permissionModel 
  Describes how the IAM roles required for StackSet operations are created. By default, SELF-MANAGED is specified.
- With - self-managedpermissions, you must create the administrator and execution roles required to deploy to target accounts. For more information, see Grant self-managed permissions.
- With - service-managedpermissions, StackSets automatically creates the IAM roles required to deploy to accounts managed by Organizations. For more information, see Activate trusted access for StackSets with Organizations.