A platform team must deploy guardrail VPCs, roles, and Config rules identically to 60 Organization accounts, prevent drift, and promote changes through dev to production with approvals. Manual console work caused inconsistency. Which IaC deployment strategy should the architect implement to deploy cloud resources consistently and securely across accounts?

The correct strategy succeeds because service-managed StackSets integrated with Organizations automatically rolls out identical VPCs, roles, and Config rules to all 60 accounts and auto-enrolls future accounts, while the CI/CD pipeline provides version control, change sets to preview impacts, scheduled drift detection to catch inconsistency, and approval gates to promote safely from dev to production. The self-managed pipeline without scheduled drift detection fails on sustained compliance because initial deployment may be consistent but later manual changes go undetected, violating the prevent-drift requirement and confusing deployment with ongoing governance. The CDK pipeline confined to a single account fails on multi-account scale because it offers strong synthesis, change sets, drift checks, and approvals yet lacks automatic Organization-wide rollout, so it cannot guarantee identical baselines across 60 accounts without major custom orchestration. The Service Catalog approach fails on lifecycle promotion because versioned products with launch constraints standardize self-service provisioning but distribute directly to accounts without staged dev-to-production pipelines and approvals, violating controlled promotion. Exam caveat is to match all verbs in the stem rather than selecting a familiar valid tool, watching for service-managed, all accounts, drift detection, and dev-to-production as a combined key. Practical check is to verify StackSets drift status, require change-set review and explicit approval before production execution, and pilot releases through development organizational units first.