An auto-parts maker wants every new account that joins a specific organizational unit to receive a baseline stack, without an operator registering that account on the StackSet. What meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
You want new houses on this street to receive the same mailbox without a separate truck visit for each address. A service-managed StackSet aimed at the organizational unit, with automatic deployment on, gives a new account the stack. A self-managed set still waits for someone to enroll that account.
Full Explanation
Service-managed StackSets deploy through AWS Organizations. With automatic deployment enabled and the organizational unit selected as a target, stack instances are created for accounts that join that unit later, without an operator adding the account to the StackSet. Whether a stack is kept when an account later leaves the unit is a separate choice from deploying the stack on join. A self-managed StackSet still needs an execution role in each account and an explicit stack instance, which is the manual enrollment this requirement removes. A stack in the management account runs only in that account, and pasted outputs are not a deployed baseline. A RAM share can expose a resource, and it does not launch the CloudFormation stack in the new account by itself. Caveat: automatic deployment follows the organizational units you actually target, and trusted access between StackSets and Organizations has to be enabled or no new account receives the stack. Operational check: move a test account into the targeted unit and confirm a stack instance appears there without a separate create for that account.