Status: IN
CloudFormation StackSets has two permission models: self-managed (manually create IAM roles in each target account) and service-managed (AWS auto-creates roles via AWS Organizations trusted access).
Source: entries/2026/03/11/AWSCloudFormation-latest-UserGuide-stacksets-prereqshtml.md