A gaming studio must roll out VPCs, roles, and GuardDuty detectors to 40 accounts across three Regions from one pipeline, with automatic rollout, failure containment, and drift visibility. Which IaC deployment model meets this?
Select an answer to reveal the explanation.
Short Explanation
Forty accounts times three Regions is a lot of clicking. You'll roll it out once with StackSets while guardrails contain faults and reveal drift.
Full Explanation
CloudFormation StackSets with managed rollout controls fits because one administrator template set can target 40 accounts across three Regions with automatic deployment to new accounts, concurrency and failure tolerance to contain regional failures, plus centralized operation status and drift detection for visibility. Central Terraform workspace automation from version control is production-proven for multi-account IaC, but it lacks native StackSets-style fault containment and ordered multi-region rollout management, so failures are harder to isolate without custom logic. Service Catalog distribution is excellent for governed self-service, but it depends on teams launching products themselves and therefore violates the automatic rollout from one pipeline requirement. A central pipeline creating separate stacks per account and Region provides orchestration yet bypasses StackSets lifecycle features, losing aggregated drift visibility and managed tolerance controls. For the exam, central pipeline alone is insufficient when failure containment plus drift visibility are explicitly required, which signals StackSets deployment options. Practically, confirm Organizations trusted access and delegated administrator, then validate concurrency settings in a test organizational unit.