Create a cross-account role in the management account that the new account's Lambda execution role can assume

Why the Answer Is Correct

Creating AWS accounts is an operation only the Organizations management account can perform, so after moving the Lambda function to a dedicated account the function can no longer call it with its own credentials. The correct pattern is to create an IAM role in the management account that carries the Organizations account-creation permissions, and to have the new account's function assume it. The role's trust policy therefore names the Lambda execution role in the new account as the principal permitted to assume it, which is the identity that actually presents credentials when the function runs. The function code is updated to assume the role when it calls CreateAccount, and the execution role is granted sts:AssumeRole so it can perform that assumption (A). This confines the function's authority to exactly the account-creation capability while keeping the permission in the management account where it must live. A is the correct answer.

Why the Other Options Are Wrong

B turns on delegated administration for Organizations and creates a delegation policy granting the new account permission to create accounts. Account creation is not a permission that Organizations delegation can grant to a member account in this way, so the delegation policy would not authorize the CreateAccount call and the requirement that the function be able to create accounts before deployment would not be met. C creates the same management-account role but allows the Lambda service principal to assume it. The principal that presents credentials when the function executes is its execution role, not the Lambda service principal, so trusting the service principal does not establish the required trust relationship for the new account's function. D enables AWS Control Tower, turns on delegated administration for it, creates a resource policy allowing the new account to create accounts, and switches the function to the Control Tower API with the controltower:CreateManagedAccount permission. That permission is part of the Control Tower account-provisioning workflow and is not a general grant to an arbitrary account's Lambda function, so this approach does not give the function the account-creation authority it needs. A is correct.

Community Comment Notes

Community voted A unanimously. jamesf described the three parts of option A, the management-account role with Organizations permissions, the trust relationship allowing assumption by the new account's Lambda execution role, and the function code updated to assume the role when creating accounts. trungtd enumerated the implementation details, that the role includes actions such as organizations:CreateAccount and that the trust policy specifies the ARN of the Lambda execution role in the new account. tgv confirmed A. No alternative received support.