StackSets with SERVICE_MANAGED permission model can only have OrganizationalUnit as target

Question

Please help me get this error i want to deploy a stackset to just one account using the cloudformation
i get this error

> Resource handler returned message: "StackSets with SERVICE_MANAGED permission model can only have OrganizationalUnit as target (Service: CloudFormation, Status Code: 400, Request ID: 2c931872-6134-4a84-8276-a0c7106865b5)" (RequestToken: 830e2814-7239-4b19-68ed-8ddc035c7ec3, HandlerErrorCode: InvalidRequest)

Pls help correct my code and further guide and advise thank you very much.

```
  #-------- [TAcctStackSet] --------##
  # GetAtt[StackSetId] || Ref[StackSetId]
  TAcctStackSet:
    Type: AWS::CloudFormation::StackSet
    DeletionPolicy: Delete
    DependsOn: [TAcct]
    Properties:
      StackSetName: TAcctStackSet
      Description: "...."
      TemplateURL: ./stacksets/TAcctStackSet.yaml
      Parameters:
      - {ParameterKey: ManagementAccountID, ParameterValue: !Ref ManagementAccountID}
      Capabilities: [CAPABILITY_NAMED_IAM] #[Array of String]
      PermissionModel: SERVICE_MANAGED #Allowed Values[SERVICE_MANAGED | SELF_MANAGED]
      AutoDeployment: # Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target OU 
        Enabled: true
        RetainStacksOnAccountRemoval: false #[Only Set When AutoDeployment is Enabled]
      StackInstancesGroup: #[Array of StackInstances]
      - Regions: #[Array of String] 
        - us-east-1
        DeploymentTargets: # Note: [SERVICE_MANAGED permission model can only have OrganizationalUnit as target]
          # AccountFilterType: #Allowed Values[NONE | UNION | INTERSECTION | DIFFERENCE]
          # AccountsUrl: [String]
          # OrganizationalUnitIds:[!Ref OrganizationRootID] #[Array of String] #Req in SERVICE_MANAGED
          Accounts: [!Ref WorkloadsToolingAcct] #[Array of String]
          # - !GetAtt TestingOUAccount20240413.AccountId #!RefTestingOUAccount20240411
        ParameterOverrides: #[Array of Parameter]
        - {ParameterKey: ManagementAccountID, ParameterValue: !Ref ManagementAccountID}
```

Accepted Answer

Hello.

I thought that if I set "AccountFilterType" to "INTERSECTION", I could deploy only to the specified account.  
Also, try specifying the OU of the deployment destination AWS account in "OrganizationalUnitIds".  
https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-deploymenttargets.html  
```
  #-------- [TAcctStackSet] --------##
  # GetAtt[StackSetId] || Ref[StackSetId]
  TAcctStackSet:
    Type: AWS::CloudFormation::StackSet
    DeletionPolicy: Delete
    DependsOn: [TAcct]
    Properties:
      StackSetName: TAcctStackSet
      Description: "...."
      TemplateURL: ./stacksets/TAcctStackSet.yaml
      Parameters:
      - {ParameterKey: ManagementAccountID, ParameterValue: !Ref ManagementAccountID}
      Capabilities: [CAPABILITY_NAMED_IAM] #[Array of String]
      PermissionModel: SERVICE_MANAGED #Allowed Values[SERVICE_MANAGED | SELF_MANAGED]
      AutoDeployment: # Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to a target OU 
        Enabled: true
        RetainStacksOnAccountRemoval: false #[Only Set When AutoDeployment is Enabled]
      StackInstancesGroup: #[Array of StackInstances]
      - Regions: #[Array of String] 
        - us-east-1
        DeploymentTargets: # Note: [SERVICE_MANAGED permission model can only have OrganizationalUnit as target]
          AccountFilterType: INTERSECTION
          # AccountsUrl: [String]
          OrganizationalUnitIds: [!Ref OrganizationRootID] #[Array of String] #Req in SERVICE_MANAGED
          Accounts: [!Ref WorkloadsToolingAcct] #[Array of String]
          # - !GetAtt TestingOUAccount20240413.AccountId #!RefTestingOUAccount20240411
        ParameterOverrides: #[Array of Parameter]
        - {ParameterKey: ManagementAccountID, ParameterValue: !Ref ManagementAccountID}
```

StackSets with SERVICE_MANAGED permission model can only have OrganizationalUnit as target

Relevant content