Introducing improved enterprise sign-in controls
Shweta V A
Product
Until now, there was no way to control how enterprise users sign in to Kiro on managed devices. Even if your organization requires IAM Identity Center, users can still sign in to Kiro with a personal account (Google, GitHub, or Builder ID).
Kiro now lets administrators decide which sign-in methods are available, so users will only see the options your organization allows.
With sign-in controls, administrators can:
- Restrict sign-in methods: show only the options the organization supports and hide the rest.
- Prefill IAM Identity Center details: so users never have to look up a start URL or region.
- Add a help link: point users to their organization’s IT support page right from the sign-in screen.
- Enable or disable device code flow: manage sign-in from environments without a browser, like remote machines, directly from the Kiro console.
Users see only what administrators allow. If a user tries to bypass a restriction, Kiro refuses the sign-in.
Administrators define sign-in rules in managed-settings.json, the admin-protected configuration file that Kiro reads on each machine. (See the documentation for more details.) These controls apply to sign-ins started from both Kiro IDE and Kiro CLI, including the device flow.
Here is a configuration that restricts users to IAM Identity Center, prefills your organization’s start URL and region, and adds a link to the organization’s IT help page:
The rule denies every sign-in method except idc (IAM Identity Center). Users see only the “Your organization” option on the sign-in screen. idc_start_url and idc_region prefill the Identity Center form so users don’t have to manually enter the details. signin_help_url adds a link to your IT help page, visible during sign-in for any user who gets stuck.
Admin rules use deny with either exclude (allowlist) or match (blocklist). To deny specific methods and leave the rest available, use match:
| Name | Sign-in option |
|---|---|
idc | Your organization (AWS IAM Identity Center) |
builder_id | AWS Builder ID |
google | |
github | GitHub |
social | Google and GitHub (shorthand) |
Add these under the top-level settings key. Each one is optional.
| Setting | What it does |
|---|---|
idc_start_url | Prefills the IAM Identity Center start URL. Must be https://. |
idc_region | Prefills the IAM Identity Center region. Used only with idc_start_url. |
signin_help_url | Shows your IT help page link on the sign-in screen. Must be https://. |
Beyond the sign-in screen, administrators can enable or disable device code flow directly from the Kiro console.
Sign-in controls are available starting with Kiro IDE 1.2 and Kiro CLI 2.29.0 in US East (N. Virginia) and Europe (Frankfurt) regions. Users must upgrade to these versions or later to access the feature. For more details, check out the documentation.