Multi-Account CloudFormation Deployment with Least Overhead

The scenario requires deploying a CloudFormation template across multiple AWS accounts (development, testing, production) with automatic updates triggered by Git commits and centralized management. The key constraint is minimizing operational overhead.

AWS CloudFormation StackSets is the native service designed for this exact use case. It allows you to create, update, or delete stacks across multiple accounts and regions from a single template. When combined with service-managed permissions, AWS handles the creation of IAM roles in target accounts, significantly reducing the administrative burden compared to self-managed permissions where the user must manually configure cross-account access.

Option A involves creating individual stacks and using CodePipeline with webhooks. While feasible, managing individual stacks per account and configuring webhooks for each introduces higher operational complexity and overhead than StackSets' built-in multi-account orchestration.

Option C suggests using Lambda to invoke CloudFormation APIs. This approach requires custom code to handle deployment logic, error handling, and permission management, which is high maintenance and contradicts the "least operational overhead" requirement.

Option D describes a single stack using cross-account roles. CloudFormation stacks are regional resources within a single account. You cannot deploy a single stack to multiple accounts directly; you need a mechanism like StackSets to orchestrate deployments across accounts.

Therefore, StackSets with service-managed permissions provides the most automated, centralized, and low-overhead solution for multi-account deployments.