Your organization uses AWS Control Tower and enrolled all existing accounts. You want all newly created AWS accounts to be automatically enrolled in Control Tower. You have an existing Step Functions workflow (in the same account as Control Tower) that creates new accounts. Which two steps should you add to the workflow to ensure new accounts are enrolled in Control Tower? (Choose two.)

To enroll a new account into AWS Control Tower programmatically, you must first create the AWSControlTowerExecution role within the new account. This role grants Control Tower the necessary permissions to manage the account. After the role is in place, you then call the AWS Service Catalog ProvisionProduct API. Control Tower uses Service Catalog to provision and manage accounts, and calling this API initiates the enrollment process, integrating the new account into your Control Tower landing zone. The other options are incorrect because: Emitting an EventBridge event with aws.controltower and CreateManagedAccount or SetupLandingZone detail types is not the correct API interaction for enrolling an account. These event types are typically emitted by Control Tower, not used to initiate actions on Control Tower. Calling Organizations EnableAWSServiceAccess is used to enable trusted access for a service within AWS Organizations, but it does not directly enroll an account into Control Tower. Control Tower handles this integration automatically once the account is provisioned via Service Catalog.