CloudFormation StackSets with service-managed permissions - service role blocked by SCP?

Question

I have a StackSet using service-managed permissions in order to utilize automatic deployments to accounts that you add to the organisation in the future. However I have SCPs for that organisation and no way to exclude the service roles that the StackSet creates from the SCP. 
The problem is I don't have the any way to know what these roles' arn or names are - they are created by CFN runtime. They all start with stacksets-exec-* and then some random id.
I tried to check member accounts cloudtrail events when those roles get a denied access error, but the event doesn't even carry information about which stackset started it in member account and assumed the service role. 
I don't see any way to exclude the service roles from SCP except for :
"Condition": {
                "StringNotLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::*:role/stacksets-exec-*"
]}
}
That however would allow any random stackset to bypass my SCP.

Answer

Hi Martin, just to confirm, you're able to see the CFN stack being deployed when you check the CloudFormation console in the Organizations root account? How about in the Member account?

Also, why do you need to block these roles?

CloudFormation StackSets with service-managed permissions - service role blocked by SCP?

Relevant content