Answers: <p>While the WorkDocs API describes <code>create-user</code> as creating a user in the Directory Service (and does), it also activates the user as a WorkDocs user.  As a result, it can only be called when the directory is associated with WorkDocs (i.e. when the directory is &quot;enabled&quot; in WorkDocs).  These errors can occur when WorkDocs is not enabled.</p>
  <p>These errors can arise, for example, if you're trying to create users for WorkSpaces using the WorkDocs API since a comparable API isn't available for WorkSpaces.  To enable WorkDocs, do one of the following:</p>
  <ul>
  <li>Use <code>EnableWorkDocs</code> when registering the Directory with WorkSpaces</li>
  <li>Manually create a site on the WorkDocs page</li>
  </ul>
  <p>WARNING:  Even if you allocate no storage, it appears these users will incur WorkDocs charges unless you also <code>deactivate_user</code>.<br />
  WARNING:  <code>EnableWorkDocs</code> is not fully reversible from the API i.e. you cannot delete the Directory Service from the API if a WorkDocs site exists and the site cannot be removed from the API (likely for data protection reasons)</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-17T16:40:37.160Z
Answers: 2020-07-27T15:31:53.987Z
Answers: 2020-07-27T15:31:53.987Z
Answers: claytond
Body: <p>When calling <code>aws workdocs create-user</code>, I'm getting <code>UnauthorizedResourceAccessException</code> or <code>UnauthorizedOperationException</code>.  I believe I have all of the permissions required.  What could be causing this?</p>
  
Tags: <aws-cli><aws-cloudformation>
Title: `UnauthorizedResourceAccessException` when calling `aws workdocs create-user`
UserDisplayName: claytond
ThreadText: # `UnauthorizedResourceAccessException` when calling `aws workdocs create-user`
  
  (Asked by: username_0 on 2020-07-17)
  
  When calling `aws workdocs create-user`, I'm getting `UnauthorizedResourceAccessException` or `UnauthorizedOperationException`. I believe I have all of the permissions required. What could be causing this?
  
  **Tags:** aws-cli, aws-cloudformation
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-07-17. Score: 1
  
  While the WorkDocs API describes `create-user` as creating a user in the Directory Service (and does), it also activates the user as a WorkDocs user. As a result, it can only be called when the directory is associated with WorkDocs (i.e. when the directory is "enabled" in WorkDocs). These errors can occur when WorkDocs is not enabled.
  
  These errors can arise, for example, if you're trying to create users for WorkSpaces using the WorkDocs API since a comparable API isn't available for WorkSpaces. To enable WorkDocs, do one of the following:
  
  * Use `EnableWorkDocs` when registering the Directory with WorkSpaces
  * Manually create a site on the WorkDocs page
  
  WARNING: Even if you allocate no storage, it appears these users will incur WorkDocs charges unless you also `deactivate_user`.  
  WARNING: `EnableWorkDocs` is not fully reversible from the API i.e. you cannot delete the Directory Service from the API if a WorkDocs site exists and the site cannot be removed from the API (likely for data protection reasons)
  
  
  ---
  
  