Kiro subscription creation fails from IAM Identity Center with AccessDeniedException: Your account is not authorized to make this call

The AccessDeniedException: "Your account is not authorized to make this call" returned when creating a Kiro subscription is usually not about your user's IAM permissions (you've already confirmed you have administrative access). This message comes from the Kiro control plane and means the account or the IAM Identity Center instance you're operating from doesn't meet one of the service-level prerequisites. Here are the causes to check, in order of likelihood.

1. Are you operating from the correct account? (most common cause)

Managing Kiro subscriptions with IAM Identity Center must be done from the organization management account, or from an account that is explicitly registered as a delegated administrator for IAM Identity Center / Kiro. If you're creating subscriptions from an ordinary member account — even one with full administrative IAM permissions — the control plane returns not authorized to make this call, because authorization is evaluated at the organization level, not at the individual account's IAM level.

• Confirm which account you're operating from.
• If it isn't the management account, either register the account as a delegated administrator for IAM Identity Center, or perform the operation from the management account.

2. Is your Identity Center instance an organization instance, not an account instance?

There are two types of IAM Identity Center instance: an organization instance and an account (standalone) instance. The Kiro enterprise subscription experience requires an organization instance. With an account/standalone instance, subscription creation can fail with this error. Check the instance type in the IAM Identity Center console; if it's an account-level instance, enable an organization instance (this requires AWS Organizations, which you already have enabled).

3. Supported Region

Your IAM Identity Center instance must be in a Region supported by Kiro. If the instance is in an unsupported Region, the control plane rejects the call. Confirm your instance is in a supported Region per the Kiro IAM Identity Center documentation.

4. SCPs blocking the service actions

Even if your role is an administrator, a Service Control Policy at the AWS Organizations level can implicitly or explicitly deny the service actions (Kiro uses the q.amazonaws.com service principal). A restrictive SCP produces an access-denied that has nothing to do with your user's IAM permissions.

• In the Organizations console → Service Control Policies, verify that no SCP denies Kiro / Amazon Q actions (q:*) or sso:* / identitystore:*.
• Alternatively, search CloudTrail for the AccessDenied events at the time of the failure — they identify the exact action and any SCP blocking it.

5. Customer-managed KMS key on Identity Center

If your IAM Identity Center instance is encrypted with a customer-managed KMS key, you must add key-policy statements that allow Kiro (q.amazonaws.com) to decrypt data via IAM Identity Center and the Identity Store. Without these grants, Kiro can't read the identities and the operation fails. The exact policy statements are in the Kiro — Connect your IAM Identity Center docs (the KMS encryption section).

Fastest way to diagnose

CloudTrail is the quickest signal: look for the access-denied event generated at the moment of the failure. It tells you the exact API call, the account/principal, and whether the cause is an SCP (explicitDeny) or a missing prerequisite. This distinguishes between the five scenarios above within minutes.

Recommended sequence

1. Confirm you're operating from the management account or a registered delegated administrator.
2. Verify the Identity Center instance is an organization instance, not an account instance.
3. Confirm the Region is supported.
4. Check SCPs + CloudTrail for the access-denied.
5. If you use a customer-managed KMS key, add the grants for q.amazonaws.com.

If the error still persists identically for all users after these checks, and CloudTrail shows no SCP deny, it's likely a backend service provisioning issue. At that point, open an AWS Support case including your account ID, the IAM Identity Center instance ARN, the Region, and the request ID from the CloudTrail event — that routes it to the right team much faster than "subscription creation is failing."

Useful references:

• Connect your IAM Identity Center (Kiro docs)
• Subscribing your team to Kiro
• Enabling identity-enhanced console sessions