Configuring a firewall, proxy server, or data perimeter for Kiro

If your network uses a firewall, proxy server, or data perimeter, you need to allowlist specific URLs so Kiro can reach its backend services. This page lists every domain Kiro contacts, grouped by function.

Network traffic overview

Kiro makes two types of outbound connections:

• IDE traffic — Requests from the Kiro process (chat, completions, telemetry, updates, extensions). This traffic respects your proxy settings.
• Browser traffic — Sign-in opens your default browser. This traffic uses your OS network stack and bypasses IDE proxy settings.

Your firewall must allow both at the network level.

Core URLs

Every Kiro installation needs the following URLs. These cover sign-in, chat and code assistance, telemetry, and auto-updates.

If your network policy allows wildcard rules, you can allowlist *.kiro.dev instead of the first four individual domains.

IAM Identity Center

If your organization uses AWS IAM Identity Center for authentication, allowlist these additional endpoints.

Replace idc-directory-id-or-alias with your IAM Identity Center instance's directory ID or alias, and sso-region with the AWS Region where your instance is enabled. For more information, see What is IAM Identity Center? in the IAM Identity Center User Guide.

External identity providers

If your organization uses an external identity provider (IdP) with IAM Identity Center, the sign-in flow redirects through your IdP's domain. You need to allowlist that domain too.

Check with your identity team for the exact domain if you are unsure which IdP is configured.

AWS GovCloud

If you use AWS GovCloud (US), allowlist these FIPS-compliant endpoints instead of the commercial Kiro service endpoints in the Core URLs table:

• q-fips.us-gov-east-1.amazonaws.com
• q-fips.us-gov-west-1.amazonaws.com

Subscription management

If you sign in with Google, GitHub, or AWS Builder ID, Kiro uses Stripe for subscription billing. Allowlist these domains to access the billing portal and upgrade plans.

Enterprise customers using IAM Identity Center don't need these domains.

Optional URLs

You only need these if you use the corresponding Kiro feature. Skip any that don't apply to your environment.

Proxy configuration

Kiro respects standard proxy environment variables for all IDE traffic:

• HTTP_PROXY
• HTTPS_PROXY
• NO_PROXY

You can also configure proxy settings in Settings > Proxy inside Kiro.

Data perimeters

If you use data perimeters on AWS to restrict access to trusted identities and resources, make sure your policies allow Kiro's service principals to reach the endpoints listed on this page. For VPC-level controls, see VPC endpoints (AWS PrivateLink).