Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Failed to create Kiro subscription - AccessDeniedException: Your account is not authorized to make this call

0

I am unable to create a Kiro subscription (Pro+) for a user via the Kiro console.

Error message: Failed to create Kiro subscription for 1 user Your account is not authorized to make this call.

Account details:

  • AWS Account ID: 791041134803
  • Account is the Organization Management Account
  • IAM Identity Center Instance ID: ssoins-72238e02bf02daf7
  • IAM Identity Center Region: us-east-1
  • Instance type: Organization instance
  • Sign-in URL: https://d-9066191238.awsapps.com/start

Enabled service principals:

  • sso.amazonaws.com
  • user-subscriptions.amazonaws.com

I have already verified:

  1. Operating from the Organization Management Account
  2. Using an IAM user with AdministratorAccess (not root)
  3. IAM Identity Center is an Organization instance in us-east-1
  4. Attempted to enable q.amazonaws.com / member.org.q.amazonaws.com / codewhisperer.amazonaws.com (all returned UNRECOGNIZED_SERVICE_PRINCIPAL)

The error occurs consistently when trying to assign a Kiro Pro+ subscription to a user in the Kiro console (Users & Groups → Add user).

Please investigate the backend provisioning status for this account and help resolve the AccessDeniedException.

  • Florian Turnwald EXPERT
    a month ago

    If my answer was helpful, I would appreciate it if you could mark it as the accepted answer.

Topics
Management & GovernanceDeveloper ToolsGenerative AI on AWS
Tags
AWS OrganizationsKiro
Language
English

asked a month ago122 views

1 Answer
1

When an IAM user with AdministratorAccess receives an AccessDeniedException while attempting to create subscriptions in the Management Account, it typically stems from one of two issues outside of standard IAM policies:

  • Service Control Policies (SCPs): Check your AWS Organizations configuration to ensure no SCP at the Root or OU level is implicitly or explicitly denying this action.
  • Account Verification Hold: AWS frequently places automated backend blocks on accounts preventing the provisioning of paid subscriptions (like Pro+ tiers) until the account is fully vetted.

Since you have already verified your IAM permissions and Identity Center setup, if your SCPs are not blocking the request, this cannot be resolved via the console. You will need to open a case with AWS Billing and Account Support and ask them to check for any backend provisioning holds on your account.

References:

EXPERT

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content