---
title: Deploy Access with AWS StackSets
description: Deploy and manage Arpio access across multiple AWS accounts from a single management account using CloudFormation StackSets
---

[Skip to content](https://docs.arpio.io/deploy-access-with-aws-stacksets#main-content)

English

Show submenu for translations

[Customer ticket portal](https://docs.arpio.io/tickets-view?hsLang=en)

- Home
- Products
- Pricing
- Blog
- Company

Open main navigation

Close main navigation

- Home
- Products
- Pricing
- Blog
- Company
- English
  
  Show submenu for translations
- [Customer ticket portal](https://docs.arpio.io/tickets-view)

 Welcome to Arpio Technical Docs

- There are no suggestions because the search field is empty.

1. [Arpio Documentation](https://docs.arpio.io/?hsLang=en)
2. [AWS Reference Guides](https://docs.arpio.io/aws-reference-guides?hsLang=en)
3. [AWS Access](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-access)

# Deploy Access with AWS StackSets

## Use CloudFormation StackSets to deploy Arpio access across multiple AWS accounts from a central management account. StackSets simplify access management by allowing you to deploy and update Arpio permissions across your entire organization from a single location.

 

For a scaled approach: the docs [here](https://docs.arpio.io/automating-arpio-stacksets?hsLang=en) describe how to automate StackSets deployment using the Arpio API and AWS CloudFormation CLI.

*Jump to:*

- [Overview](https://docs.arpio.io/deploy-access-with-aws-stacksets#overview)
- [Prerequisites](https://docs.arpio.io/deploy-access-with-aws-stacksets#prerequisites)
- [Step 1: Create IAM Roles](https://docs.arpio.io/deploy-access-with-aws-stacksets#step1)
- [Step 2: Create StackSets](https://docs.arpio.io/deploy-access-with-aws-stacksets#step2)
- [Step 3: Deploy Stack Instances](https://docs.arpio.io/deploy-access-with-aws-stacksets#step3)
- [Scenario: Migrating from CloudFormation Templates](https://docs.arpio.io/deploy-access-with-aws-stacksets#scenario)
- [Adding Additional Applications](https://docs.arpio.io/deploy-access-with-aws-stacksets#adding)
- [Updating Stack Instances](https://docs.arpio.io/deploy-access-with-aws-stacksets#update)

 

 

#### **Overview**

AWS CloudFormation StackSets extend CloudFormation functionality by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. For Arpio, this means you can manage access permissions for all your applications from your AWS management account.

**Benefits of using StackSets:**

- **Centralized management:** Deploy and update Arpio access from a single management account
- **Simplified updates:** When Arpio releases permission updates, apply them once to update all accounts
- **Reusable across applications:** A single StackSet pair can serve your entire organization
- **Consistent permissions:** Ensure all accounts have identical Arpio access configurations

**StackSets Architecture Components:**

| **Component** | **Quantity** | **Scope** | **Notes** |
| --- | --- | --- | --- |
| Administration Role | 1 | Management account | One-time setup, enables StackSet operations |
| Execution Role | 1 per account | Each target account | Allows StackSets to deploy resources |
| StackSets | 1 pair (minimum) | Management account | Primary + Recovery; reusable for all apps |
| Stack Instances | 1 per account/region | Target accounts | Deploys actual Arpio access roles |

#### **Prerequisites**

Before you begin, ensure you have:

- **AWS Management Account:** An AWS account designated as your management account for StackSet operations
- **Target AWS Accounts:** The source (primary) and recovery AWS accounts for your Arpio application
- **AWS CLI or CloudShell:** Access to run AWS CLI commands in each account
- **IAM Permissions:** Administrator access or permissions to create IAM roles and CloudFormation StackSets

**ℹ️ Note:** Best practice is for your management account to be a dedicated account (separate from your primary or recovery workload accounts).

#### **Getting Started**

To deploy Arpio access with StackSets, start by creating a new application in Arpio:

1. Log in to your Arpio account
2. Click **Create New Application**
3. Enter your application name, source account/region, and recovery account/region
4. Set your Recovery Point Objective (RPO)
5. Click **Continue**

On the next screen, you will see “AWS StackSets” as an option to manage Arpio’s access permissions. Select “AWS StackSets” and Click the “CONTINUE WITH AWS STACKSETS” button. 

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-24-0869-AM.png?width=670&height=281&name=undefined-Feb-27-2026-12-21-24-0869-AM.png)

On the next screen, you will see the StackSets deployment instructions. The page is organized into three main steps:

- **Step 1:** Set Up IAM Roles (Administration Role + Execution Roles)
- **Step 2:** Create StackSets (Primary Access + Recovery Access)
- **Step 3:** Deploy Stack Instances to your target accounts

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-23-7298-AM.png?width=670&height=318&name=undefined-Feb-27-2026-12-21-23-7298-AM.png)

*Figure 2: Deploy Access with AWS StackSets - Overview*

 

#### **Step 1: Create IAM Roles**

StackSets require two IAM roles to operate: an Administration Role in your management account, and an Execution Role in each target account.

**1a. Create Administration Role**

The Administration Role is deployed once in your management account. It allows CloudFormation to assume roles in your target accounts.

1. Enter your **Management Account ID** in the input field. (This can be found by going to AWS Organizations in the AWS console from a member account.)
2. Open AWS CloudShell (or AWS CLI) using an Administrator role in your **management account**
3. Click **Copy** or **Download** to get the Administration Role command
4. Paste and run the command in CloudShell

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-24-3562-AM.png?width=670&height=565&name=undefined-Feb-27-2026-12-21-24-3562-AM.png)

The command creates a CloudFormation stack named ArpioStackSetAdministrationRole. Wait for the stack creation to complete before proceeding.

**Expected output:**

`{  "StackId": "arn:aws:cloudformation:us-east-1:YOUR-ACCOUNT:stack/ArpioStackSetAdministrationRole/..."}`

 

**1b. Create Execution Roles**

The Execution Role must be deployed in **each target account** (your primary account and recovery account). This role allows the StackSet to deploy resources in those accounts.

1. Open AWS CloudShell in your **primary account**
2. Copy the Execution Role command from the Arpio UI
3. Run the command
4. Repeat for your **recovery account**

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-24-9855-AM.png?width=670&height=339&name=undefined-Feb-27-2026-12-21-24-9855-AM.png)

*Figure 3: Create Execution Role command*

 

**💡 Tip:** IAM roles are global resources. You only need to create the Execution Role once per account, regardless of which region you run the command in.

**Step 2: Create StackSets**

Create two StackSets in your management account: one for Primary Access and one for Recovery Access.

⚠️ **Important:** If a StackSet was already created for this application during a previous setup, you **must** reuse it. Enter the existing StackSet names in the input fields and skip the CloudShell commands. Creating new StackSets instead of reusing the existing ones will cause conflicts.

1. Enter names for your StackSets in the input fields (e.g., ArpioPrimaryAccess and ArpioRecoveryAccess)
2. Open AWS CloudShell in your management account
3. Copy and run the Primary Access StackSet command
4. Copy and run the Recovery Access StackSet command

 

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-24-7030-AM.png?width=670&height=568&name=undefined-Feb-27-2026-12-21-24-7030-AM.png)

*Figure 4: Create StackSets - Primary and Recovery Access*

#### **Step 3: Deploy Stack Instances**

Stack Instances deploy the actual Arpio access roles to your target accounts. Run these commands from your management account.

1. Copy and run the **Primary Access** Stack Instance command
2. Copy and run the **Recovery Access** Stack Instance command
3. Wait 1-3 minutes for the Stack Instances to deploy
4. Click **Test Access** to verify the deployment

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-25-3886-AM.png?width=670&height=538&name=undefined-Feb-27-2026-12-21-25-3886-AM.png)

*Figure 5: Deploy Stack Instances - Primary Access and Recovery Access*

 

When validation succeeds, you will see green checkmarks next to both Primary Access and Recovery Access. The **Continue** button will become enabled.

Click **Continue** to complete the application setup and proceed to resource selection.

 

#### **Scenario: Migrating from CloudFormation Templates**

If your AWS accounts already have Arpio access deployed via individual CloudFormation templates, you will see a warning message at Step 3.

The warning indicates:

> ⚠️ An existing Arpio CloudFormation stack (stack-name) exists in this account.Deploying via StackSets may fail if IAM roles conflict. Consider usingCloudFormation for this app, or remove the existing stack first.

**You have two options:**

**Option 1: Continue using CloudFormation templates for this application**

If you prefer to keep your existing setup, click **Back** and choose the CloudFormation deployment method instead of StackSets.

**Option 2: Migrate to StackSets**

To migrate to StackSets, you must first remove the existing CloudFormation stacks:

1. Open the AWS CloudFormation console in the affected account
2. Locate the existing Arpio access stack (name shown in the warning)
3. Delete the stack
4. Wait for deletion to complete
5. Repeat for any other accounts with existing stacks
6. Return to Arpio and run the Stack Instance commands

 

**⚠️ Warning:** Deleting the CloudFormation stack will temporarily remove Arpio's access to the account. Complete the Stack Instance deployment promptly to restore access.

 

#### **Adding Additional Applications**

One of the key benefits of StackSets is reusability. When you create additional Arpio applications, you can reuse your existing StackSets.

**Same accounts, different regions:**

- Skip Step 1 (IAM roles already exist in those accounts)
- Skip Step 2 (enter your existing StackSet names)
- Run Step 3 only (deploy new Stack Instances for the new regions)

**Different accounts:**

- Run Step 1b only (create Execution Roles in the new accounts)
- Skip Step 2 (enter your existing StackSet names)
- Run Step 3 (deploy Stack Instances for the new account/region combinations)

**💡 Tip:** A single StackSet pair can serve your entire organization. You only need to create additional StackSets if you prefer to organize them separately for different teams or environments.

#### **Troubleshooting**

The Arpio UI includes expandable troubleshooting sections for each step. If you encounter issues:

**Stack already exists error:**

If you see an error that a stack already exists, you may need to delete the existing CloudFormation stack before running the command again. Check the CloudFormation console in the appropriate account.

**Access validation fails:**

Wait 1-3 minutes after deploying Stack Instances, then click **Test Access** again. If it continues to fail, verify that all Stack Instance deployments completed successfully in the CloudFormation console.

**Permission denied errors:**

Ensure you have administrator access or appropriate IAM permissions to create roles and StackSets. The Execution Role requires the account ID of your management account—verify this value is correct.

#### **Updating Stack Instances**

Arpio periodically updates our permissions to introduce new capabilities to our automation. When that happens, a new set of CloudFormation templates are generated.

Template updates can be issued via CloudFormation in your management account using the following command:

> ```
> aws cloudformation update-stack-set \  --stack-set-name <YOUR-PRIMARY-STACKSET-NAME> \  --template-url <arpio-template-url> \  --administration-role-arn arn:aws:iam::<YOUR-MANAGEMENT-ACCOUNT-ID>:role/ArpioStackSetAdministrationRole \  --capabilities CAPABILITY_NAMED_IAM
> ```

 

If you're automating this process you may benefit from customizing the `update-stack-set` command with `--operation-preferences` such as `MaxConcurrentCount=10`

See AWS documentation for more details:

[https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/concurrency-mode.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/concurrency-mode.html)

[https://docs.aws.amazon.com/cli/latest/reference/cloudformation/update-stack-instances.html](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/update-stack-instances.html)

 

This command will need to be run once for each StackSet (primary and recovery). This will update the templates for all of the stack instances managed by each. The S3 template URL referenced in the command will not change.

In the Arpio console, you’ll be prompted to update your StackSets in the Application Settings “Upgrade” tab when a new template version is available. The above command will be automatically generated for the user to apply to their StackSets. Regardless of which application you access this command from, it will only need to be run once per StackSet to update all Arpio applications.

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-25-7687-AM.png?width=670&height=302&name=undefined-Feb-27-2026-12-21-25-7687-AM.png)

![](https://docs.arpio.io/hs-fs/hubfs/undefined-Feb-27-2026-12-21-26-1536-AM.png?width=670&height=324&name=undefined-Feb-27-2026-12-21-26-1536-AM.png)

…

#### **Summary**

Deploying Arpio access with StackSets provides centralized management and simplified updates across your organization. The key steps are:

1. **Create IAM Roles:** Administration Role in management account, Execution Role in each target account
2. **Create StackSets:** Primary Access and Recovery Access StackSets in management account
3. **Deploy Stack Instances:** Deploy to each account/region combination, then verify with Test Access

Once configured, your StackSets can be reused for all future Arpio applications, requiring only new Stack Instances for additional account/region combinations.

- [Getting Started](https://docs.arpio.io/getting-started?hsLang=en#main-content)
  
  
  
  
  
    - [New Account Setup](https://docs.arpio.io/getting-started?hsLang=en#new-account-setup)
    - [New Application Setup](https://docs.arpio.io/getting-started?hsLang=en#new-application-setup)
- [Arpio Fundamentals](https://docs.arpio.io/arpio-fundamentals?hsLang=en#main-content)
  
  
  
  
  
    - [Platform Fundamentals](https://docs.arpio.io/arpio-fundamentals?hsLang=en#platform-fundamentals)
    - [Platform Features](https://docs.arpio.io/arpio-fundamentals?hsLang=en#platform-features)
- [Arpio Reference Guides](https://docs.arpio.io/arpio-reference-guides?hsLang=en#main-content)
  
  
  
  
  
    - [Arpio API](https://docs.arpio.io/arpio-reference-guides?hsLang=en#arpio-api)
    - [Lifecycle Events](https://docs.arpio.io/arpio-reference-guides?hsLang=en#lifecycle-events)
    - [Role-Based Access Controls (RBAC)](https://docs.arpio.io/arpio-reference-guides?hsLang=en#role-based-access-controls-rbac)
    - [Single Sign-On (SSO) Integration](https://docs.arpio.io/arpio-reference-guides?hsLang=en#single-sign-on-sso-integration)
    - [Test Planning](https://docs.arpio.io/arpio-reference-guides?hsLang=en#test-planning)
    - [Test & Recovery How-To](https://docs.arpio.io/arpio-reference-guides?hsLang=en#test-recovery-how-to)
- [AWS Reference Guides](https://docs.arpio.io/aws-reference-guides?hsLang=en#main-content)
  
  
  
  
  
    - [AWS Resource Reference](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-resource-reference)
    - [AWS Configuration Tags](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-configuration-tags)
    - [AWS Access](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-access)
    - [AWS Testing](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-testing)
    - [AWS Solutions](https://docs.arpio.io/aws-reference-guides?hsLang=en#aws-solutions)
- [Azure Reference Guides](https://docs.arpio.io/azure-reference-guides?hsLang=en#main-content)
  
  
  
  
  
    - [Azure Resource Reference](https://docs.arpio.io/azure-reference-guides?hsLang=en#azure-resource-reference)
    - [Azure Configuration Tags](https://docs.arpio.io/azure-reference-guides?hsLang=en#azure-configuration-tags)
    - [Azure Scenarios](https://docs.arpio.io/azure-reference-guides?hsLang=en#azure-scenarios)
- [FAQ](https://docs.arpio.io/faq?hsLang=en#main-content)
  
  
  
  
  
    - [AWS FAQ](https://docs.arpio.io/faq?hsLang=en#aws-faq)
    - [Contact Support](https://docs.arpio.io/faq?hsLang=en#contact-support)
    - [License & Billing](https://docs.arpio.io/faq?hsLang=en#license-billing)
    - [Tests and Recoveries](https://docs.arpio.io/faq?hsLang=en#tests-and-recoveries)

- Home
- Products
- Pricing
- Blog
- Company

[![bubble-wand-tight.64](https://docs.arpio.io/hs-fs/hubfs/bubble-wand-tight.64.png?width=64&height=64&name=bubble-wand-tight.64.png "bubble-wand-tight.64")](https://arpio.io)

Copyright © 2026, Arpio