Amazon Kiro: Failed to create Kiro subscription for 1 user - Your account is not authorized to make this call

As far as I remember, this is a known issue related to AWS account verification, not your IAM or AWS Organizations configuration.

When provisioning user subscriptions for services like Amazon Kiro (or Amazon Q Developer), AWS performs internal account health and security checks. If an account is relatively new, lacks sufficient billing history, or hasn't completed specific backend verification steps, AWS imposes an internal security hold.

This hold blocks the subscription API and returns the generic Your account is not authorized to make this call error (internally known as a CSCoreAccessDenied exception). Because this is a hard account-level block, it will fail identically whether you use the AWS root user or a fully privileged IAM Administrator. (Additionally, the UNRECOGNIZED_SERVICE_PRINCIPAL error you saw is simply because Kiro does not use that specific Org service principal for this assignment action).

How to resolve this: You cannot fix this via IAM policies or CLI commands. You must contact AWS Support to have the hold manually lifted.

1. Go to the AWS Support Center.
2. Create a case under Account and billing (this is free and does not require a paid technical support plan).
3. Inform them that your account is hitting the "not authorized" verification block when trying to create an Amazon Kiro subscription, and request that they manually verify and unblock your account.

Once AWS Support removes the restriction, your current IAM Administrator setup will work without any further changes.

Hello.

I have encountered similar errors in the past; as the error message suggests, there is a possibility that some form of restriction has been imposed on the AWS side.
In this case, since it cannot be resolved by the user, I believe you will need to contact AWS support and open a case under "Account and billing".
Inquiries regarding "Account and billing" are free of charge.
https://console.aws.amazon.com/support

There are reports that the operation succeeded when performed by an IAM user rather than the root user, as mentioned in the answer below, so please check that out.
https://repost.aws/questions/QUwZu3J-vzRcqYFhNQsNlvHg/amazon-q-developer-kiro-subscription-failing-with-cscoreaccessdenied-your-account-is-not-authorized-to-make-this-call

Hello @Jubaid Hasan,

Could an AWS engineer please verify whether there is a backend entitlement, account provisioning issue, service allowlisting requirement, or missing service authorization associated with AWS Account 547268988271 that is preventing Kiro subscription creation? Since the issue reproduces with both the AWS root user and a full administrator account, this appears to be beyond standard IAM configuration.

If necessary, please escalate this case to the Amazon Kiro service team for investigation and verification of account-level provisioning or entitlement status.

Additional Diagnostic Information Requested

If available, please check:

Whether the AWS account is entitled/allowlisted for Amazon Kiro. Whether Kiro subscription APIs are successfully enabled for this account. Whether any backend provisioning workflow is failing. Whether there are known issues affecting first-time Kiro subscription creation in us-east-1. Relevant CloudTrail request IDs or internal service logs associated with the failed subscription attempts.