An organization must provision an application and its supporting resources across several AWS Regions using a single CloudFormation template. They use AWS Organizations and want to initiate and manage the deployment from a single management account. Which approach should a SysOps administrator use to satisfy these constraints?

CloudFormation StackSets with service-managed permissions are designed for deploying CloudFormation stacks across multiple AWS accounts and Regions from a central administrator account, which directly addresses the requirement for a single management account to provision resources across several Regions within AWS Organizations. Service-managed permissions simplify deployment by allowing StackSets to create necessary IAM roles automatically in target accounts. Storing a template in S3 with CRR only replicates the template, not the deployment, and passing parameters for accounts/Regions would require manual execution for each target. Creating a primary template that references nested stacks in S3 buckets in each target Region would be overly complex for managing deployments across multiple accounts and Regions. Placing a primary template in the management account that creates nested stacks and specifying destination accounts/Regions for each nested stack is not a native CloudFormation feature for cross-account/cross-Region deployments; nested stacks are typically within the same account and Region.