Service: Amazon Q Developer / Kiro
Region: us-east-1
Account ID: 473688632013
Problem:
Unable to assign Kiro subscriptions to users. The Kiro control plane rejects the request with AccessDeniedException. After investigation, the root cause appears to be that q.amazonaws.com and codewhisperer.amazonaws.com are not provisioned as enabled service principals in my AWS Organization, and cannot be enabled manually.
Failing API call observed in browser network tab:
POST https://codewhisperer.us-east-1.amazonaws.com/
Payload: { "principalId": "745884e8-e071-70a1-d6e8-715ec74d89b1", "principalType": "USER", "subscriptionType": "Q_DEVELOPER_STANDALONE_POWER" }
Response: { "__type": "com.amazon.kiro.controlplane#AccessDeniedException", "message": "Your account is not authorized to make this call." }
HTTP Status: 400
CLI Evidence:
Service-linked role exists ✅
arn:aws:iam::473688632013:role/aws-service-role/q.amazonaws.com/AWSServiceRoleForAmazonQDeveloper
Current org service access list ✅
iam.amazonaws.com
member.org.stacksets.cloudformation.amazonaws.com
sso.amazonaws.com
user-subscriptions.amazonaws.com
q.amazonaws.com missing and cannot be enabled ❌
bash$ aws organizations enable-aws-service-access --service-principal q.amazonaws.com
InvalidInputException: UNRECOGNIZED_SERVICE_PRINCIPAL
codewhisperer.amazonaws.com same result ❌
bash$ aws organizations enable-aws-service-access --service-principal codewhisperer.amazonaws.com
InvalidInputException: UNRECOGNIZED_SERVICE_PRINCIPAL
Everything else is correctly configured:
AWS Organizations: enabled, management account
IAM Identity Center: enabled, Organization instance
Kiro profile: created successfully in us-east-1
SSO sign-in URL: generated successfully
User visible in Kiro "Add User" dialog
user-subscriptions.amazonaws.com: enabled
sso.amazonaws.com: enabled
Service-linked role: exists
Request:
Please investigate and remediate the backend provisioning for account 473688632013. Specifically:
Enable q.amazonaws.com org service access at the backend for this account
Confirm codewhisperer.amazonaws.com control plane entitlement is provisioned
Verify the account is entitled for Q_DEVELOPER_STANDALONE_POWER subscriptions
Perform any required manual activation steps on the backend
