hello,
I am writing to request urgent assistance regarding a critical blocker that has prevented me from completing the Kiro IDE onboarding process for my AWS account. I have been troubleshooting this issue for approximately one full day (8+ hours) without success, and I am completely blocked from using Kiro.
🔷 Problem Description
I am trying to onboard Kiro for my organization and subscribe users through the AWS Console. However, I am encountering two separate errors that are completely blocking the process:
Error 1 — Kiro Console (User Subscription):
1 kullanıcı için Kiro aboneliği oluşturulamadı
Your account is not authorized to make this call.
Error 2 — Kiro IDE (Authentication):
Authentication with IAM Identity Center failed.
Please verify you have an active subscription.
For more information: https://kiro.dev/docs/troubleshooting/#aws-iam-identity-center-issues
🔷 Everything I Have Tried (Chronological Order)
Step 1 — Created a Custom IAM Policy (KiroAdminPolicy)
Following the official Kiro documentation for administrator permissions, I created a custom IAM policy named KiroAdminPolicy with the following permission sets:
sso:ListInstances, sso:CreateInstance, sso:CreateApplication, and all related SSO actions
iam:ListRoles, iam:CreateServiceLinkedRole (scoped to AWSServiceRoleForAmazonQDeveloper)
identitystore:DescribeUser
sso-directory:* (GetUserPoolInfo, DescribeUser, DescribeUsers, DescribeGroups, SearchGroups, SearchUsers, DescribeDirectory)
signin:ListTrustedIdentityPropagationApplicationsForConsole, signin:CreateTrustedIdentityPropagationApplicationForConsole
user-subscriptions:* (ListClaims, ListApplicationClaims, ListUserSubscriptions, CreateClaim, DeleteClaim, UpdateClaim, SetOverageConfig)
organizations:* (DescribeAccount, DescribeOrganization, ListAWSServiceAccessForOrganization, DisableAWSServiceAccess, EnableAWSServiceAccess)
kms:* (ListAliases, CreateGrant, Encrypt, Decrypt, GenerateDataKey*, RetireGrant, DescribeKey)
codeguru-security:UpdateAccountConfiguration
codewhisperer:* (UpdateProfile, ListProfiles, TagResource, UnTagResource, ListTagsForResource, CreateProfile)
q:* (ListDashboardMetrics, CreateAssignment, DeleteAssignment, UpdateAssignment)
cloudwatch:GetMetricData, cloudwatch:ListMetrics
Step 2 — Attached Policy to kiro-admin User
aws iam attach-user-policy
--user-name kiro-admin
--policy-arn arn:aws:iam::619544672849:policy/KiroAdminPolicy
Run in CloudShell
✅ Successful
Step 3 — Verified Attached Policies on kiro-admin
aws iam list-attached-user-policies --user-name kiro-admin
Run in CloudShell
Result:
{
"AttachedPolicies": [
{
"PolicyName": "KiroAdminPolicy",
"PolicyArn": "arn:aws:iam::619544672849:policy/KiroAdminPolicy"
},
{
"PolicyName": "AdministratorAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
}
]
}
✅ Both AdministratorAccess and KiroAdminPolicy are attached — permissions should not be the issue.
Step 4 — Verified AWS Organizations Service Access
aws organizations list-aws-service-access-for-organization
Run in CloudShell
Result:
{
"EnabledServicePrincipals": [
{ "ServicePrincipal": "iam.amazonaws.com" },
{ "ServicePrincipal": "license-manager.amazonaws.com" },
{ "ServicePrincipal": "sso.amazonaws.com" },
{ "ServicePrincipal": "user-subscriptions.amazonaws.com" }
]
}
✅ All required service principals are enabled.
Step 5 — Verified IAM Identity Center Instance
aws sso-admin list-instances
Run in CloudShell
Result:
{
"Instances": [
{
"InstanceArn": "arn:aws:sso:::instance/ssoins-7223db861f3ccde7",
"IdentityStoreId": "d-9066790d0b",
"OwnerAccountId": "619544672849",
"Status": "ACTIVE",
"PrimaryRegion": "us-east-1"
}
]
}
✅ IAM Identity Center instance is ACTIVE in us-east-1.
Step 6 — Attempted Kiro Profile Creation via Console
Logged into AWS Console as kiro-admin
Navigated to the Kiro Console in us-east-1
Attempted to complete the "Sign up for Kiro" / "Create Kiro profile" step
❌ The profile creation step appears to be failing — either silently or with an authorization error
Step 7 — Attempted User Subscription via Kiro Console
Navigated to Users & Groups → Users → Add user
Searched for target user
Selected subscription tier
Clicked "Assign"
❌ Error: Your account is not authorized to make this call
Step 8 — Attempted Kiro IDE Authentication
Opened Kiro IDE
Attempted to sign in via IAM Identity Center
❌ Error: Authentication with IAM Identity Center failed. Please verify you have an active subscription.
🔷 Suspected Root Cause
Despite having AdministratorAccess on the kiro-admin user, the Kiro profile creation step appears to be failing. This suggests one of the following:
The Kiro profile has not been successfully initialized for account 619544672849 in us-east-1, which is blocking all downstream operations (user subscriptions, IDE authentication)
There may be a missing service-level enablement that is not covered by IAM permissions alone (e.g., a backend activation step on AWS's side)
There may be an account-level restriction or prerequisite that has not been met for Kiro onboarding
🔷 Questions for AWS Support
Why is the kiro-admin user (with AdministratorAccess) receiving "not authorized" errors when trying to create a Kiro profile or assign user subscriptions?
Is there an additional account-level activation or enablement step required for Kiro that is not documented?
Can you check on your end whether account ************ has any blockers or missing prerequisites for Kiro onboarding in us-east-1?
Can you manually trigger or assist with the Kiro profile initialization for this account?
🔷 Business Impact
This issue has been blocking our team for approximately 1 full day. We are unable to use Kiro IDE at all, and all onboarding attempts have failed. We would greatly appreciate an urgent response.
Thank you for your assistance.
*Edit: Removed account ID — Aimee K.
