An organization manages 500 AWS accounts under AWS Organizations and finds many unattached EBS volumes. They want a Lambda function deployed to every account that runs every 30 minutes and tags EBS volumes that have been unattached for 7 days or more. Which approach is the most operationally efficient?

The most operationally efficient approach leverages AWS Organizations, CloudFormation StackSets, and a delegated administrator account. CloudFormation StackSets allow you to deploy and manage CloudFormation stacks across multiple accounts and regions from a single administrator account, which is ideal for managing 500 accounts. Including both the Lambda function and the EventBridge scheduled rule within the same CloudFormation template ensures that the function is deployed and automatically scheduled to run every 30 minutes in each target account, simplifying deployment and ongoing management. The incorrect options are less efficient. Creating a cross-account IAM role and using a custom script is more complex and less automated than StackSets. Deploying a Lambda and then separately configuring an EventBridge event bus in the delegated administrator to invoke it in member accounts introduces unnecessary complexity and potential cross-account invocation issues for a simple scheduled task. Using CodeDeploy is overkill for deploying a single Lambda function and doesn't offer the multi-account deployment benefits of StackSets.