diff --git a/.changelog/39504.txt b/.changelog/39504.txt
new file mode 100644
index 00000000000..07524068b2f
--- /dev/null
+++ b/.changelog/39504.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+resource/aws_kinesis_stream: Tag on Create to support attribute-based access control (ABAC)
+```
\ No newline at end of file
diff --git a/internal/service/kinesis/generate.go b/internal/service/kinesis/generate.go
index f7017028acb..568cfdabb74 100644
--- a/internal/service/kinesis/generate.go
+++ b/internal/service/kinesis/generate.go
@@ -1,7 +1,7 @@
 // Copyright (c) HashiCorp, Inc.
 // SPDX-License-Identifier: MPL-2.0
 
-//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForStream -ListTagsInIDElem=StreamName -ServiceTagsSlice -TagOp=AddTagsToStream -TagOpBatchSize=10 -TagInCustomVal=updatedTags.IgnoreAWS().Map() -TagInIDElem=StreamName -UntagOp=RemoveTagsFromStream -UpdateTags -CreateTags
+//go:generate go run ../../generate/tags/main.go -ListTags -ListTagsOp=ListTagsForStream -ListTagsInIDElem=StreamName -ServiceTagsSlice -TagOp=AddTagsToStream -TagOpBatchSize=10 -TagInCustomVal=updatedTags.IgnoreAWS().Map() -TagInIDElem=StreamName -UntagOp=RemoveTagsFromStream -UpdateTags
 //go:generate go run ../../generate/servicepackage/main.go
 // ONLY generate directives and package declaration! Do not add anything else to this file.
 
diff --git a/internal/service/kinesis/stream.go b/internal/service/kinesis/stream.go
index d8009ea1ffa..444bfc85b8b 100644
--- a/internal/service/kinesis/stream.go
+++ b/internal/service/kinesis/stream.go
@@ -165,6 +165,10 @@ func resourceStreamCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		input.ShardCount = aws.Int32(int32(d.Get("shard_count").(int)))
 	}
 
+	if tags := KeyValueTags(ctx, getTagsIn(ctx)).Map(); len(tags) > 0 {
+		input.Tags = tags
+	}
+
 	_, err := conn.CreateStream(ctx, input)
 
 	if err != nil {
@@ -240,10 +244,6 @@ func resourceStreamCreate(ctx context.Context, d *schema.ResourceData, meta inte
 		}
 	}
 
-	if err := createTags(ctx, conn, name, getTagsIn(ctx)); err != nil {
-		return sdkdiag.AppendErrorf(diags, "setting Kinesis Stream (%s) tags: %s", name, err)
-	}
-
 	return append(diags, resourceStreamRead(ctx, d, meta)...)
 }
 
diff --git a/internal/service/kinesis/tags_gen.go b/internal/service/kinesis/tags_gen.go
index 020134fd844..48eb1b5adf5 100644
--- a/internal/service/kinesis/tags_gen.go
+++ b/internal/service/kinesis/tags_gen.go
@@ -97,15 +97,6 @@ func setTagsOut(ctx context.Context, tags []awstypes.Tag) {
 	}
 }
 
-// createTags creates kinesis service tags for new resources.
-func createTags(ctx context.Context, conn *kinesis.Client, identifier string, tags []awstypes.Tag, optFns ...func(*kinesis.Options)) error {
-	if len(tags) == 0 {
-		return nil
-	}
-
-	return updateTags(ctx, conn, identifier, nil, KeyValueTags(ctx, tags), optFns...)
-}
-
 // updateTags updates kinesis service tags.
 // The identifier is typically the Amazon Resource Name (ARN), although
 // it may also be a different identifier depending on the service.