StackSets, nesting & drift

Multi-account/Region IaC and drift detection.

At professional scale, IaC spans many accounts and Regions and must handle drift. Nested stacks, StackSets, and drift detection are the advanced CloudFormation capabilities that make large estates manageable.

Modularity and multi-account deployment

Nested stacks let you break a large template into reusable child stacks — a networking stack, a database stack, an app stack — composed into a parent, so teams reuse vetted building blocks instead of copying template code. StackSets take this across boundaries: they deploy a stack to many accounts and Regions from a single operation, which is how you roll out a security baseline, a logging configuration, or a standard VPC to an entire organization consistently. Combined with AWS Organizations, StackSets make org-wide, repeatable infrastructure a single managed action rather than a per-account chore.

# One operation → deploy a baseline stack to every account in an OU, in 3 Regions.
aws cloudformation create-stack-set --stack-set-name org-baseline \
  --template-body file://baseline.yaml --permission-model SERVICE_MANAGED
 
aws cloudformation create-stack-instances --stack-set-name org-baseline \
  --deployment-targets OrganizationalUnitIds=ou-xxxx \
  --regions eu-west-1 us-east-1 ap-southeast-1
# New accounts moved into the OU can auto-inherit the baseline.

Drift detection and IaC discipline

Even with IaC, someone may change a resource in the console, causing drift — live configuration diverging from the template. CloudFormation drift detection reports these divergences so you can reconcile them (update the template or revert the change), and a DevOps team treats unexplained drift as a signal to investigate. The broader discipline is to make IaC the only path to change: enforce it with preventive guardrails (SCPs, permission boundaries) so out-of-band changes are hard, run IaC scanning (cfn-lint, cfn-nag, Checkov) in the pipeline to catch misconfigurations pre-deploy, and detect drift on a schedule. This is how infrastructure stays consistent, compliant, and reproducible as the estate grows to professional scale.