Deploying a StackSet
The create wizard walks you through naming the StackSet, providing a CloudFormation template, filling in its parameters, choosing the organizational units (OUs) and regions to deploy to, and setting deployment preferences. Open it from the StackSets list with Create StackSet.
StackSet Name
| Rule | Detail |
|---|---|
| First character | Must be a letter |
| Allowed characters | Letters, digits, and hyphens |
| Maximum length | 128 characters |
Template
Choose a template source:
| Source | How it works |
|---|---|
| Upload a template file | Paste the template body or upload a .json / .yaml file. The template may be up to 450 KB (460,800 bytes). Prism uploads it to the private template bucket in the administration account (the ck-prism-cfn-<account-id>-<region> bucket created at enablement) — the same behavior as the AWS Console. |
| Amazon S3 URL | Point Prism at a template that already lives in one of your own S3 buckets (an https://…s3….amazonaws.com/… or s3://bucket/key URL). Prism reads the object directly using the administration role's read-only s3:GetObject permission and stores the URL as a live pointer instead of copying the file. |
Whichever source you choose, Prism validates the template before you can continue. Validation errors are shown inline.
An Amazon S3 URL source stays linked to that object. When a pipeline later overwrites the file at the same URL, roll the change out with Pull the latest template from this S3 URL on the Edit screen — no re-upload needed. See Refreshing from an S3 URL.
Parameters
After the template validates, the wizard generates a parameters form from the template's Parameters section — one field per parameter.
- Parameters declared with NoEcho are masked like passwords.
- If the template requires capability acknowledgements (for example, it creates IAM resources), the wizard shows the required capabilities and you must acknowledge them before continuing.
Targets: Organizational Units
Choose the target OUs from your organization's hierarchy. Deployment targets are resolved from the OUs you pick:
- Every account under a selected OU is targeted, including accounts in nested OUs.
- Accounts in the
SUSPENDEDstate are excluded. - Accounts under a target OU that are not onboarded in Prism are marked skipped — no stack is deployed to them.
Regions
Pick the AWS regions this StackSet deploys to. The region list is per StackSet, and Prism creates one stack instance per account × region — for example, 10 target accounts across 2 regions produce 20 stack instances.
Deployment Preferences
| Preference | Meaning |
|---|---|
| Failure tolerance (%) | The percentage of accounts, per region, in which stack operations can fail before CloudFormation stops the operation in that region |
| Max concurrent (%) | The percentage of target accounts CloudFormation deploys to at one time |
Tags
Optionally add tags. Tags are applied to the StackSet and propagate to the stacks it creates.
After You Submit
A progress screen appears while CloudFormation creates the stack instances, then the StackSet's detail view opens with the per-instance table.
Stack Instance Statuses
Each stack instance (one per account × region) shows one of the following statuses. Failed and skipped instances include a reason.
| Status | Meaning |
|---|---|
| Pending | The instance is queued but its operation has not started yet |
| Creating | The stack is being created in this account and region |
| Updating | The stack is being updated to the StackSet's latest template |
| Succeeded | The instance is deployed and running the StackSet's current template |
| Failed | The last operation on this instance failed; the reason is shown |
| Deleting | The instance is being removed |
| Deleted | The instance has been removed |
| Skipped | No stack was deployed to this target (for example, the account is not onboarded in Prism) |
When some instances succeed and others fail, the StackSet as a whole is reported as partial_failure.
Failed instances can be retried from the StackSet detail page — see Retrying Failed Instances.
Inspecting Stack Events
Expand any row in the instance table to see that instance's CloudFormation stack events — the same resource-level event stream the AWS Console shows on a stack's Events tab, read live from the target account. This is the quickest way to see why an instance is Failed or still Creating.
- Refresh reloads the events on demand.
- Auto-refresh is on by default and re-polls every few seconds while the row is expanded; toggle it off to freeze the timeline.
Related Pages
- CloudFormation StackSets, Service overview and enablement
- Updating & Sync, Rolling out template changes and keeping targets in sync
- Teardown, Deleting a StackSet