Multi-Account Distribution
Explore strategies to distribute AWS resources across many accounts using StackSets for deploying individual copies and Resource Access Manager for sharing centrally owned resources. Understand failure scenarios, operational impacts, and rollback considerations to maintain availability, cost control, and security in large multi-account environments.
Most infrastructure decisions get easier once the constraints are named out loud, so start there. Assume 120 AWS accounts, an availability target of 99.9%, and traffic that's mostly steady but spikes hard during deployments, tripling control plane activity for short windows. Data must stay in us-east-1, the monthly budget has a hard ceiling, and the operational team is two people, so any approach that requires account-by-account fixes will miss the target.
The change request has two parts that look similar but behave differently under failure. Every account must get its own copy of a baseline resource that local workloads depend on, and a subset of accounts must consume a centrally owned shared resource without duplicating it. The first is a deploy everywhere problem; the second is a share from one place problem, and the evidence collected differs because the ownership boundary differs.
Before choosing a mechanism, the topology gets locked, and failure gets defined in observable terms. The management or delegated admin account triggers multi-account actions, member accounts receive deployments, and the shared resource owner account retains control of the shared resource lifecycle. Failure means at least ...