Kiro/Amazon Q Developer subscription failing: account does not meet requirements

Question

Hello  ,

I am trying to use **Amazon Q Developer & Kiro** in my AWS Organization Management  account (Region: `us-east-1`), but I consistently encounter the following error when attempting to create an assignment:
![The Error ](/media/postImages/original/IMNVnIQYYYS-iA9iidIeSBtg)

on Checking CloudTrail i found this

```
AccessDenied: Account does not meet requirements for this operation
```

I have taken the following steps to troubleshoot:

### **Steps Taken**

1. **Verified AWS Organizations**

```bash
   aws organizations describe-organization
   ```

* Confirmed Organizations is enabled and my account is part of it.

2. **Checked AWS Service Access**

```bash
   aws organizations list-aws-service-access-for-organization
   ```

* Currently enabled services: `sso.amazonaws.com` and `user-subscriptions.amazonaws.com`
   * Attempted to enable `q.amazonaws.com`:

```bash
     aws organizations enable-aws-service-access --service-principal q.amazonaws.com
     ```

Result:

```
     InvalidInputException: UNRECOGNIZED_SERVICE_PRINCIPAL
     ```

3. **Verified Identity Center (SSO)**

* Identity Center is enabled in `us-east-1`
   * Users and permission sets are configured

4. **Tried AWS CLI**

```bash
   aws q create-assignment ... --debug
   ```

* CLI response:

```
     argument command: Found invalid choice 'q'
     ```
   * Shows that the CLI does not recognize the `q` service

5. **Tried different regions**

* Including `us-west-2`
   * Same results

---

### **Documentation Consulted**

* [Amazon Q Developer User Guide](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/unable-to-subscribe-standalone.html)
* [AWS Organizations Service Access Documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_sa.html)

---

### **Question**

* Is **Amazon Q Developer restricted to specific accounts** or require a **feature flag / allowlist**?
* Are there additional **prerequisites** for account eligibility that are not documented?
* How can I enable this service for my AWS account ?

Florian Turnwald · Answer

I guess the "Account does not meet requirements" error and the CLI failure are caused by three specific configuration gaps, not a lack of permissions:

**1.	Identity Center Instance Type:** Amazon Q Developer Pro requires an Organization Instance of IAM Identity Center. If you are using an "Account Instance" (limited to a single account), the subscription will fail.

**2.	Outdated AWS CLI:** The error invalid choice 'q' means your local AWS CLI version predates the launch of Amazon Q. You must update to the latest AWS CLI v2 to recognize the aws q command.

**3.	Incorrect Service Principal:** The service principal `q.amazonaws.com` is often not recognized for manual organization enablement. You should use codewhisperer.amazonaws.com, as Amazon Q Developer still operates under this underlying service principal for many organizational features.

**How to Fix:**
- Update CLI: Run the latest installer for AWS CLI v2.
- Upgrade Identity Center: Ensure your IAM Identity Center is enabled for the entire Organization (check "Settings" in the Identity Center console).
- Enable Service Access: Use the correct principal:
`aws organizations enable-aws-service-access --service-principal codewhisperer.amazonaws.com`
- Console Setup: Always use the Amazon Q Developer console (not the standard Amazon Q Business console) to trigger the initial handshake.

re:Post Agent · Answer

Based on the error you're encountering, there are several potential issues to address:

**Verify Your Permissions:**
Ensure you have the minimum permissions required to subscribe users to Amazon Q Developer Pro. You need specific IAM permissions to access and use the Amazon Q Developer console. After obtaining the necessary permissions, reload the console page to access Amazon Q.

**Confirm You're in the Correct Console:**
Make sure you're accessing the Amazon Q Developer console specifically, not the Amazon Q console. These are separate services with different interfaces.

**Check Regional Support:**
Verify that you're operating in a supported AWS Region for Amazon Q Developer. While you mentioned trying us-east-1 and us-west-2, confirm these regions support the Q Developer console and Q Developer profile functionality.

**Follow the Correct Workflow:**
Since you're working with an AWS Organization Management account, ensure you're following the appropriate workflow for subscribing users in a management account. The process differs depending on whether you're using a standalone account, management account, or member account.

**Identity Center Configuration:**
For IAM Identity Center workforce users, verify that identity-enhanced console sessions are enabled. This feature is only available with organization instances of IAM Identity Center. Note that account instances of IAM Identity Center don't support console access for Amazon Q Developer Pro subscriptions.

The "account does not meet requirements" error typically indicates a configuration issue with permissions, Identity Center setup, or the subscription workflow rather than an account-level restriction or allowlist requirement.  
**Sources**  
[Users unable to use their subscription on AWS websites - Amazon Q Developer](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/unable-to-use-pro-on-websites.html)  
[Unable to subscribe users - Amazon Q Developer](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/unable-to-subscribe-standalone.html)

Kiro/Amazon Q Developer subscription failing: account does not meet requirements

Steps Taken

Documentation Consulted

Question

Add your answer

Relevant content