The module is designed to be deployed in a dedicated account within an AWS Organization, this account must be delegated certain abilities for the module to function. See our Architecture documentation ...