AWS Certified DevOps Engineer - Professional DOP-C02 — Topic 1 Question 247

Question

A company uses an organization in AWS Organizations to manage its AWS accounts. The company's DevOps team has developed an AWS Lambda function that calls the Organizations API to create new AWS accounts. The Lambda function runs in the organization's management account. The DevOps team needs to move the Lambda function from the management account to a dedicated AWS account. The DevOps team must ensure that the Lambda function has the ability to create new AWS accounts only in Organizations before the team deploys the Lambda function to the new account. Which solution will meet these requirements?

Accepted Answer

Correct answer: A. The correct answer is A. Option A: In the management account, create a new IAM role that has the necessary permission to create new accounts in Organizations. Allow the role to be assumed by the Lambda execution role in the new AWS account. Update the... AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

AWS Certified DevOps Engineer - Professional DOP-C02 — Question 247