A newly acquired company’s single AWS account joined an AWS Organization and was moved into an OU. A DevOps engineer in the management account assumes the OrganizationAccountAccessRole to access member accounts, but attempting to assume the role via the console in the new member account fails with "Invalid information in one or more fields." What action will let the DevOps engineer access the new member account?

The OrganizationAccountAccessRole is not automatically created in member accounts when they join an AWS Organization. It must be manually created in each member account that needs to be accessed by the management account. The correct action is to create this role in the new member account with AdministratorAccess and a trust policy allowing the management account to assume it. Granting the DevOps engineer's IAM user permission in the management account is insufficient because the role itself doesn't exist in the target account. Creating a Service Control Policy (SCP) in the management account would not grant access to a specific user; SCPs define maximum permissions for accounts within an OU, not direct user access. Editing an existing OrganizationAccountAccessRole is incorrect because the role does not exist by default in newly joined accounts.