A retail enterprise manages 80 AWS accounts under AWS Organizations with separate dev, test, and prod OUs. Platform teams must roll out identical VPC, logging, and guardrails quickly and keep them consistent after changes. Which approach should the cloud architect choose to deploy cloud resources consistently and securely across accounts?

Service-managed StackSets with versioned CloudFormation templates is the intended design because it integrates natively with AWS Organizations trusted access to target dev, test and prod OUs directly, automatically provisioning identical VPCs, logging and baseline guardrails to all 80 accounts and to future accounts joining an OU while propagating stack updates centrally to preserve consistency. Using StackSets with self-managed permissions fails on operational scale because it requires creating and maintaining administration and execution IAM roles in every account and manually managing account lists, which slows rollout and breaks automatic enrollment of new accounts. Publishing products through Service Catalog fails on enforcement model because it follows a self-service pull workflow where each account team must discover, launch and update the product, so the platform cannot guarantee rapid universal deployment or automatic remediation after changes. Relying only on SCPs with AWS Config rules fails on provisioning capability because those provide preventive and detective governance that can block noncompliant actions and flag drift but cannot create the required VPCs, log groups and baseline resources. For the exam, remember that service-managed permissions imply Organizations integration and automatic OU deployment while self-managed implies manual roles outside Organizations, and that governance controls do not substitute for deployment tools. In practice, verify trusted access is enabled, store templates in version control with change sets, and enable automatic deployment and drift detection for OU targets.