One account in a grocery chain's StackSet failed an update that succeeded in every other account. The template and parameters were the same. What should the operator inspect first?
Select an answer to reveal the explanation.
Short Explanation
When every oven but one finishes the same recipe, you inspect that oven, not the recipe card. One StackSet account failed while the others succeeded, so the template is the unlikely cause. Look at the role that account uses and at any service control policy that applies only there.
Full Explanation
A StackSet operation runs per stack instance. The same template and parameters can succeed everywhere except one account when that account alone denies the call. Inspect the role StackSets assumes in the failed account, and inspect service control policies on that account or its organizational unit for a deny on the action or the resource type. Retry only that failed stack instance after the deny is gone so accounts that already succeeded stay as they are. A template syntax problem fails the operation broadly, not in one account that received the same template. The administrator role in a Region that already succeeded is a weak first stop, because that path just worked for this StackSet. A stack-count limit in an account that succeeded does not explain the account that failed. Caveat: the operation summary can look successful while one stack instance failed, so read the instance status reason rather than the summary alone. Operational check: compare the failed account's role trust and service control policies with an account that succeeded, remove the deny, and retry that stack instance.