A Lambda function that creates AWS accounts via the Organizations API currently runs in the management account. You must move that Lambda to a separate AWS account but still allow it to create accounts in the organization, with its ability restricted to Organizations only. What approach meets this requirement before deploying the Lambda into the dedicated account?

The correct approach involves cross-account role assumption. The management account, which owns the AWS Organizations, must grant permissions for account creation. By creating an IAM role in the management account with organizations:CreateAccount permissions and a trust policy allowing the Lambda execution role in the dedicated account to assume it, you establish a secure cross-account access mechanism. The Lambda function's code is then updated to explicitly assume this management account role before making Organizations API calls. This ensures the Lambda operates with the necessary permissions, restricted to Organizations, without directly granting permissions to the dedicated account itself. Incorrect options: Delegated administration for Organizations does not directly grant an account permission to create other accounts; it delegates management of specific Organization features. Allowing the Lambda service principal to assume a role in the management account would mean the Lambda in the management account could assume it, not a Lambda in a separate account. AWS Control Tower is a separate service for governing multi-account environments and isn't strictly required to move an Organizations API-calling Lambda. The question specifies Organizations API, not Control Tower API.