Study guide
8.2 Multi-Account & Multi-Region Resource Sharing
AWS Certified CloudOps Engineer – Associate SOA-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Monitoring & Observability Infrastructure
1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms
2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation
2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda
3 Chapter 3: Performance Optimization for Compute, Storage & Databases
3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance
4 Chapter 4: Compute & Database Scalability and Elasticity
4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB
5 Chapter 5: High Availability, Fault Tolerance & Load Balancing
5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments
6 Chapter 6: Backup, Data Protection & Disaster Recovery
6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience
7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK
7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures
8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC
8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows
9 Chapter 9: Systems Manager & Event-Driven Operations Automation
9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation
10 Chapter 10: Identity, Access Management & Governance
10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs
11 Chapter 11: Data Security, Encryption & Vulnerability Management
11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings
12 Chapter 12: VPC Architecture, Endpoints & Network Protection
12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing
13 Chapter 13: DNS, Route 53 Routing & Content Delivery
13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator
14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity
14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting
8.2 Multi-Account & Multi-Region Resource Sharing
Key Takeaways Explain This Topic AI
AWS CloudFormation StackSets extends CloudFormation templates to orchestrate multi-account, multi-Region infrastructure deployments in a single coordinated operation.
Service-managed permissions integrate with AWS Organizations for automatic deployment and cleanup across Organizational Units without manual roles, whereas self-managed permissions utilize custom administration and execution IAM roles across standalone accounts.
Operational deployment preferences—Maximum Concurrent Accounts, Failure Tolerance, and Sequential versus Parallel Region concurrency—govern rollout blast radiuses and automate failure aborts.
AWS Resource Access Manager (AWS RAM) securely shares centralized AWS resources—including VPC subnets, Transit Gateways, Route 53 Resolver rules, and Aurora DB clusters—across accounts without provisioning duplicate infrastructure.
In a shared VPC architecture, participant accounts can launch compute and data resources in owner-managed subnets, but participants cannot view, modify, or delete resources owned by other accounts, and cannot directly attach external security groups.
Last updated: September 2026
8.2 Multi-Account & Multi-Region Resource Sharing
CloudOps Blueprint Focus: Managing multi-account infrastructure is a core domain of the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam. You must master AWS CloudFormation StackSets architecture and permission models, configure safe deployment preferences across accounts and Regions, govern shared resources using AWS Resource Access Manager (RAM), and enforce account-level security boundaries in centralized shared VPC environments.
Multi-Account Infrastructure with CloudFormation StackSets
In enterprise multi-account environments—where distinct accounts isolate production, staging, and security workloads—deploying infrastructure stack-by-stack introduces severe overhead and configuration drift. AWS CloudFormation StackSets extends CloudFormation templates by enabling administrators to provision, update, and manage stacks across hundreds of AWS accounts and multiple Regions in a single coordinated operation.
A StackSet implementation comprises three logical layers:
StackSet: The parent resource defining the CloudFormation template, parameters, and IAM capabilities.
Stack Instances: Pointers to individual stacks created in specific target accounts and Regions. A stack instance maps 1:1 to a physical stack.
Stack Operations: The actions executed across stack instances ( CREATE , UPDATE , DELETE , or DETECT_DRIFT ).
StackSets Permission Models: Service-Managed vs. Self-Managed
CloudFormation StackSets supports two distinct permission models governing cross-account authorization:
Feature Service-Managed Permissions Self-Managed Permissions
Directory Integration Integrated natively with AWS Organizations . Standalone AWS accounts or multi-organization setups.
Targeting Mechanism Targets Organizational Units (OUs) or entire organization. Targets explicit, comma-separated AWS Account IDs.
IAM Role Setup Zero manual IAM roles required. Uses Organizations service-linked roles. Requires manual provisioning of AWSCloudFormationStackSetAdministrationRole and AWSCloudFormationStackSetExecutionRole .
Automatic Deployment Automatically deploys stacks to accounts joining targeted OUs ( AutoDeployment: Enabled ). Not supported. New accounts must be manually targeted in subsequent updates.
Automatic Cleanup Automatically deletes stacks when accounts leave targeted OUs ( RetainStacksOnAccountRemoval: false ). Not supported. Stacks must be manually deleted prior to account removal.
Delegated Administration Supports delegating StackSet management to non-root member accounts (e.g., Security or Platform account). Not supported; StackSets must run from the primary administrator account.
In enterprise operations, Service-Managed permissions are standard. Delegated administration allows platform teams to manage organizational baselines—such as IAM password policies, AWS Config rules, and CloudWatch log forwarders—from a platform operations account without root access to the Organizations management account.
Operational Rollout Preferences: Concurrency & Failure Tolerances
Deploying across hundreds of accounts simultaneously poses substantial operational risk. A misconfiguration or hitting a service quota could trigger widespread outages. CloudFormation StackSets provides granular rollout controls to limit blast radiuses:
Maximum Concurrent Accounts: Sets the maximum number or percentage of target accounts where stack instances are deployed simultaneously (e.g., MaxConcurrentCount: 5 or MaxConcurrentPercentage: 20 ). Limiting concurrency prevents overwhelming AWS API rate limits and controls deployment velocity.
Failure Tolerance: Specifies the number or percentage of account deployment failures permitted before the entire StackSet operation halts immediately (e.g., FailureToleranceCount: 2 or FailureTolerancePercentage: 5 ). Remaining accounts remain untouched, preventing systemic failure propagation.
Region Concurrency:
Sequential: Deploys stacks across specified Regions one at a time. If the rollout in the initial canary Region fails, the operation aborts before altering subsequent Regions.
Parallel: Deploys to all designated Regions simultaneously, optimizing deployment speed when changes have been pre-validated.
Centralized Resource Sharing with AWS RAM
To eliminate redundant infrastructure, centralize governance, and minimize connectivity costs, AWS Resource Access Manager (AWS RAM) allows accounts to share supported AWS resources across AWS Organizations or with individual external accounts.
Key shareable resource types include:
Amazon VPC Subnets: Foundation of centralized shared VPC architectures.
AWS Transit Gateways (TGW): Shares transit hubs and route tables for inter-VPC connectivity.
Route 53 Resolver Rules: Distributes internal hybrid DNS resolution rules across all VPCs.
AWS License Manager Configurations: Centrally enforces enterprise software licensing rules.
Amazon Aurora DB Clusters: Shares database clones across accounts for testing and analytics.
AWS Network Firewall Rule Groups & IPAM Pools: Centralizes egress inspection and IP address allocations.
Centralized Shared VPC Architecture & Security Boundaries
In a Shared VPC model, network engineering teams decouple subnet routing and edge security from application workloads:
The Network Owner Account creates and owns the Amazon VPC, subnets, route tables, Internet Gateways, NAT Gateways, Transit Gateway attachments, and Network Access Control Lists (NACLs).
The Participant Accounts are application or microservice accounts granted access to specific subnets via an AWS RAM Resource Share.
Resource Permissions and Cross-Account Security Boundaries
Within a shared VPC, strict security boundaries isolate participants:
Ownership Isolation: Participant accounts can create, view, and manage their own resources (EC2 instances, EBS volumes, RDS databases, ENIs) inside the shared subnets. However, participants cannot view, modify, or delete resources owned by other participants or the network owner account.
Subnet & Routing Control: Participants cannot modify subnet CIDRs, route tables, or NACLs. Only the network owner retains administrative control over VPC routing.
Security Group Governance: Security groups are account-scoped. A participant account cannot directly attach a security group owned by another account.
Cross-Account Security Group Referencing: To permit inter-service communication, participant accounts reference peer security groups in inbound or outbound rules (e.g., Account B's database security group permits port 3306 from Account A's security group formatted as 111122223333/sg-0123456789abcdef0 ). Traffic routes over AWS private network links without exposing resources to the broader subnet CIDR.
StackSet Drift Detection & Remediation
Over time, manual modifications in member accounts cause configuration drift . CloudFormation StackSets provides centralized drift detection ( aws cloudformation detect-stack-set-drift ). This operation queries all stack instances across all target accounts and Regions, identifying out-of-band property modifications and parameter discrepancies without impacting production workloads.