An organization in AWS Organizations uses all-features and a hierarchy of OUs under the root. All OUs and accounts have been registered and enrolled in AWS Control Tower. The company must apply custom changes to the AWS Config configuration recorder in every current account and ensure the same customizations are applied automatically to any accounts enrolled into Control Tower in the future. Which set of steps meets this requirement?

The correct options involve using a centralized Lambda function to apply customizations. The first correct option describes creating a new account with a Lambda function that applies the customizations across all accounts. This is a valid approach for centralized management. The second correct option describes creating an IAM role in the Control Tower management account that a Lambda function can assume. This role is granted permissions to assume the AWSControlTowerExecution role in other accounts, allowing the Lambda function to perform actions across the organization. This is a secure and scalable way to manage cross-account access. The third correct option describes using an EventBridge rule in the Control Tower management account to trigger a Lambda function when accounts are enrolled or updated. This ensures that new accounts automatically receive the customizations. Re-registering OUs or updating the landing zone can also trigger this for existing accounts. The incorrect options are flawed because: Making an account an AWS Config delegated administrator only centralizes Config data, not the ability to customize recorders across accounts. Configuring AWSControlTowerExecution directly in each account for a Lambda function is not a scalable or centralized approach.