How to Apply a Base Configuration to New AWS Organizations Accounts?

SOA-C03 By islever Editorial Last updated Oct 20, 2026

Provision and maintain cloud resources. Automate the management of existing resources. Implement and manage security and compliance tools and policies.

Short answer

A Use AWS CloudFormation StackSets automatic deployments to apply the base configuration to each account when it joins AWS Organizations.

Question

A CloudOps engineer manages the security of accounts in an organization in AWS Organizations. The CloudOps engineer must implement a solution that applies a base configuration to all accounts when the accounts join the organization.
Which solution will meet this requirement with the LEAST operational overhead?

Create the configuration in an AWS CloudFormation template. Deploy the template to all accounts in the organization by using StackSets automatic deployments. Correct Answer
Turn on AWS Config in the organization's management account. Use multi-account, multi-Region data aggregation. Review results on the Aggregated Resources page.
Create an AWS Lambda function in the organization's management account to configure resources. Configure the Lambda function with cross-account access. Run the function when a new account is detected.
Create the configuration in an AWS CloudFormation template. Deploy the template to all accounts in the organization by using an AWS Lambda function that runs when a new account is detected.

Key Takeaways

The question tests the native AWS Organizations integration with CloudFormation StackSets; the trap is confusing AWS Config aggregation, which provides visibility, with actual configuration deployment.

AWS CloudFormation StackSets with automatic deployments applies a base configuration to accounts as they join AWS Organizations, without custom orchestration. This page confirms option A and explains why monitoring or Lambda-based approaches add operational overhead.

Common mistake: Choosing option D because it sounds automated; a custom Lambda still requires cross-account logic, event handling, retry behavior, and ongoing maintenance that StackSets automatic deployments already provides.

Expert Analysis

Why the Answer Is Correct

CloudFormation StackSets with automatic deployments is designed to deploy stack instances to accounts in an AWS Organization, including accounts that join later. The base configuration is defined once in a CloudFormation template, and StackSets handles the cross-account deployment mechanics. This directly satisfies the requirement to apply the configuration when accounts join while minimizing operational overhead.

Why the Other Options Are Wrong

Option B turns on AWS Config and uses multi-account aggregation, but AWS Config evaluates and records resource state; it does not deploy a base configuration to new accounts. Option C uses a custom Lambda function with cross-account access, which requires custom detection, permissions, invocation, and error handling. Option D also uses Lambda to deploy the template, so it still depends on custom orchestration and cross-account setup instead of StackSets' native organization integration. StackSets automatic deployments is the managed, lower-overhead mechanism for this exact scenario.

Community Comment Notes

Bad_Mat's comment states "Option A is the correct answer" and endorses CloudFormation StackSets automatic deployments. The comment aligns with the technical analysis but does not provide additional implementation detail. With no contrary votes or comments recorded, the community input is consistent with option A.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When the requirement is a repeatable baseline for every account, look for a service-managed StackSets feature rather than a monitoring service or custom code. Automatic deployments specifically covers new accounts and is the lowest-overhead answer for organization-wide CloudFormation rollouts.

Frequently Asked Questions

Why is AWS Config aggregation not enough to apply a base configuration?

AWS Config records and aggregates resource compliance data; it does not deploy or modify resources, so it cannot enforce the baseline configuration itself.

Why not use a Lambda function to deploy the CloudFormation template?

A Lambda-based deployment needs custom cross-account roles, event detection, retries, and maintenance; StackSets automatic deployments provides this natively for organization accounts.

More SOA-C03 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Bad_Mat 👍 1 Answered A

Option A is the correct answer: Create the configuration in an AWS CloudFormation template. Deploy the template to all accounts in the organization by using StackSets automatic deployments.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide