DOP-C02 Practice Question 4: StackSets Service Managed Auto Deployment

The service-managed permission model is what integrates StackSets with AWS Organizations. With it you target organizational units instead of account ID lists, StackSets creates the required IAM roles in the member accounts on your behalf, and, critically for this scenario, you can turn on automatic deployment, which creates stack instances in accounts added to a target OU in the future and removes them from accounts moved out of it. Nothing runs on a schedule and no one issues a command. Trusted access with Organizations must be activated first, and the StackSet is administered from the management account or a registered delegated administrator.

Option A gets the outcome but by the wrong road. The self-managed model cannot target an OU at all, it takes explicit account IDs, so the team writes and owns reconciliation code, and there is a window between account creation and the next scheduled run in which a new account has no baseline. It also leaves the execution-role problem unsolved.

Option B still uses self-managed permissions, so the OU target it describes is not available, and it explicitly requires provisioning AWSCloudFormationStackSetExecutionRole into every member account, precisely the manual role maintenance the stem rules out.

Option C relies on humans. A shared Service Catalog product is a good pattern for self-service provisioning, but an account owner who never launches it leaves an account without the baseline, so the guarantee the stem asks for does not hold.

Reference: StackSets concepts