A company uses AWS Organizations to create and manage many AWS accounts. The company wants to deploy new IAM roles in each account. Which action should the SysOps administrator take to deploy the…

The correct answer is C. Use AWS CloudFormation StackSets to deploy a template to each account to create the new IAM. StackSets enables you to create, update, or delete CloudFormation stacks across multiple AWS accounts and regions from a single administrator account, which is ideal for applying identical IAM role configurations across all accounts in an organization. This approach minimizes…

Submitted by yuki_2020· Mar 5, 2026Deployment, provisioning, and automation

Question

A company uses AWS Organizations to create and manage many AWS accounts. The company wants to deploy new IAM roles in each account. Which action should the SysOps administrator take to deploy the new roles in each of the organization's accounts?

Options

ACreate a service control policy (SCP) in the organization to add the new IAM roles to each
BDeploy an AWS CloudFormation change set to the organization with a template to create the new
CUse AWS CloudFormation StackSets to deploy a template to each account to create the new IAM
DUse AWS Config to create an organization rule to add the new IAM roles to each account.

How the community answered

(32 responses)

A
6% (2)
B
19% (6)
C
72% (23)
D
3% (1)

Explanation

StackSets enables you to create, update, or delete CloudFormation stacks across multiple AWS accounts and regions from a single administrator account, which is ideal for applying identical IAM role configurations across all accounts in an organization. This approach minimizes manual effort, ensures consistency, and scales with the number of accounts. It is the recommended pattern for cross-account resource provisioning within AWS Organizations.

Topics

#CloudFormation StackSets#multi-account deployment#IAM roles#AWS Organizations

Community Discussion

No community discussion yet for this question.

Full SOA-C03 Practice