CloudFormation StackSets

The CloudFormation StackSets service lets you deploy a single CloudFormation template across many AWS accounts and regions in your organization from one place. Prism creates a stack instance for each target account and region, tracks its status, and lets you update, sync, and delete the whole deployment as a unit.

What is CloudFormation StackSets?

AWS CloudFormation StackSets extends CloudFormation so that one template can be provisioned into multiple accounts and regions in a single operation. The Prism StackSets service manages the full lifecycle for you:

• Multi-account deployment, Paste or upload one template and deploy it to the accounts under any organizational units (OUs) you choose, in one or more regions
• Per-instance visibility, Every account and region combination gets its own stack instance with a live status and, when something goes wrong, the reason
• Controlled updates, Change a StackSet's template, parameters, targets, or regions, with a clear warning about which instances an update touches
• Manual sync, Preview and apply the instance changes needed when accounts join or leave your target OUs
• Safe teardown, Delete a StackSet while choosing whether the deployed stacks (and the resources in them) are destroyed or retained

Access

CloudFormation StackSets is part of the same Organization Services beta as Security Hub. CloudKeeper enables that beta for your organization on request, and doing so unlocks both Security Hub and StackSets at once, there is no separate StackSets switch. Once the beta is enabled:

1. An Admin grants StackSets access to individual admins or Organization Services users in Preferences > Admin Management. The StackSets toggle appears there alongside the Security Hub toggle.
2. Users with access see CloudFormation StackSets in the Organization Services sidebar.

info

Enabling the beta only makes the StackSets toggle available; it does not grant anyone access. Without a per-user StackSets access grant, the service does not appear in the sidebar even after CloudKeeper enables the beta for your organization.

How It Works: the Administration Account

StackSets uses the AWS self-managed permissions model. You pick one AWS account to act as the StackSets administration account, and every deployment is driven from it:

• The administration account holds the administration role that CloudFormation assumes to orchestrate StackSet operations.
• Every other onboarded account holds an execution role that the administration role assumes to create, update, and delete stacks in that account.
• Templates you paste or upload are stored in a private S3 bucket in the administration account.

Enabling the Service

1. Open Organization Services and select CloudFormation StackSets in the sidebar.
2. Choose the AWS account that will act as the administration account.
3. Review what will be created (see below) and confirm.

A progress screen appears while Prism provisions each account, then transitions to the StackSets list when provisioning finishes.

What Enablement Creates

Resource	Where	Purpose
CKPrism-StackSetAdministrationRole	Administration account	Assumed to orchestrate StackSet operations; trusts cloudformation.amazonaws.com and the Prism organization switch role
ck-prism-cfn-<account-id>-<region> S3 bucket	Administration account	Private bucket that stores the templates you paste or upload in the create wizard
CKPrism-StackSetExecutionRole	Every onboarded account	Assumed by the administration role to deploy stacks into the account; trusts the administration role

warning

CKPrism-StackSetExecutionRole is created with the AWS managed AdministratorAccess policy in every onboarded account. This is the standard permission model for self-managed StackSets — the execution role must be able to create whatever resources your templates describe — but it means anyone who can deploy a StackSet can create, modify, or delete any resource in the target accounts. Grant StackSets access accordingly.

The Role-Provisioning Grid

Prism tracks execution-role provisioning per account in a status grid (the role status panel). Each row shows an account's ID and name and a colored phase chip:

Phase	Meaning
Pending	Provisioning has not started for this account yet
Provisioning	The execution role is being created in this account
Provisioned	The execution role is in place
Failed	Provisioning failed for this account
Removing	The execution role is being removed (during disable)
Removed	The execution role has been removed

The grid appears in two places:

• On the enable "in progress" screen, it is view-only — you can watch each account's phase while enablement runs, but there is no retry button while the fan-out is still in progress.
• On the StackSets list page, any row whose phase is Failed shows a Retry button that reruns provisioning for just that account. If some accounts failed, the service is marked partial_failure and a warning banner appears above the list.

note

This per-account Retry provisions the execution role in an account. It is a different action from retrying a failed stack instance on a StackSet's detail page — see Retrying failed instances.

Restart Resilience

In-flight AWS StackSet operations (create, update, delete, and sync) re-attach after a backend restart: Prism persists the AWS operation ID, and a startup sweep resumes tracking them where they left off.

Role and service provisioning fan-outs (enable and disable) are not resumable. If the backend restarts while enablement or disablement is running, the affected accounts are marked failed, and you retry them from the role-provisioning grid on the StackSets list page.

Prerequisites

• Your organization has been onboarded to Prism by CloudKeeper
• CloudKeeper has enabled the Organization Services beta (which covers both Security Hub and StackSets) for your organization
• StackSets access enabled for your account by an Admin in Preferences > Admin Management
• At least one AWS account is onboarded in Prism

Related Pages

• Deploying a StackSet, The create wizard: template, parameters, capabilities, OU targets, and regions
• Updating & Sync, Editing a StackSet, syncing OU membership, retrying failures, and stopping operations
• Teardown, Deleting StackSets and disabling the service