A platform team must place a standard security baseline (an incident response IAM role, a log forwarding configuration, and a set of AWS Config rules) into all 140 accounts of its organization, in three Regions. New accounts are vended weekly and must receive the baseline without anyone remembering to act.
Two organizational constraints apply. Company policy forbids using the organization's management account for day-to-day operations, so the platform team works from its own member account. Application teams must not be able to create the baseline resources themselves, because the baseline's IAM role has to be identical everywhere.