A developer manages three AWS accounts, each with an Amazon RDS instance in a private subnet. The developer needs to create and later update database users consistently across all three accounts with minimal operational effort. Which approach provides the most operational efficiency?

The most operationally efficient approach is to use a CloudFormation template with a custom resource. CloudFormation allows for infrastructure as code, ensuring consistent deployment across accounts. A custom resource can invoke a Lambda function to execute the necessary database commands (e.g., SQL statements) to create and update users within the private subnet, as CloudFormation itself doesn't directly manage database users. This centralizes the user management logic and leverages CloudFormation's deployment capabilities. Creating a CloudFormation template that declares users directly isn't feasible, as CloudFormation doesn't have native resource types for database users within RDS instances. Writing a script and deploying EC2 instances is less efficient due to the overhead of managing EC2 instances and the manual execution of scripts. A single Lambda function trying to manage users across all accounts would require complex cross-account access and might introduce security concerns or single points of failure.