How to Apply a Base Configuration to New AWS Organizations Accounts?
A CloudOps engineer manages the security of accounts in an organization in AWS Organizations. The CloudOps engineer must implement a solution that applies a base configuration to all accounts when the accounts join the organization. Which solution will meet this requirement with the LEAST operational overhead?
Community Insight
The question tests the native AWS Organizations integration with CloudFormation StackSets; the trap is confusing AWS Config aggregation, which provides visibility, with actual configuration deployment.
AWS CloudFormation StackSets with automatic deployments applies a base configuration to accounts as they join AWS Organizations, without custom orchestration. This page confirms option A and explains why monitoring or Lambda-based approaches add operational overhead.
Choosing option D because it sounds automated; a custom Lambda still requires cross-account logic, event handling, retry behavior, and ongoing maintenance that StackSets automatic deployments already provides.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CloudFormation StackSets with automatic deployments is designed to deploy stack instances to accounts in an AWS Organization, including accounts that join later. The base configuration is defined once in a CloudFormation template, and StackSets handles the cross-account deployment mechanics. This directly satisfies the requirement to apply the configuration when accounts join while minimizing operational overhead.Why the Other Options Are Wrong
Option B turns on AWS Config and uses multi-account aggregation, but AWS Config evaluates and records resource state; it does not deploy a base configuration to new accounts. Option C uses a custom Lambda function with cross-account access, which requires custom detection, permissions, invocation, and error handling. Option D also uses Lambda to deploy the template, so it still depends on custom orchestration and cross-account setup instead of StackSets' native organization integration. StackSets automatic deployments is the managed, lower-overhead mechanism for this exact scenario.Community Comment Notes
Bad_Mat's comment states "Option A is the correct answer" and endorses CloudFormation StackSets automatic deployments. The comment aligns with the technical analysis but does not provide additional implementation detail. With no contrary votes or comments recorded, the community input is consistent with option A.Official Reference
Exam Strategy
When the requirement is a repeatable baseline for every account, look for a service-managed StackSets feature rather than a monitoring service or custom code. Automatic deployments specifically covers new accounts and is the lowest-overhead answer for organization-wide CloudFormation rollouts.
Frequently Asked Questions
Why is AWS Config aggregation not enough to apply a base configuration?
AWS Config records and aggregates resource compliance data; it does not deploy or modify resources, so it cannot enforce the baseline configuration itself.
Why not use a Lambda function to deploy the CloudFormation template?
A Lambda-based deployment needs custom cross-account roles, event detection, retries, and maintenance; StackSets automatic deployments provides this natively for organization accounts.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →