`UnauthorizedResourceAccessException` when calling `aws workdocs create-user`

While the WorkDocs API describes create-user as creating a user in the Directory Service (and does), it also activates the user as a WorkDocs user. As a result, it can only be called when the directory is associated with WorkDocs (i.e. when the directory is "enabled" in WorkDocs). These errors can occur when WorkDocs is not enabled.

These errors can arise, for example, if you're trying to create users for WorkSpaces using the WorkDocs API since a comparable API isn't available for WorkSpaces. To enable WorkDocs, do one of the following:

• Use EnableWorkDocs when registering the Directory with WorkSpaces
• Manually create a site on the WorkDocs page

WARNING: Even if you allocate no storage, it appears these users will incur WorkDocs charges unless you also deactivate_user.
WARNING: EnableWorkDocs is not fully reversible from the API i.e. you cannot delete the Directory Service from the API if a WorkDocs site exists and the site cannot be removed from the API (likely for data protection reasons)