Multi-account

Recommended. This is the equivalent of the single-account Launch Stack link, but it deploys a StackSet, and its wrapper stack creates the role in your management account as well. Sign in to your management account, then open:

https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-stackset-wrapper.template.json&stackName=LevelFour-Onboarding&param_LevelFourHandshakeID=&param_TargetOUId=

Enter the two parameters:

• LevelFourHandshakeID: the value LevelFour provided
• TargetOUId: the root ID or OU ID from the preflight output

At the bottom of the page, tick:

I acknowledge that AWS CloudFormation might create IAM resources with custom names.

Click Create stack. CloudFormation provisions the StackSet, which deploys the role to every account under the target. Status reaches CREATE_COMPLETE once all per-account stacks succeed, typically 2 to 5 minutes for a small target and longer for larger ones.

Use this if you want to see and confirm every StackSet option before clicking Create. Creating the StackSet from the console rather than through the Launch Stack wrapper template deploys the role only to accounts under your target OU or root, and this path has no inline role for the management account. Item 9 covers it. The Launch Stack tab does both in one deploy.

1. Console > CloudFormation > StackSets > Create StackSet

2. Permissions > Permission model: Service-managed permissions

3. Prerequisite - Prepare template > Prepare template: Template is ready

4. Specify template > Template source: Amazon S3 URL > paste:

   https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json

   Click Next.

5. Specify StackSet details:

   • StackSet name: LevelFour-Onboarding
   • Parameters > LevelFourHandshakeID: your handshake value

   Click Next.

6. Configure StackSet options:

   • Tags: leave empty (optional)
   • Execution configuration > Managed execution: leave Inactive (the default, and fine for a one-shot onboarding deploy; "Active" only matters if you will run concurrent StackSet operations)
   • Capabilities: tick I acknowledge that AWS CloudFormation might create IAM resources with custom names

   Click Next.

7. Set deployment options:

   • Add stacks to stack set: Deploy new stacks (default)
   • Deployment targets:
     • If you are onboarding the whole organization, pick Deploy to organization. No OU ID input needed, because AWS targets every member account under the root.
     • If you are scoping to a specific OU, pick Deploy to organizational units (OUs) and paste the OU ID from the preflight.
   • Auto-deployment options:
     • Automatic deployment: Activated
     • Account removal behavior: Delete stacks
     • Stack set dependencies: leave empty
   • Specify Regions: from the dropdown, add US East (N. Virginia) us-east-1 only. IAM is global, so one region is enough.
   • Deployment options: leave the defaults (Maximum concurrent accounts = 1, Failure tolerance = 0, Region concurrency = Sequential, Concurrency mode = Strict failure tolerance). For orgs with 100+ accounts where the rollout takes long, you can raise concurrency here. The defaults are safest.

   Click Next.

8. Review, then click Submit.

9. Deploy the role to the management account. Go through the single-account flow once in the management account with the same handshake ID. Skip this only if you do not need LevelFour to call organizations:ListAccounts from your management account (rare).

For IaC-first teams. The first two commands create the StackSet and its stack instances, which reach member accounts only. The third deploys the same per-account template into the management account with the same handshake, which is what the single-account flow does from the console. The Launch Stack tab handles both in one deploy.

aws cloudformation create-stack-set \
  --stack-set-name LevelFour-Onboarding \
  --template-url https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json \
  --permission-model SERVICE_MANAGED \
  --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameters ParameterKey=LevelFourHandshakeID,ParameterValue=<YOUR_HANDSHAKE_ID>

aws cloudformation create-stack-instances \
  --stack-set-name LevelFour-Onboarding \
  --deployment-targets OrganizationalUnitIds=<YOUR_ROOT_OR_OU_ID> \
  --regions us-east-1

aws cloudformation create-stack \
  --stack-name LevelFour-ManagementAccount \
  --template-url https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v2/onboarding-levelfour-cloudformation-template.json \
  --capabilities CAPABILITY_NAMED_IAM \
  --parameters ParameterKey=LevelFourHandshakeID,ParameterValue=<YOUR_HANDSHAKE_ID> \
  --region us-east-1

Recommended. In AWS CloudShell signed in to your management account:

curl -fsSL https://cf-templates-1bsphth8u70q9-us-east-1.s3.amazonaws.com/onboarding/v1/levelfour-handoff.sh | bash

It auto-detects your wrapper stack and prints the stack outputs, then one combined table of every active organization account with its LevelFour role status. Copy the whole picture into your reply.

Wrapper stack outputs:
-----------------------------------------------------------
| Output                | Value                           |
|-----------------------|---------------------------------|
| ManagementAccountId   | 123456789012                    |
| DeploymentTarget      | r-abcd                          |
| StackSetName          | LevelFour-Onboarding            |
| RoleNameInEachAccount | LevelFourCrossAccountRole       |
-----------------------------------------------------------

Active organization accounts and their LevelFour role status:

  Account ID      Name                              Role Status
  --------------  --------------------------------  ---------------
  123456789012    Org (management)                  CURRENT
  234567890123    Prod                              CURRENT
  345678901234    Staging                           CURRENT
  456789012345    Dev                               CURRENT

================ Send this to LevelFour ================
  ManagementAccountId : 123456789012
  Active accounts     : 4
  Role deployed to    : 4 of 4
========================================================

If any account is not CURRENT, the script flags it and explains the common causes: the management account missing on older deploys, or an SCP block.

The console does not surface the full account list in one place. CloudFormation outputs are stack-level only, and aggregating AWS Organizations data would need a custom Lambda resource, which the template does not include. You will need three short stops.

Stop 1. Wrapper stack outputs. Open the wrapper stack (LevelFour-Onboarding) > Outputs tab:

Stop 2. Member account rollout status. CloudFormation > StackSets > LevelFour-Onboarding > Stack instances tab. One row per member account. Every row should show Status: CURRENT. The management account is not in this table. It is covered by the inline LevelFourCrossAccountRole resource on the wrapper stack itself, which is already in CREATE_COMPLETE if you got this far.

Stop 3. All organization accounts. AWS Organizations console > Accounts. Cross-reference these with the StackSet's Stack instances table. Every active account should be either a row in Stop 2 (member, rolled out via StackSet) or the management account (covered by the wrapper).

The Handoff script tab does all three stops in one command, and prints an explicit "Send this to LevelFour" summary.

The same data the handoff script consolidates, raw:

aws cloudformation describe-stacks \
  --stack-name LevelFour-Onboarding \
  --region us-east-1 \
  --query 'Stacks[0].Outputs[].[OutputKey,OutputValue]' \
  --output table

aws cloudformation list-stack-instances \
  --stack-set-name LevelFour-Onboarding \
  --region us-east-1 \
  --query 'Summaries[].[Account,Region,Status]' \
  --output table

aws organizations list-accounts \
  --query 'Accounts[?Status==`ACTIVE`].[Id,Name]' \
  --output table

• The first command prints the wrapper stack outputs (your ManagementAccountId lives there).
• The second prints per-member-account rollout status from the StackSet. Every row should show Status: CURRENT. Any account in a FAILED or INOPERABLE state needs a per-account look, usually an SCP block. See Troubleshooting.
• The third prints every active account in your organization, including the management account, which is never in the StackSet's stack-instance list. It is covered by the inline LevelFourCrossAccountRole resource on the wrapper stack itself, which is already in CREATE_COMPLETE.

For the unified view the handoff script prints on its own, cross-reference the second and third tables. Every active account ID from the third should appear in the second with Status: CURRENT, except the management account.