Audit Kiro Tool Calls with AWS CloudTrail
Kiro now records calls to Kiro service MCP tools in AWS CloudTrail for Kiro profiles in US East (N. Virginia) (us-east-1) and Europe (Frankfurt) (eu-central-1). Security and audit teams can see who made a request, which tool was called, when it ran, and whether it completed.
CloudTrail logs privileged tool calls as management events by default. Administrators can also log tool listings and read-only tool calls by enabling data events. Events redact tool arguments and omit results. This logging covers Kiro service tools only, not MCP servers added to Kiro.