StackSets: multi-account & region

Deploy one template everywhere.

A stack manages resources in one account and one region. A StackSet manages the same template across many accounts and regions from a single definition — deploy a security baseline (a config rule, an IAM role, a logging bucket) to every account in your AWS Organization, or roll an app to five regions, in one operation. It is the answer to “we need this identical infrastructure everywhere.”

$ aws cloudformation create-stack-set \
    --stack-set-name org-baseline --template-body file://baseline.yaml \
    --permission-model SERVICE_MANAGED --auto-deployment Enabled=true
 
$ aws cloudformation create-stack-instances --stack-set-name org-baseline \
    --deployment-targets OrganizationalUnitIds=ou-abc-123 \
    --regions us-east-1 eu-west-1

Governance at scale

With service-managed permissions and auto-deployment, a StackSet targeted at an Organizational Unit automatically deploys to new accounts as they join the OU — so a new team account gets your guardrails on day zero. Operation preferences control the rollout: how many accounts at once, the failure tolerance before it stops. This makes StackSets a core governance tool, not just a convenience.