How do I resolve the "AccessDeniedException" error when I use the create-group AWS CLI command to create Quick Suite groups?

Short description

You might receive the following error messages when you use the AD Connector to sign in to Amazon Quick Suite:

"An error occurred (AccessDeniedException) when calling the CreateGroup operation: Group operations are not enabled for this account."

Quick Suite manages only the identities that are created and maintained in Quick Suite. If AD Connector is set up, then AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) groups are used.

The AWS Managed Microsoft AD groups are used to map users to admin, author, and reader roles. You can't use the create-group AWS CLI command to create Quick Suite managed groups when you manage users through AWS Managed Microsoft AD.

Resolution

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Use AWS Managed Microsoft AD to create groups

You can create at least three groups after you establish your Active Directory:

• Amazon Quick Suite admins
• Amazon Quick Suite authors
• Amazon Quick Suite readers

Note: Only the Enterprise edition of Quick Suite supports AD Connector and AWS Managed Microsoft AD. For more information, see AWS Managed Microsoft AD best practices.

Use the AWS CLI Command to create groups

To use the AWS CLI to create and manage Quick Suite groups, you must first unsubscribe from Quick Suite. Then, re-subscribe and change how you connect to Quick Suite to use AWS Identity and Access Management (IAM) identities and Quick Suite managed users. For more information, see Identity and access management in Quick Suite.

Note: When you unsubscribe, Quick Suite deletes all users, data, and assets.

Related information

Can I use AWS Managed Microsoft AD to authenticate users in Quick Suite?