You need to deploy an IAM role to the Organizations management account and all member accounts using CloudFormation, with the least operational overhead. Trusted access for CloudFormation is enabled and the organization has 10 accounts. Which approach meets the requirement with minimal operational work?

The correct answer is to create a CloudFormation StackSet with service-managed permissions targeting the root OU, and a separate CloudFormation stack in the management account. CloudFormation StackSets with service-managed permissions allow you to deploy stacks across accounts in an AWS Organization with minimal overhead, as AWS handles the necessary IAM roles. Targeting the root OU ensures deployment to all current and future member accounts. However, StackSets do not deploy to the management account itself when targeting an OU. Therefore, a separate CloudFormation stack is required in the management account to deploy the IAM role there, completing the requirement for all accounts. Using self-managed permissions would require manually creating IAM roles in each account, increasing operational overhead. Deploying only a StackSet to the root OU would miss the management account.