That command and its docs have been added but not yet released - you can see the awsaccounts script here in the meantime: https://github.com/cloud-custodian/cloud-custodian/blob/main/tools/c7n_org/c7n_org/orgaccounts.py You can run that script with a

--role

option to customize the role it generates in the config - by default it uses

arn:aws:iam::{Id}:role/OrganizationAccountAccessRole