`UnauthorizedResourceAccessException` when calling `aws workdocs create-user`
While the WorkDocs API describes create-user as creating a user in the Directory Service (and does), it also activates the user as a WorkDocs user.  As a result, it can only be called when the directory is associated with WorkDocs (i.e. when the directory is &quot;enabled&quot; in WorkDocs).  These errors can occur when WorkDocs is not enabled.
These errors can arise, for example, if you're trying to create users for WorkSpaces using the WorkDocs API since a comparable API isn't available for WorkSpaces.  To enable WorkDocs, do one of the following:

Use EnableWorkDocs when registering the Directory with WorkSpaces
Manually create a site on the WorkDocs page

WARNING:  Even if you allocate no storage, it appears these users will incur WorkDocs charges unless you also deactivate_user.
WARNING:  EnableWorkDocs is not fully reversible from the API i.e. you cannot delete the Directory Service from the API if a WorkDocs site exists and the site cannot be removed from the API (likely for data protection reasons)