AWS Control

AWS Control is a built-in Crew app that puts your connected AWS accounts on one surface. It ships disabled by default. Enable it from Apps > Library before use.

AWS Control covers four areas: reviewing account health, browsing and managing files in a private S3 drive, running cloud backups, and checking billing costs. Every paid service asks for your confirmation before its first use per account, and every change is on the record.

1. Open Apps > Library
2. Find AWS Control and click Enable

Open AWS Control and connect an account. Crew uses the AWS profile registry that the deploy engine maintains. Each connected account shows a health indicator (ok, degraded, or unknown) based on whether its configured profiles resolve to a live identity.

To disconnect an account, use the overflow menu on its row. Disconnecting drops only the local registry entry and its consent grants. Nothing in AWS is changed.

The Drive view is a private, versioned, owner-only S3 bucket scoped to your account. It is not a general S3 browser. The bucket is created only after you confirm it, and is hardened at creation with block public access, AES-256 server-side encryption, bucket owner enforced, and versioning enabled.

The Drive bucket hosts three sections on separate key prefixes:

• Files: your general drive files (drive/ prefix). Browse and create folders, delete a folder and everything under it (requires confirmation), and see the share ledger alongside each folder.
• Library: your cloud artifact library (artifacts/ prefix). Reports, outputs, and files you have saved or published there.
• Backup: cloud snapshots of your Crew install (backup/ prefix); see the Backup section below.

Share links always expire. Nothing is public unless you explicitly create a share.

The Backup view manages cloud snapshots of your Crew install.

Two backup kinds are supported:

• Snapshot: the standard Crew snapshot (memory, crons, config, skills, workspace, notifications, security component) uploaded to the backup/snapshots/ prefix
• Sessions archive: your full sessions transcript history uploaded to backup/sessions/

Click Back up now in the Backup view.

A restore downloads the archive to the /restore/ directory on the gateway host and gives you the local path. It does not hot-swap live state directly. To apply the restore, run kirocrew restore with the downloaded path:

kirocrew restore ~/.kiro/crew/restore/<snapshot-file>.tar.gz

This follows the same replace or merge restore flow as a local snapshot. See Snapshot and restore for the full reference, including Replace-mode recovery.

A nightly backup toggle is available per account. The nightly loop runs in the background and is authorized by the toggle you set.

The Bill view shows month-to-date spend and a projected total for the current month, grouped by AWS service. Data comes from Cost Explorer and is cached daily (CE data lags approximately 24 hours). The cache age is shown alongside the figures.

The projection is local arithmetic extrapolating month-to-date over the full month. No AWS Budgets resources are created.

Every action in AWS Control follows these principles:

• Consent-gated paid services: every service that incurs AWS charges asks for your confirmation before its first use per account
• Audit trail: every mutation is recorded in the Crew audit log
• Owner-only drive: the S3 bucket is private and restricted to the account that provisioned it; share links expire and nothing is public by default
• Read-only billing: the Bill view reads Cost Explorer data and never modifies billing configuration
• Local-only disconnect: removing an account removes the local registry entry and consent grants only; no AWS resources are touched

• Snapshot and restore for the restore reference and Replace-mode recovery
• Security for credential protection and the audit log