[26,977,978],{},"StackSets pushes identical resources into accounts. The next lesson covers the opposite move: keeping one resource in one account and letting other accounts use it, with AWS RAM.",[980,981,982],"style",{},"html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}",{"title":98,"searchDepth":319,"depth":319,"links":984},[985,986,987,988,989,990,991,992],{"id":43,"depth":130,"text":44},{"id":139,"depth":130,"text":140},{"id":336,"depth":130,"text":337},{"id":447,"depth":130,"text":448},{"id":547,"depth":130,"text":548},{"id":755,"depth":130,"text":756},{"id":835,"depth":130,"text":836},{"id":921,"depth":130,"text":922},"md",[995],{"slug":88,"concept":996,"style":997,"aspectRatio":998,"labels":999},"A single-template-to-many-stacks diagram. One template box sits at the top left inside a stack set container; from it, arrows fan out to a grid whose rows are target accounts and whose columns are AWS Regions. Each cell in the grid is one stack instance, and the cells carry mixed statuses so the learner sees that instances are tracked individually rather than as one unit. The emphasis is on the account-by-Region multiplication, and the footer states the counting rule in one sentence.","diagram","16:9",[1000,213,1001,1002,1003,1004,62,66,1005,1006,1007,1008],"Stack set: one template, one set of parameters, one administrator account","AWS Regions","Account 111122223333","Account 444455556666","Account 777788889999","Stack instance: CURRENT","Stack instance: OUTDATED, the last operation failed here","Stack instance: a reference that can exist with no stack behind it","3 accounts by 2 Regions is 6 stack instances, and each one succeeds or fails on its own.",[13,14,15,16,17,18,19],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/03-multi-account-provisioning/01-cloudformation-stacksets",{"passingScore":1013,"questions":1014},70,[1015,1024,1032,1040,1048,1058,1066,1074,1080,1088],{"question":1016,"type":1017,"options":1018,"correctAnswer":1020,"explanation":1023},"What is the relationship between a stack instance and a stack in CloudFormation StackSets?","single",[1019,1020,1021,1022],"A stack instance is another name for the stack that the stack set created","A stack instance is a reference to a stack in one target account and Region, and it can exist even when the stack does not","A stack instance is a nested stack inside the administrator account's stack","A stack instance is the template that each target account receives","The stack instance is the bookkeeping record that ties one account and Region pair to the stack set, and the stack is the actual set of resources. Keeping them separate is what lets CloudFormation show you a stack instance whose stack was never created, along with the reason it failed.",{"question":1025,"type":1017,"options":1026,"correctAnswer":1030,"explanation":1031},"A team runs a stack set from an administrator account that is not part of any AWS Organization, deploying into 6 accounts owned by a partner company. Which permission model applies?",[1027,1028,1029,1030],"Service-managed permissions, because the accounts are external","Service-managed permissions with an account filter of UNION","Either model works, because permission models only affect the console","Self-managed permissions, with an execution role created in each of the 6 accounts","Service-managed permissions only reach accounts inside your own organization, so an external target rules it out. Self-managed permissions work for any account where you can create the execution role that trusts your administration role, which is exactly the cross-company case.",{"question":1033,"type":1017,"options":1034,"correctAnswer":1035,"explanation":1039},"Trusted access is activated and a service-managed stack set targets the organization root. The management account also runs workloads. What happens to the management account?",[1035,1036,1037,1038],"No stack is deployed to the management account","A stack is deployed, because the management account is part of the organization","A stack is deployed only if automatic deployment is enabled","The operation fails with an error about the management account","CloudFormation never deploys service-managed stack instances to the organization's management account, even when the target is the whole organization. If that account needs the same resources, you deploy them separately, which is a favorite gap in real baseline rollouts.",{"question":1041,"type":1017,"options":1042,"correctAnswer":1045,"explanation":1047},"A stack set deploys to 10 accounts in each of 3 Regions. Failure tolerance is set to 20 percent. Two stacks fail in the first Region and a third fails in the same Region. What does CloudFormation do?",[1043,1044,1045,1046],"It stops immediately after the first failure in the Region","It continues through all 3 Regions and reports the failures at the end","It stops the whole operation and does not move on to the remaining Regions","It retries the 3 failed stacks before continuing","Failure tolerance is evaluated per Region, and 20 percent of 10 accounts rounds down to 2 allowed failures, so the third failure crosses the threshold. Crossing it in one Region sets the operation to FAILED and cancels the remaining Regions rather than pushing a broken template further.",{"question":1049,"type":1050,"options":1051,"correctAnswers":1056,"explanation":1057},"Which two statements about service-managed stack sets are true? (Choose 2.)","multiple",[1052,1053,1054,1055],"Automatic deployment adds a stack to accounts that join a target OU later","You can restrict a delegated administrator to a single OU","Templates containing macros or transforms are not supported","Stack instances can be created in accounts outside the organization by account ID",[1052,1054],"Automatic deployment is the reason most baselines use the service-managed model: a new account inherits the stack without anyone running an operation. The two distractors are the limits people expect to exist and do not: a delegated administrator has full deployment reach across the organization, and no service-managed stack set can leave the organization.",{"question":1059,"type":1017,"options":1060,"correctAnswer":1061,"explanation":1065},"An operator deletes stack instances from a stack set and selects the Retain stacks option. What is the result in the target accounts?",[1061,1062,1063,1064],"The stacks and their resources keep running, no longer associated with the stack set","The stacks are deleted but their resources are retained","The stacks stay associated with the stack set but stop receiving updates","The stacks are moved to the administrator account","Retain stacks disassociates without destroying: the stack stays in the target account and is managed there in CloudFormation from then on. This is the standard move when a workload needs to graduate out of a central baseline without an outage.",{"question":1067,"type":1017,"options":1068,"correctAnswer":1070,"explanation":1073},"A stack set operation completes with a status of SUCCEEDED, but three accounts are missing the new resources. What is the most likely explanation?",[1069,1070,1071,1072],"SUCCEEDED means the resources exist and the console is stale","The failure tolerance was set high enough to absorb all three failures","The three accounts were skipped because they are in a different Region","Automatic deployment has not run for those accounts yet","The operation status only says the failure tolerance was never exceeded, not that every stack succeeded. Check FailedStackInstancesCount in the operation's status details, then filter stack instances by detailed status and last operation ID to find which accounts need redeploying.",{"question":1075,"type":1017,"options":1076,"correctAnswer":1078,"explanation":1079},"True or False: running drift detection on a stack set also shows drift results for a stack that an operator checked directly in a target account.",[1077,1078],"True","False","Drift results produced by running detection on an individual stack are not surfaced on the StackSets console page, so the stack set can still show a stale drift status. Detection has to be started at the stack set level for the results to roll up into the stack set's drift status and counts.",{"question":1081,"type":1017,"options":1082,"correctAnswer":1085,"explanation":1087},"An administrator updates a stack in a target account through CloudFormation, changing it to a different template than the stack set uses. What does StackSets drift detection report for that stack instance?",[1083,1084,1085,1086],"DRIFTED, because the stack no longer matches the stack set's template","INOPERABLE, because the stack diverged from the stack set","IN_SYNC, because drift only covers changes made outside CloudFormation","NOT_CHECKED, because the template changed","Drift compares each resource against the expected state recorded in CloudFormation for that stack, so a change made through CloudFormation becomes the new expected state. Divergence from siblings in the stack set is a real operational problem, but it is not what drift detection measures.",{"question":1089,"type":1017,"options":1090,"correctAnswer":1094,"explanation":1095},"A stack set operation fails in every target account with the status reason: Account 123456789012 should have 'AWSCloudFormationStackSetExecutionRole' role with trust relationship to Role 'AWSCloudFormationStackSetAdministrationRole'. What is the fix?",[1091,1092,1093,1094],"Raise the failure tolerance so the operation can complete","Switch the stack set to a Region where the accounts are enabled","Activate trusted access with AWS Organizations","Create the execution role in each target account with a trust policy naming the administrator account","That message is the self-managed model reporting that the trust chain is missing, so the administration role has nothing to assume in the target. Trusted access is the service-managed setup step and does nothing here, and raising failure tolerance would only convert a visible failure into a quiet one.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/03-multi-account-provisioning/01-cloudformation-stacksets","HWpOvfN416y4EZsVt6mBB5pQrE6LKRuFbZU3E_mk62I",{"locked":9,"reason":1100,"meta":1101,"item":3},"paywall",{"title":1102,"description":1103,"isFree":5,"estimatedMinutes":10,"difficulty":11,"learningObjectives":1104},"Service Catalog and Control Tower","Letting teams provision for themselves without handing them the keys: Service Catalog portfolios, products, and constraints, shared versus copied catalogs, and the Control Tower landing zone with its OUs, shared accounts, controls, and drift.",[1105,1106,1107,1108,1109,1110],"Explain how a launch constraint lets an end user provision resources they have no permission to create","Choose the right Service Catalog constraint type for a given governance requirement","Compare a shared portfolio with a portfolio copied by a StackSet, and state what a recipient administrator can change","Describe the structure a Control Tower landing zone creates and what lives in each shared account","Distinguish preventive, detective, and proactive controls by the mechanism each uses","Recognize the events that put a landing zone into drift and what drift blocks",{"locked":9,"reason":1100,"meta":1112,"item":3},{"title":1113,"description":1114,"isFree":5,"estimatedMinutes":1115,"difficulty":11,"learningObjectives":1116},"Resource Sharing with AWS RAM","Sharing one resource with many accounts instead of duplicating it: resource shares and managed permissions, the two-layer permission model, invitations and organization sharing, and the ownership split inside a shared VPC subnet.",28,[1117,1118,1119,1120,1121,1122],"Explain what a resource share contains and why the owning account keeps ownership","Enable sharing with AWS Organizations correctly and describe when invitations are required","Describe the two-layer permission model of managed permissions plus consumer IAM policies","Identify which resource types can be shared outside an organization and which cannot","Divide responsibilities correctly between a VPC owner and a participant in a shared subnet","Use Availability Zone IDs to place resources consistently across accounts"]