A central team must deploy a common IAM and logging baseline into new accounts in selected OUs, including accounts created later. Which tool most directly supports this deployment model?

1. A Route 53 private hosted zone association for each account.
2. CloudFormation StackSets with service-managed permissions and automatic deployment to the selected OUs.
3. A single ordinary stack in the management account with no cross-account deployment configuration.
4. An S3 lifecycle rule that runs when an account joins an OU.