Certain API endpoints are not considered part of the availability guarantees. You might be able to verify and create IAM tokens, but not create new IAM roles, new S3 buckets etc. AWS sometimes advises that these operations shouldn't be done automatically, but not everybody listens.